Affected by GO-2024-3056 and 60 other vulnerabilities

GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

GO-2026-5081: Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

GO-2026-5091: Gitea has insecure default SSH settings in code.gitea.io/gitea

GO-2026-5243: Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea

GO-2026-5299: Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea

GO-2026-5321: Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea

GO-2026-5334: Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea

GO-2026-5365: Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea

GO-2026-5448: Gitea: Open Redirect via redirect_to in code.gitea.io/gitea

GO-2026-5510: Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea

GO-2026-6017: Gitea has insufficient permission checks for Composer package source links in code.gitea.io/gitea

GO-2026-6029: Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

GO-2026-6030: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea

GO-2026-6031: Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

GO-2026-6041: Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea

GO-2026-6043: Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea

GO-2026-6044: Gitea: Permanent Fork PR Workflow Approval Gate Bypass in code.gitea.io/gitea

GO-2026-6051: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea

GO-2026-6056: Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts in code.gitea.io/gitea

GO-2026-6057: Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface in code.gitea.io/gitea

GO-2026-6074: Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea

GO-2026-6075: Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea

GO-2026-6076: Gitea: Unauthorized Access to Labels of Private Organizations in code.gitea.io/gitea

GO-2026-6077: Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea

GO-2026-6080: Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag in go-gitea/gitea

GO-2026-6081: Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea

GO-2026-6333: Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea

GO-2026-6334: Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea

GO-2026-6335: Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea

GO-2026-6336: Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea

GO-2026-6337: Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea

GO-2026-6338: Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea

GO-2026-6339: Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea

GO-2026-6340: Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea

GO-2026-6341: Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea

GO-2026-6342: Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea

GO-2026-6343: Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea

GO-2026-6344: Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea

GO-2026-6345: Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea

GO-2026-6346: Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea

GO-2026-6347: Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea

GO-2026-6433: Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev

foreachref

package

v1.19.4 Latest Latest Go to latest Published: Jul 4, 2023 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/go-gitea/gitea

Documentation ¶

Index ¶

type Format
- func NewFormat(fieldNames ...string) Format
- func (f Format) Flag() string
- func (f Format) Parser(r io.Reader) *Parser
type Parser
- func NewParser(r io.Reader, format Format) *Parser
- func (p *Parser) Err() error
- func (p *Parser) Next() map[string]string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Format ¶

type Format struct {
	// contains filtered or unexported fields
}

Format supports specifying and parsing an output format for 'git for-each-ref'. See See git-for-each-ref(1) for available fields.

func NewFormat ¶

func NewFormat(fieldNames ...string) Format

NewFormat creates a forEachRefFormat using the specified fieldNames. See git-for-each-ref(1) for available fields.

func (Format) Flag ¶

func (f Format) Flag() string

Flag returns a for-each-ref --format flag value that captures the fieldNames.

func (Format) Parser ¶

func (f Format) Parser(r io.Reader) *Parser

Parser returns a Parser capable of parsing 'git for-each-ref' output produced with this Format.

type Parser ¶

type Parser struct {
	// contains filtered or unexported fields
}

Parser parses 'git for-each-ref' output according to a given output Format.

func NewParser ¶

func NewParser(r io.Reader, format Format) *Parser

NewParser creates a 'git for-each-ref' output parser that will parse all references in the provided Reader. The references in the output are assumed to follow the specified Format.

func (*Parser) Err ¶

func (p *Parser) Err() error

Err returns the latest encountered parsing error.

func (*Parser) Next ¶

func (p *Parser) Next() map[string]string

Next returns the next reference as a collection of key-value pairs. nil denotes EOF but is also returned on errors. The Err method should always be consulted after Next returning nil.

It could, for example return something like:

{ "objecttype": "tag", "refname:short": "v1.16.4", "object": "f460b7543ed500e49c133c2cd85c8c55ee9dbe27" }

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL