(allura) 01/07: [#8607] lock down a bit of the incomplete commit_status endpoint

[gc...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git

commit a5ecc798d28a41699efad3f272a4b4ff90dacb67
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Fri Jun 12 10:42:41 2026 -0400

    [#8607] lock down a bit of the incomplete commit_status endpoint
---
 Allura/allura/controllers/repository.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index de6b72ece..dbfad7eb0 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -373,9 +373,12 @@ def commits(self, rev=None, limit=25, **kw):
             ]}
 
     @expose('json:')
+    @require_post()
     def commit_status(self, rev=None, **kwargs):
+        require_access(c.app.repo, 'admin')
         if not g.commit_statuses_enabled:
             return {'status': 'disabled', 'message': 'check your config file'}
+        # TODO: if/when this experimental feature is implemented, scope context or app_config field to current repo
         params = {x: kwargs.get(x, '').strip() for x in
                   ['state', 'target_url', 'description', 'context']}
         params['commit_id'] = rev