Core Rule Set: a repository's name passes in the adopt form's id (closes #365)
check / check (push) Waiting to run
check / check (push) Waiting to run
While bodies are read, the admin forms that adopt or delete an unadopted repository were refused when the repository's name held a command or a system file's name, such as alice/python3-app, alice/powershell-scripts or alice/.profile. id there now skips 930120, 932120 and 932260, on gitea's /-/admin/repos/unadopted and Forgejo's /admin/repos/unadopted. Model: opus-5-5
This commit is contained in:
1 parent
0b23352767
commit
3044b823f3
3 files changed
+70
-6
No files matched your search
@@ -812,9 +812,9 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
a push reuses a layer, `from` names the image the layer comes from. An image
|
||||
such as `owner/python3-app` would have that push refused.
|
||||
8. On gitea's paths, some fields skip the rules that refused ordinary gitea
|
||||
requests there. They are the fields where gitea sends a search, a file name
|
||||
or a branch name. `internal/coreruleset/gitea.conf` lists each rule and the
|
||||
request it refused. The fields are:
|
||||
requests there. They are the fields where gitea sends a search, a file name,
|
||||
a branch name or a repository's name. `internal/coreruleset/gitea.conf` lists
|
||||
each rule and the request it refused. The fields are:
|
||||
- `q` on gitea's searches of code, of issues and pull requests, and of
|
||||
commits. A code search holds code, such as `<script>`,
|
||||
`SELECT * FROM users WHERE` or `../`.
|
||||
@@ -884,6 +884,11 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
- to start a release from a tag;
|
||||
- to edit a branch protection rule;
|
||||
- to list a directory's last commits.
|
||||
- `id` of the admin forms that adopt or delete an unadopted repository, for
|
||||
the lists of system files and command names (930120, 932120, 932260). `id`
|
||||
holds the repository's owner and name, such as `alice/python3-app` or
|
||||
`alice/.profile`. gitea serves the forms at `/-/admin/repos/unadopted` and
|
||||
Forgejo at `/admin/repos/unadopted`.
|
||||
- The `Content-Range` header of an artifact upload from
|
||||
`actions/upload-artifact@v3` (920450).
|
||||
- The passwords in a body, for each rule that random passwords set off. The
|
||||
|
||||
Reference in new issue
Block a user