[PR #20] [MERGED] Fixes possible vulnerabilities with keyword hijacking #15097

New Issue

2025-11-02T11:38:47-06:00

GiteaMirror commented

2025-11-02 11:38:47 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/20
Author: @ghost
Created: 11/3/2016
Status: ✅ Merged
Merged: 11/12/2016
Merged by: @thibaultmeyer

Base: master ← Head: issue/3700

📝 Commits (3)

d1a8401 Added public entries to reserved keywords list
682e633 Rename variables
427bd15 Derped comment

📊 Changes

1 file changed (+4 additions, -4 deletions)

View changed files

📝 models/user.go (+4 -4)

📄 Description

This fixes #3700. Apparently nothing in the public/ directory is actually filtered out from possible usernames, which means we can have try.gogs.io/css as a possible username. This could be quite dangerous in terms of XSS or some other exploit.

Also @Unknwon, how did you derp so hard in variable naming? reversed? really?

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/20 **Author:** [@ghost](https://github.com/ghost) **Created:** 11/3/2016 **Status:** ✅ Merged **Merged:** 11/12/2016 **Merged by:** [@thibaultmeyer](https://github.com/thibaultmeyer) **Base:** `master` ← **Head:** `issue/3700` --- ### 📝 Commits (3) - [`d1a8401`](https://github.com/go-gitea/gitea/commit/d1a84017a55d50bb54d672d22f3b47db3faf0ad6) Added public entries to reserved keywords list - [`682e633`](https://github.com/go-gitea/gitea/commit/682e6333202f984e729a48ec4dccf87d8d5da1a9) Rename variables - [`427bd15`](https://github.com/go-gitea/gitea/commit/427bd15be7ceb2e6c9ff094a006e6c9593b133cf) Derped comment ### 📊 Changes **1 file changed** (+4 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `models/user.go` (+4 -4) </details> ### 📄 Description This fixes #3700. Apparently nothing in the public/ directory is actually filtered out from possible usernames, which means we can have try.gogs.io/css as a possible username. This could be quite dangerous in terms of XSS or some other exploit. Also @Unknwon, how did you derp so hard in variable naming? reversed? really? --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 11:38:47 -06:00

GiteaMirror closed this issue

2025-11-02 11:38:47 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#15097