Collaborator with read write can delete repository

[jmgiaever]

A collaborator that only have read access to a repository can delete it.

How?

• Log in to Gogs with one account and add a user (another account) to a repository as a collaborator with read access
• Log in to Gogs with the collaborator and create a token for this account, and query the API with the new token: DELETE {url}/api/v1/repos/*owner username*/*repo name*

Gogs Version: 0.11.29.0727