femsci/forgejo
femsci/forgejo
1
0
Fork 0
forked from NYANDEV/forgejo
Code Pull requests Activity

Ensure correct SSH permissions check for private and restricted users (#17370) (#17373)

Browse source 
Repositories owned by private users and organisations and pulls by restricted users
need to have permissions checked. Previously Serv would simply assumed that if the
user could log in and the repository was not private then it would be visible.

Fix #17364

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
6543 2021-10-20 22:26:48 +02:00 committed by GitHub
parent 79a3d277e5
commit 79f0b1a50b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
routers/private/serv.go
View file

@ -278,7 +278,12 @@ func ServCommand(ctx *context.PrivateContext) {
}
// Permissions checking:
if repoExist && (mode > models.AccessModeRead || repo.IsPrivate || setting.Service.RequireSignInView) {
if repoExist &&
(mode > models.AccessModeRead ||
repo.IsPrivate ||
owner.Visibility.IsPrivate() ||
user.IsRestricted ||
setting.Service.RequireSignInView) {
if key.Type == models.KeyTypeDeploy {
if deployKey.Mode < mode {
ctx.JSON(http.StatusUnauthorized, private.ErrServCommand{