Affected by GO-2025-4261 and 9 other vulnerabilities

GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

GO-2026-4362: Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea

GO-2026-4363: Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea

GO-2026-4364: Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

GO-2026-4365: Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

GO-2026-4366: Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea

GO-2026-4367: Gitea has improper access control for uploaded attachments in code.gitea.io/gitea

GO-2026-4368: Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea

GO-2026-4369: Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea

GO-2026-4370: Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea

system

package

v1.25.2 Latest Latest Go to latest Published: Nov 22, 2025 License: MIT Imports: 4 Imported by: 2

Details

This section is empty.

This section is empty.

func Init() error

Init initialize AppState interface

type DBStore struct{}

DBStore can be used to store app state items in local filesystem

func (f *DBStore) Get(ctx context.Context, item StateItem) error

Get reads the state item

func (f *DBStore) Set(ctx context.Context, item StateItem) error

Set saves the state item

type RuntimeState struct {
	LastAppPath    string `json:"last_app_path"`
	LastCustomConf string `json:"last_custom_conf"`
}

RuntimeState contains app state for runtime, and we can save remote version for update checker here in future

func (a RuntimeState) Name() string

Name returns the item name

type StateItem interface {
	Name() string
}

StateItem provides the name for a state item. the name will be used to generate filenames, etc

type StateStore interface {
	Get(ctx context.Context, item StateItem) error
	Set(ctx context.Context, item StateItem) error
}

StateStore is the interface to get/set app state items

var AppState StateStore

AppState contains the state items for the app