Lunny Xiao e4ef995f2a fix(release): validate web attachment renames against allowed types (#38314) ...

This fixes the web release edit flow so renamed release attachments are
validated against `[repository.release] ALLOWED_TYPES`.

Previously, the API attachment edit endpoint already enforced release
attachment type restrictions, but the web release edit form passed
`attachment-edit-*` values into `release_service.UpdateRelease`, which
updated attachment names directly without validating the new filename
against `setting.Repository.Release.AllowedTypes`.

As a result, a user with repository write access could rename an
existing release attachment to a disallowed extension through the web
UI.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-07-04 15:02:17 +02:00

..

e2e

refactor: replace legacy delete-button with link-action (#38143)

2026-06-18 12:02:11 +00:00

fuzz

…

gitea-lfs-meta

…

gitea-repositories-meta

…

integration

fix(release): validate web attachment renames against allowed types (#38314)

2026-07-04 15:02:17 +02:00

testdata/data

…

mssql.ini.tmpl

…

mysql.ini.tmpl

…

pgsql.ini.tmpl

…

sqlite.ini.tmpl

fix: allow git clone of private repos with anonymous code access (#38074)

2026-06-13 12:02:02 +08:00

test_utils.go

…