The Gitea team reports:

Fix missing check

Do some missing checks

By crafting an API request, attackers can access the contents of issues even though the logged-in user does not have access rights to these issues.

< 1.21.2

Problem Description:

• The Wiki page did not sanitize author name
• the reviewer name on a "dismiss review" comment is also affected
• the migration page has some spots

< 1.21.6

The Gitea team reports:

check blocklist for emails when adding them to account

< 1.20.3

The Gitea team reports:

Update golang.org/x/crypto

< 1.21.3

Problem Description:

Even with RequireSignInView enabled, anonymous users can use docker pull to fetch public images.

< 1.21.5

The Gitea team reports:

Disallow javascript, vbscript and data (data uri images still work) url schemes even if all other schemes are allowed

< 1.20.1

The Gitea team reports:

Fix API leaking Usermail if not logged in

The API should only return the real Mail of a User, if the caller is logged in. The check do to this don't work. This PR fixes this. This not really a security issue, but can lead to Spam.

< 1.20.3