Issues - ipx - Gitea: Git with a cup of tea

Bodyless POST routes accept cross-origin simple requests carrying ambient credentials bug

#336 by rays was closed 2026-10-23 07:37:07 -07:00

1

An open /api/events stream keeps sending daemon events to an account after it is removed bug

#335 by rays was closed 2026-10-23 07:53:05 -07:00

1

Changing a password leaves every existing session and API token valid bug

#334 by rays was closed 2026-10-23 07:47:03 -07:00

1

Any signed-in user can mark a feed they do not subscribe to private, and promote an OPML-derived feed out of its OPML bug

#333 by rays was closed 2026-10-23 07:57:45 -07:00

1

A kept feed from a private OPML loses its private mark when the OPML is removed and is shared to the directory bug

#332 by rays was closed 2026-10-23 07:00:10 -07:00

1

Torrent enclosures write with overwrite enabled straight into a folder other feeds share, so one publisher can replace another feed's downloaded episodes bug

#331 by rays was closed 2026-10-23 05:56:58 -07:00

1

A feed's .torrent URL, or a tracker it names, can make the daemon buffer an unbounded body in memory bug

#330 by rays was closed 2026-10-23 06:40:33 -07:00

2

The directory's refresher fetches LAN and container-network addresses named by an rw peer or by a listed feed's redirect bug

#329 by rays was closed 2026-10-23 07:14:20 -07:00

2

Enclosure downloads send the feed's basic-auth password to whatever host the feed names, unlike feed fetches bug

#328 by rays was closed 2026-10-23 07:03:36 -07:00

1

Feeds listed in a password-protected OPML inherit its username and password and send them to their own, unrelated hosts bug

#327 by rays was closed 2026-10-23 07:03:36 -07:00

1

Item and enclosure links from feeds are used as href and window.open targets without a scheme check bug

#326 by rays was closed 2026-10-23 06:08:37 -07:00

1

Private feed keys in the URL path reach every signed-in user through /api/events bug

#325 by rays was closed 2026-10-23 07:53:04 -07:00

1

Disconnecting sign-in requests escape the password-check limit and run unbounded Argon2 work on the blocking pool bug

#324 by rays was closed 2026-10-23 08:04:29 -07:00

1

ipx-web strips only the Cf-Access header names, while ipx trusts whatever header trusted_header names from Caddy's address bug

#323 by rays was closed 2026-10-23 08:21:32 -07:00

1

A deeply nested OPML, uploaded by any signed-in user or served by any feed publisher, can overflow the stack and abort the whole daemon bug

#322 by rays was closed 2026-10-23 06:13:03 -07:00

1

Every fresh install seeds an admin account with the public password 'ipodderx', usable through the unauthenticated login endpoint bug

#321 by rays was closed 2026-10-23 06:56:57 -07:00

2

Feed, enclosure, OPML and artwork fetches reach any internal address, and the responses come back to the user bug

#320 by rays was closed 2026-10-23 06:32:29 -07:00

1

Downloaded enclosure served same-origin with an extension-guessed type allows stored XSS bug

#319 by rays was closed 2026-10-23 06:02:56 -07:00

1

A multi-file torrent's name is recorded unchecked as the enclosure path, so a feed publisher can point Delete, reap and media serving at any path bug

#318 by rays was closed 2026-10-23 05:56:57 -07:00

1

WordPress.com sites answer the feed with a browser check, and the feed fails for hours bug

#317 by rays was closed 2026-10-23 05:14:08 -07:00

1