Repository: go-gitea/gitea
File: routers/web/repo/pull.go (Go)

Code before:
	} else {
		ctx.Data["GetCommitMessages"] = ""
	}

	sha, err := baseGitRepo.GetRefCommitID(pull.GetGitHeadRefName())
	if err != nil {
		if git.IsErrNotExist(err) {
			ctx.Data["IsPullRequestBroken"] = true
			if pull.IsSameRepo() {
				ctx.Data["HeadTarget"] = pull.HeadBranch
			} else if pull.HeadRepo == nil {
				ctx.Data["HeadTarget"] = ctx.Locale.Tr("repo.pull.deleted_branch", pull.HeadBranch)
			} else {
				ctx.Data["HeadTarget"] = pull.HeadRepo.OwnerName + ":" + pull.HeadBranch
			}
			ctx.Data["BaseTarget"] = pull.BaseBranch
			ctx.Data["NumCommits"] = 0
			ctx.Data["NumFiles"] = 0
			return nil
		}
		ctx.ServerError(fmt.Sprintf("GetRefCommitID(%s)", pull.GetGitHeadRefName()), err)
		return nil
	}

	statusCheckData := &pullCommitStatusCheckData{
		ApproveActionLink: fmt.Sprintf("%s/actions/approve-all-checks?sha=%s&redirect=%s", repo.Link(), sha, issue.Link()),
	}
	ctx.Data["StatusCheckData"] = statusCheckData

	commitStatuses, err := git_model.GetLatestCommitStatus(ctx, repo.ID, sha, db.ListOptionsAll)
	if err != nil {
		ctx.ServerError("GetLatestCommitStatus", err)
		return nil
	}
	if !ctx.Repo.CanRead(unit.TypeActions) {
		git_model.CommitStatusesHideActionsURL(ctx, commitStatuses)
	}

	runs, err := actions_service.GetRunsFromCommitStatuses(ctx, commitStatuses)
	if err != nil {
		ctx.ServerError("GetRunsFromCommitStatuses", err)
		return nil
	}
	for _, run := range runs {
		if run.NeedApproval {
			statusCheckData.RequireApproval = true
			break
		}
	}
	if statusCheckData.RequireApproval {
		statusCheckData.CanApprove = ctx.Repo.CanWrite(unit.TypeActions)

Review comment (security):
If you need to build a link, then you need to correctly escape the paramters.

Actually, you can use `form-fetch-action` or `link-action`, no need to use the fragile `redirect` parameter 

Code after:
	} else {
		ctx.Data["GetCommitMessages"] = ""
	}

	sha, err := baseGitRepo.GetRefCommitID(pull.GetGitHeadRefName())
	if err != nil {
		if git.IsErrNotExist(err) {
			ctx.Data["IsPullRequestBroken"] = true
			if pull.IsSameRepo() {
				ctx.Data["HeadTarget"] = pull.HeadBranch
			} else if pull.HeadRepo == nil {
				ctx.Data["HeadTarget"] = ctx.Locale.Tr("repo.pull.deleted_branch", pull.HeadBranch)
			} else {
				ctx.Data["HeadTarget"] = pull.HeadRepo.OwnerName + ":" + pull.HeadBranch
			}
			ctx.Data["BaseTarget"] = pull.BaseBranch
			ctx.Data["NumCommits"] = 0
			ctx.Data["NumFiles"] = 0
			return nil
		}
		ctx.ServerError(fmt.Sprintf("GetRefCommitID(%s)", pull.GetGitHeadRefName()), err)
		return nil
	}

	statusCheckData := &pullCommitStatusCheckData{
		ApproveLink: fmt.Sprintf("%s/actions/approve-all-checks?commit_id=%s", repo.Link(), sha),
	}
	ctx.Data["StatusCheckData"] = statusCheckData

	commitStatuses, err := git_model.GetLatestCommitStatus(ctx, repo.ID, sha, db.ListOptionsAll)
	if err != nil {
		ctx.ServerError("GetLatestCommitStatus", err)
		return nil
	}
	if !ctx.Repo.CanRead(unit.TypeActions) {
		git_model.CommitStatusesHideActionsURL(ctx, commitStatuses)
	}

	runs, err := actions_service.GetRunsFromCommitStatuses(ctx, commitStatuses)
	if err != nil {
		ctx.ServerError("GetRunsFromCommitStatuses", err)
		return nil
	}
	for _, run := range runs {
		if run.NeedApproval {
			statusCheckData.RequireApprovalRunCount++
		}
	}
	if statusCheckData.RequireApprovalRunCount > 0 {
		statusCheckData.CanApprove = ctx.Repo.CanWrite(unit.TypeActions)
	}