Fix get release draft permission check by lunny · Pull Request #36659 · go-gitea/gitea

lunny · 2026-02-17T20:22:39Z

Draft release and it's attachments need a write permission to access.

Copilot

Pull request overview

This PR tightens API access control around draft releases to ensure they’re only visible to users with write permission and (when authenticated via token) an appropriate write-level repository scope, and extends the same protection to draft release attachments.

Changes:

Enforce draft-release visibility checks in GetRelease and ListReleases using a combined repo-permission + token-scope (write:repository) gate.
Apply the same draft visibility restriction to release attachment APIs (list/get) and shared release-repo matching.
Add integration tests and fixtures to validate draft release and draft attachment access behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/integration/api_releases_test.go	Adds a draft-release GET integration test (needs additional scope-coverage updates).
tests/integration/api_releases_attachment_test.go	Adds a draft-release attachment access test and new API structs usage.
routers/api/v1/repo/release_attachment.go	Blocks draft attachment access for unauthorized users (contains a redundant extra release DB lookup).
routers/api/v1/repo/release.go	Introduces helper functions to enforce write-scope for draft release visibility and draft inclusion in listing.
models/fixtures/attachment.yml	Adds a fixture attachment linked to a draft release for integration testing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/integration/api_releases_test.go

tests/integration/api_releases_attachment_test.go

routers/api/v1/repo/release_attachment.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>

Draft release and it's attachments need a write permission to access. --------- Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Giteabot <teabot@gitea.io>

@lunny

Backport #36659 by @lunny Draft release and it's attachments need a write permission to access. Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

wxiaoguang · 2026-02-23T04:38:40Z

routers/api/v1/repo/release.go

 	release_service "code.gitea.io/gitea/services/release"
 )

+func hasRepoWriteScope(ctx *context.APIContext) bool {


The name is not right. It will be definitely abused in the future.

It returns true for anonymous user.

wxiaoguang · 2026-02-23T04:39:31Z

routers/api/v1/repo/release_attachment.go

+		if !canAccessDraftRelease(ctx) {
+			if !ctx.Written() {
+				ctx.APIErrorNotFound()
+			}
+			return false


Why use this new error pattern?

You should make canAccessDraftRelease write reponse if it returns false

(Many places)

wxiaoguang · 2026-02-23T05:01:53Z

Following up: Fix release draft access check logic #36720

* giteaofficial/main: (81 commits) Add keyboard shortcuts for repository file and code search (go-gitea#36416) Refactor text utility classes to Tailwind CSS (go-gitea#36703) Prevent redirect bypasses via backslash-encoded paths (go-gitea#36660) Fix force push time-line commit comments of pull request (go-gitea#36653) Fix get release draft permission check (go-gitea#36659) Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (go-gitea#30256) Update JS and PY deps (go-gitea#36708) Move jobparser from act repository to Gitea (go-gitea#36699) Fix push time bug (go-gitea#36693) Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (go-gitea#36654) various fixes (go-gitea#36697) Add AI Contribution Policy to CONTRIBUTING.md (go-gitea#36651) Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (go-gitea#36688) Rework e2e tests (go-gitea#36634) Remove unused functions (go-gitea#36672) Add migration http transport for push/sync mirror lfs (go-gitea#36665) Fix track time issue id (go-gitea#36664) Refactor inline style attributes (go-gitea#36652) Update Nix flake (go-gitea#36679) Upgrade gogit to 5.16.5 (go-gitea#36680) ... # Conflicts: # web_src/js/features/repo-issue-content.ts

* main: (24 commits) Instance-wide (global) info banner and maintenance mode (go-gitea#36571) Add created_by filter to SearchIssues (go-gitea#36670) Inline and lazy-load EasyMDE CSS, fix border colors (go-gitea#36714) Fix release draft access check logic (go-gitea#36720) Change image transparency grid to CSS (go-gitea#36711) Avoid opening new tab when downloading actions logs (go-gitea#36740) Add validation constraints for repository creation fields (go-gitea#36671) Fix SVG height calculation in diff viewer (go-gitea#36748) Fix path resolving (go-gitea#36734) [skip ci] Updated translations via Crowdin Fix track time list permission check (go-gitea#36662) Fix incorrect setting loading order (go-gitea#36735) Use case-insensitive matching for Git error "Not a valid object name" (go-gitea#36728) feat: Add workflow dependencies visualization (go-gitea#36248) Add keyboard shortcuts for repository file and code search (go-gitea#36416) Refactor text utility classes to Tailwind CSS (go-gitea#36703) Prevent redirect bypasses via backslash-encoded paths (go-gitea#36660) Fix force push time-line commit comments of pull request (go-gitea#36653) Fix get release draft permission check (go-gitea#36659) Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (go-gitea#30256) ... # Conflicts: # web_src/css/base.css # web_src/css/index.css

Fix get release draft permission check

20b9e35

lunny added type/bug backport/v1.25 This PR should be backported to Gitea 1.25 labels Feb 17, 2026

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Feb 17, 2026

github-actions bot added modifies/api This PR adds API routes or modifies them modifies/go Pull requests that update Go code labels Feb 17, 2026

lunny added 2 commits February 17, 2026 15:05

Fix bug

9adf6d8

Merge branch 'main' into lunny/fix_get_release_draft

7295f43

silverwind requested a review from Copilot February 18, 2026 03:36

Copilot started reviewing on behalf of silverwind February 18, 2026 03:38 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

tests/integration/api_releases_test.go Show resolved Hide resolved

tests/integration/api_releases_attachment_test.go Show resolved Hide resolved

routers/api/v1/repo/release_attachment.go Outdated Show resolved Hide resolved

lunny and others added 5 commits February 19, 2026 13:28

Update tests/integration/api_releases_attachment_test.go

07eca5b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>

Update routers/api/v1/repo/release_attachment.go

47138a8

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>

Fix test

7e22086

Merge branch 'main' into lunny/fix_get_release_draft

35b8bf6

Merge branch 'main' into lunny/fix_get_release_draft

f1432f4

silverwind approved these changes Feb 22, 2026

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Feb 22, 2026

Zettat123 approved these changes Feb 22, 2026

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Feb 22, 2026

lunny added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 22, 2026

lunny and others added 2 commits February 22, 2026 12:25

Merge branch 'main' into lunny/fix_get_release_draft

f0a3c0b

Merge branch 'main' into lunny/fix_get_release_draft

a78e9d4

silverwind enabled auto-merge (squash) February 22, 2026 20:29

silverwind merged commit 1eced4a into go-gitea:main Feb 22, 2026
26 checks passed

GiteaBot added this to the 1.26.0 milestone Feb 22, 2026

GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 22, 2026

lunny deleted the lunny/fix_get_release_draft branch February 22, 2026 21:24

GiteaBot mentioned this pull request Feb 22, 2026

Fix get release draft permission check (#36659) #36715

Merged

wxiaoguang reviewed Feb 23, 2026

View reviewed changes

lunny added the backport/done All backports for this PR have been created label Mar 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix get release draft permission check#36659

Fix get release draft permission check#36659
silverwind merged 10 commits intogo-gitea:mainfrom
lunny:lunny/fix_get_release_draft

lunny commented Feb 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wxiaoguang Feb 23, 2026

Uh oh!

wxiaoguang Feb 23, 2026

Uh oh!

wxiaoguang commented Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

lunny commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wxiaoguang Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

wxiaoguang Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

wxiaoguang commented Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

lunny commented Feb 17, 2026 •

edited

Loading