This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8607d in repository https://gitbox.apache.org/repos/asf/allura.git
commit 4a774ecea9371dc8b9d76f4f37d50961c18c7ffb Author: Dave Brondsema <[email protected]> AuthorDate: Fri Jun 12 10:42:41 2026 -0400 [#8607] lock down a bit of the incomplete commit_status endpoint --- Allura/allura/controllers/repository.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py index de6b72ece..dbfad7eb0 100644 --- a/Allura/allura/controllers/repository.py +++ b/Allura/allura/controllers/repository.py @@ -373,9 +373,12 @@ def commits(self, rev=None, limit=25, **kw): ]} @expose('json:') + @require_post() def commit_status(self, rev=None, **kwargs): + require_access(c.app.repo, 'admin') if not g.commit_statuses_enabled: return {'status': 'disabled', 'message': 'check your config file'} + # TODO: if/when this experimental feature is implemented, scope context or app_config field to current repo params = {x: kwargs.get(x, '').strip() for x in ['state', 'target_url', 'description', 'context']} params['commit_id'] = rev
