forgejo/routers/web
Matthias Riße 7f4f3434ec fix: consider HEAD requests to be pulls (#6750)
Previously an anonymous GET request to e.g.
https://codeberg.org/forgejo/forgejo/HEAD was allowed, as GET requests
are considered pulls and those don't need authentication for a public
repository, but a HEAD request to the same URL was rejected with a 401.
Since the result of a HEAD request is a subset of the result of a GET
request it is safe to allow HEAD as well.

This isn't really a practical issue for Forgejo itself, but I have encountered this in https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/issues/40. Since the fix isn't git-annex specific I am proposing it here.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [X] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6750
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
2025-02-07 07:39:00 +00:00
..
admin chore: load 2fa status for user search when needed (#6727) 2025-01-29 17:57:55 +00:00
auth chore: remove deadcode in models/user 2025-01-29 18:37:14 +01:00
devtest Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
events Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
explore fix: set explore pages to configurable default sort (#6708) 2025-01-31 10:38:03 +00:00
feed Add pubdate for repository rss and add some tests (#33411) 2025-02-02 12:01:29 +01:00
healthcheck Add health-check test 2024-04-06 00:34:55 +02:00
misc fix: Preview picture not visible on Markdown file (#5781) 2024-11-23 15:00:18 +00:00
org feat: add configurable cooldown to claim usernames (#6422) 2025-01-24 04:16:56 +00:00
repo fix: consider HEAD requests to be pulls (#6750) 2025-02-07 07:39:00 +00:00
shared Add search action jobs for API routes, repo, org and global level (#6300) 2025-01-14 11:17:42 +00:00
user chore: remove usages of sort.Sort (#6689) 2025-01-26 13:30:00 +00:00
base.go Fix missing signature key error when pulling Docker images with SERVE_DIRECT enabled (#32365) 2024-11-05 09:33:15 +01:00
githttp.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
goget.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
home.go Rewrite OpenGraph Header 2025-01-01 20:43:20 +01:00
metrics.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
nodeinfo.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
swagger_json.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
web.go Update 2024-12-18 22:33:22 +01:00
webfinger.go Enable more revive linter rules (#30608) 2024-04-28 15:39:00 +02:00