mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-03-12 00:12:37 +01:00
- The security patch of forgejo/forgejo#6843 fixed the issue where project boards loaded all issues without considering if the doer actually had permission to view that issue. Within that patch the call to `Issues` was modified to include this permission checking. - The query being generated was not entirely correct. Issues in public repositories weren't considered correctly (partly the fault of not setting `AllPublic` unconditionally) in the cause an authenticated user loaded the project. - This is now fixed by setting `AllPublic` unconditionally and subsequently fixing the `Issue` function to ensure that the combination of setting `AllPublic` and `User` generates the correct query, by combining the permission check and issues in public repositories as one `AND` query. - Added unit testing. - Added integration testing. - Resolves Codeberg/Community#1809 - Regression of https://codeberg.org/forgejo/forgejo/pulls/6843 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7143 Reviewed-by: Otto <otto@codeberg.org> Co-authored-by: Gusted <postmaster@gusted.xyz> Co-committed-by: Gusted <postmaster@gusted.xyz>
91 lines
3 KiB
Go
91 lines
3 KiB
Go
// Copyright 2025 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
org_model "code.gitea.io/gitea/models/organization"
|
|
project_model "code.gitea.io/gitea/models/project"
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestPrivateIssueProject(t *testing.T) {
|
|
defer tests.AddFixtures("models/fixtures/PrivateIssueProjects/")()
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
sess := loginUser(t, user2.Name)
|
|
|
|
test := func(t *testing.T, sess *TestSession, username string, projectID int64, hasAccess bool, publicIssueHref ...string) {
|
|
t.Helper()
|
|
defer tests.PrintCurrentTest(t, 1)()
|
|
|
|
// Test that the projects overview page shows the correct open and close issues.
|
|
req := NewRequestf(t, "GET", "%s/-/projects", username)
|
|
resp := sess.MakeRequest(t, req, http.StatusOK)
|
|
|
|
htmlDoc := NewHTMLParser(t, resp.Body)
|
|
openCloseStats := htmlDoc.Find(".milestone-toolbar .group").First().Text()
|
|
if hasAccess {
|
|
assert.Contains(t, openCloseStats, "2\u00a0Open")
|
|
} else {
|
|
assert.Contains(t, openCloseStats, "1\u00a0Open")
|
|
}
|
|
assert.Contains(t, openCloseStats, "0\u00a0Closed")
|
|
|
|
// Check that on the project itself the issue is not shown.
|
|
req = NewRequestf(t, "GET", "%s/-/projects/%d", username, projectID)
|
|
resp = sess.MakeRequest(t, req, http.StatusOK)
|
|
|
|
htmlDoc = NewHTMLParser(t, resp.Body)
|
|
issueCardsLen := htmlDoc.Find(".project-column .issue-card").Length()
|
|
if hasAccess {
|
|
assert.EqualValues(t, 2, issueCardsLen)
|
|
} else {
|
|
assert.EqualValues(t, 1, issueCardsLen)
|
|
// Ensure that the public issue is shown.
|
|
assert.EqualValues(t, publicIssueHref[0], htmlDoc.Find(".project-column .issue-card .issue-card-title").AttrOr("href", ""))
|
|
}
|
|
|
|
// And that the issue count is correct.
|
|
issueCount := strings.TrimSpace(htmlDoc.Find(".project-column-issue-count").Text())
|
|
if hasAccess {
|
|
assert.EqualValues(t, "2", issueCount)
|
|
} else {
|
|
assert.EqualValues(t, "1", issueCount)
|
|
}
|
|
}
|
|
|
|
t.Run("Organization project", func(t *testing.T) {
|
|
org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{ID: 3})
|
|
orgProject := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 1001, OwnerID: org.ID})
|
|
|
|
t.Run("Authenticated user", func(t *testing.T) {
|
|
test(t, sess, org.Name, orgProject.ID, true)
|
|
})
|
|
|
|
t.Run("Anonymous user", func(t *testing.T) {
|
|
test(t, emptyTestSession(t), org.Name, orgProject.ID, false, "/org3/repo21/issues/1")
|
|
})
|
|
})
|
|
|
|
t.Run("User project", func(t *testing.T) {
|
|
userProject := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 1002, OwnerID: user2.ID})
|
|
|
|
t.Run("Authenticated user", func(t *testing.T) {
|
|
test(t, sess, user2.Name, userProject.ID, true)
|
|
})
|
|
|
|
t.Run("Anonymous user", func(t *testing.T) {
|
|
test(t, emptyTestSession(t), user2.Name, userProject.ID, false, "/user2/repo1/issues/1")
|
|
})
|
|
})
|
|
}
|