Disallow access to project archive in release unless authorized user has read access #9535

New Issue

GiteaMirror · 2025-11-02T08:42:08-06:00

GiteaMirror commented

2025-11-02 08:42:08 -06:00

Originally created by @cleandesign-contrib on GitHub (Sep 8, 2022).

Feature Description

The current security model of gitea has a certain bit of granularity that allows a user to be restricted from viewing the source code of a project, but allowed to access and download its releases.

This is great, because a CI bot can take the project and post a release, creating an effective security fire-gap.

However, every release comes with an automatically generated master.zip and master.tar.gz links, which effectively means that if one has access to the releases, then one has access to the entire contents of the project (minus .git history).

Would adding the following code here possibly be a solution to this problem?

if !canReadFiles(ctx.Repo) {
        ctx.Error(http.StatusForbidden, "Access Denied", repo_model.ErrUserDoesNotHaveAccessToRepo{
            UserID:   ctx.Doer.ID,
            RepoName: ctx.Repo.Repository.LowerName,
        })
        return
    }

Screenshots

No response

Originally created by @cleandesign-contrib on GitHub (Sep 8, 2022). ### Feature Description The current [security model](https://docs.gitea.io/en-us/permissions/) of gitea has a certain bit of granularity that allows a user to be restricted from viewing the source code of a project, but allowed to access and download its releases. This is great, because a CI bot can take the project and post a release, creating an effective security fire-gap. However, every release comes with an automatically generated `master.zip` and `master.tar.gz` links, which effectively means that if one has access to the releases, then one has access to the entire contents of the project (minus `.git` history). Would adding the following code [here](https://github.com/go-gitea/gitea/blob/4562d40fcead66e54525f710875377ebf7c4766e/routers/api/v1/repo/file.go#L314) possibly be a solution to this problem? ```go if !canReadFiles(ctx.Repo) { ctx.Error(http.StatusForbidden, "Access Denied", repo_model.ErrUserDoesNotHaveAccessToRepo{ UserID: ctx.Doer.ID, RepoName: ctx.Repo.Repository.LowerName, }) return } ``` ### Screenshots _No response_

GiteaMirror added the issue/needs-feedback label 2025-11-02 08:42:09 -06:00

GiteaMirror closed this issue

2025-11-02 08:42:09 -06:00

GiteaMirror commented

2025-11-02 08:42:10 -06:00

@lunny commented on GitHub (Sep 8, 2022):

If you have tried, I think we have done that. For release archives, you must have read permission to Code. This has been implemented but if it's not, it should be a bug.

@lunny commented on GitHub (Sep 8, 2022): If you have tried, I think we have done that. For release archives, you must have read permission to Code. This has been implemented but if it's not, it should be a bug.

GiteaMirror commented

2025-11-02 08:42:10 -06:00

@cleandesign-contrib commented on GitHub (Sep 8, 2022):

Hi @lunny: then this is a bug.

There's also an additional bug in that it appears DISABLE_DOWNLOAD_SOURCE_ARCHIVES has been orphaned as a configuration setting. Would you like me to split that out into a separate bug?

@cleandesign-contrib commented on GitHub (Sep 8, 2022): Hi @lunny: then this is a bug. There's also an additional bug in that it appears `DISABLE_DOWNLOAD_SOURCE_ARCHIVES` has been orphaned as a configuration setting. Would you like me to split that out into a separate bug?

GiteaMirror commented

2025-11-02 08:42:10 -06:00

@noerw commented on GitHub (Sep 8, 2022):

There's also an additional bug in that it appears DISABLE_DOWNLOAD_SOURCE_ARCHIVES has been orphaned as a configuration setting. Would you like me to split that out into a separate bug?

This is not true, see bb0ff77e46/routers/web/web.go (L293)

@noerw commented on GitHub (Sep 8, 2022): > There's also an additional bug in that it appears DISABLE_DOWNLOAD_SOURCE_ARCHIVES has been orphaned as a configuration setting. Would you like me to split that out into a separate bug? This is not true, see https://github.com/go-gitea/gitea/blob/bb0ff77e461ae080b1722701aea74010ff71e0ae/routers/web/web.go#L293

GiteaMirror commented

2025-11-02 08:42:10 -06:00

@noerw commented on GitHub (Sep 8, 2022):

However, every release comes with an automatically generated master.zip and master.tar.gz links, which effectively means that if one has access to the releases, then one has access to the entire contents of the project (minus .git history).

@cleandesign-contrib I can't reproduce this in current 1.18.0+dev-402 (52c2ef790). What gitea version are you referring to?

@noerw commented on GitHub (Sep 8, 2022): > However, every release comes with an automatically generated master.zip and master.tar.gz links, which effectively means that if one has access to the releases, then one has access to the entire contents of the project (minus .git history). @cleandesign-contrib I can't reproduce this in current `1.18.0+dev-402` (52c2ef790). What gitea version are you referring to?

GiteaMirror commented

2025-11-02 08:42:10 -06:00

@cleandesign-contrib commented on GitHub (Sep 8, 2022):

@noerw do you have access to the security email account for gitea? Because I have sent an email there which may or may not be related to this.

(I have confirmed the issue with two independent developers in our organization that were able to reproduce it)

@cleandesign-contrib commented on GitHub (Sep 8, 2022): @noerw do you have access to the security email account for gitea? Because I have sent an email there which may or may not be related to this. (I have confirmed the issue with two independent developers in our organization that were able to reproduce it)

GiteaMirror commented

2025-11-02 08:42:11 -06:00

@techknowlogick commented on GitHub (Sep 8, 2022):

per your email you are using 1.15.0, this version is very out of date. please update to latest stable and try again. closing this, but please update the email thread if you still continue to receive the same issue.

@techknowlogick commented on GitHub (Sep 8, 2022): per your email you are using `1.15.0`, this version is very out of date. please update to latest stable and try again. closing this, but please update the email thread if you still continue to receive the same issue.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9535