Forgejo v7.0.10
Release notes
- Security bug fixes
- PR (backported): Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to timing attacks. A pre-condition for such an attack is the precise measurements of the time for each operation. Since it requires observing the timing of network operations, the issue is mitigated when a Forgejo instance is accessed over the internet because the ISP introduce unpredictable random delays.
- PR (backported): Because of a missing permission check, the branch used to propose a pull request to a repository can always be deleted by the user performing the merge. It was fixed so that such a deletion is only allowed if the user performing the merge has write permission to the repository from which the pull request was made.
- Localization
- PR (backported): Translation backports to v7
- Included for completeness but not worth a release note
100% Completed
Label
Project
Assignee
All assignees
No assignee
0ko
0xllx0
aahlenst
Alex619829
algernon
ashimokawa
Beowulf
c8h4
caesar
christopher-besch
cobak78
crystal
Cyborus
davrot
Dirk
dmowitz
efertone
emilylange
famfo
floss4good
fnetX
fogti
forgejo-backport-action
forgejo-end-to-end
forgejo-experimental-ci
forgejo-moderation
forgejo-release-manager
forgejo-release-notes-assistant
forgejo-renovate-action
Gusted
iamyaash
JakobDev
jerger
JSchlarb
KaKi87
kita
klausfyhn
Kwonunn
lenikadali
limiting-factor
litchipi
mahlzahn
Mai-Lapyst
Maks1mS
maltejur
marcellmars
mfenniak
msrd0
mysticmode
n0toose
nostar
oliverpool
pat-s
patdyn
patka
release-team
sclu1034
smartclip_tim
snematoda
Snoweuph
spiffyk
viceice
wetneb
Xinayder
xtex
0ko
0xllx0
aahlenst
Alex619829
algernon
ashimokawa
Beowulf
c8h4
caesar
christopher-besch
cobak78
crystal
Cyborus
davrot
Dirk
dmowitz
efertone
emilylange
famfo
floss4good
fnetX
fogti
forgejo-backport-action
forgejo-end-to-end
forgejo-experimental-ci
forgejo-moderation
forgejo-release-manager
forgejo-release-notes-assistant
forgejo-renovate-action
Gusted
iamyaash
JakobDev
jerger
JSchlarb
KaKi87
kita
klausfyhn
Kwonunn
lenikadali
limiting-factor
litchipi
mahlzahn
Mai-Lapyst
Maks1mS
maltejur
marcellmars
mfenniak
msrd0
mysticmode
n0toose
nostar
oliverpool
pat-s
patdyn
patka
release-team
sclu1034
smartclip_tim
snematoda
Snoweuph
spiffyk
viceice
wetneb
Xinayder
xtex
Sort
[v7.0/forgejo] use constant time check for internal token
All checks were successful
testing / frontend-checks (pull_request) Successful in 1m8s
testing / backend-checks (pull_request) Successful in 3m42s
testing / test-unit (pull_request) Successful in 7m57s
testing / test-mysql (pull_request) Successful in 22m33s
testing / test-sqlite (pull_request) Successful in 22m59s
testing / test-pgsql (pull_request) Successful in 26m58s
/ backporting (pull_request_target) Has been skipped
bug
confirmed
forgejo/security
worth a release-note
[v7.0/forgejo] add permission check to 'delete branch after merge'
All checks were successful
testing / frontend-checks (pull_request) Successful in 1m0s
testing / backend-checks (pull_request) Successful in 8m7s
testing / test-unit (pull_request) Successful in 8m6s
testing / test-mysql (pull_request) Successful in 19m17s
testing / test-sqlite (pull_request) Successful in 19m52s
testing / test-pgsql (pull_request) Successful in 22m34s
/ backporting (pull_request_target) Has been skipped
bug
confirmed
forgejo/security
worth a release-note
Translation backports to v7
All checks were successful
testing / frontend-checks (pull_request) Successful in 46s
testing / backend-checks (pull_request) Successful in 6m57s
testing / test-unit (pull_request) Successful in 6m31s
testing / test-mysql (pull_request) Successful in 16m29s
testing / test-sqlite (pull_request) Successful in 17m17s
testing / test-pgsql (pull_request) Successful in 18m56s
/ backporting (pull_request) Has been skipped
forgejo/i18n