Gusted 4dfb3facb4 fix: validate CSRF on non-safe methods ... - CSRF has to be validated for any request that can change the state, in practice this means any HTTP request where the method isn't GET/HEAD/OPTIONS. - The code only considered POST to be a state-changing request. - Forgejo has several PUT/DELETE (that changes state) routes for which no CSRF was being validated. - Change the code to validate CSRF for all non-"safe" methods.		2025-08-30 09:32:43 +02:00
..
admin	feat: Global 2FA enforcement (#8753)	2025-08-15 10:56:45 +02:00
auth	chore: Use common SetCaptchaData in link account (#8592)	2025-08-26 20:30:18 +02:00
devtest	chore(ui): clean up hashbox CSS, small design changes (#7822)	2025-05-25 12:51:27 +02:00
events	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
explore	fix(code-search): fix broken pagination. (#9000)	2025-08-23 13:06:41 +02:00
feed	fix: correct release link in feed (#8802)	2025-08-06 17:51:36 +02:00
healthcheck	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
misc	feat: bump the minimum required Git version from 2.0.0 to 2.34.1 (#8328)	2025-06-29 00:44:18 +02:00
moderation	feat!: Abusive content reporting (#6977)	2025-05-18 08:05:16 +00:00
org	fix(ui): prevent render failure on faulty org settings post (#8553)	2025-07-18 13:13:45 +02:00
repo	feat(build): improve lint-locale-usage further (#8736)	2025-08-27 23:47:34 +02:00
shared	fix: show membership of limited orgs	2025-06-06 19:33:26 +02:00
user	feat(build): improve lint-locale-usage further (#8736)	2025-08-27 23:47:34 +02:00
base.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
githttp.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
goget.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
home.go	feat: Global 2FA enforcement (#8753)	2025-08-15 10:56:45 +02:00
metrics.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
nodeinfo.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
swagger_json.go	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
web.go	fix: validate CSRF on non-safe methods	2025-08-30 09:32:43 +02:00
webfinger.go	fix: trim trailing slash in WebFinger OIDC issuer link (#8794)	2025-08-06 14:50:51 +02:00