Security release. Please update.
Security
Fixes four privately reported vulnerabilities (GHSA-9m33-xfrc-5jxw, GHSA-6m23-28hh-gjh2, GHSA-2hpx-83vg-gm45, GHSA-5pp8-r7f5-6q8p). Thanks to hackchang, mansurmavlankulov and tonghuaroot for the reports.
POST /api/gitea/test-connectionandPOST /api/github/test-connectionnow require a signed-in user. They were the only non-public API routes without a guard and made a server side request to any URL in the body (#447)- Email sign-up is closed server side once an account exists.
AUTH_ALLOW_SIGNUP=truereopens it; the first account is always allowed - SSO providers are scoped to the user who created them for listing, updating and deleting, and the OIDC client secret is no longer returned by the API. Leaving the secret blank when editing keeps the stored one
- HTTP errors from Gitea and other hosts no longer include the upstream response body in the message
- Requests to user supplied URLs (connection tests, OIDC discovery, ntfy, Gotify, Apprise and webhook notifications) refuse link local and cloud metadata addresses and no longer follow redirects. Private networks stay allowed because mirroring to a LAN Gitea is the normal deployment
If your instance has more than one account, rotate the OIDC client secrets of configured SSO providers after updating.
Full Changelog: v3.38.0...v3.38.1