GustedandMathieu Fenniak d1c7b04d09 fix: verify code challenge of S256 ...

We do not know for sure, but it is quite likely someone assumed implicit
fallthrough. This meant that if someone used S256 for PKCE, it simply
did not verify the code challenge and always accepted it.

PKCE only started working recently as it was broken for a long time
already, forgejo/forgejo!8678

2026-03-06 11:21:07 -07:00

..

api

Move Container API processing logic to service (#11432)

2026-03-06 18:56:49 +01:00

common

chore: fix typos throughout the codebase (#10753)

2026-01-26 22:57:33 +01:00

install

fix: don't clobber authorized_keys file during installation (#10948)

2026-01-23 18:38:09 +01:00

private

feat: detailed permission denied message on push (#10941)

2026-01-29 01:48:46 +01:00

utils

[PORT] drop utils.IsExternalURL (and expand IsRiskyRedirectURL tests) (#3167)

2024-04-15 13:03:08 +00:00

web

fix: verify code challenge of S256

2026-03-06 11:21:07 -07:00

init.go

fix: don't clobber authorized_keys file during installation (#10948)

2026-01-23 18:38:09 +01:00