forgejo/routers/web/org
Earl Warren 913e3b536e
fix(sec): permission check for project issue
- Do an access check when loading issues for a project board, currently
this is not done and exposes the title, labels and existence of a
private issue that the viewer of the project board may not have access
to.
- The number of issues cannot be calculated in a efficient manner
and stored in the database because their number may vary depending on
the visibility of the repositories participating in the project. The
previous implementation used the pre-calculated numbers stored in each
project, which did not reflect that potential variation.
- The code is derived from https://github.com/go-gitea/gitea/pull/22865

(cherry picked from commit 2193afaeb9954a5778f5a47aafd0e6fbbf48d000)
2025-02-05 22:05:22 +00:00
..
setting Show repo count in blocked users tab (#3601) 2024-05-02 17:10:06 +00:00
home.go Filter Repositories by type (#29231) 2024-03-06 12:10:46 +08:00
main_test.go make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
members.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
org.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
org_labels.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
projects.go fix(sec): permission check for project issue 2025-02-05 22:05:22 +00:00
projects_test.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
setting.go [REFACTOR] use Icon from interface in webhook list 2024-03-31 07:20:18 +00:00
setting_oauth2.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
setting_packages.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
teams.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00