forked from NYANDEV/forgejo
Backport #24362 by @jolheiser > The scoped token PR just checked all API routes but in fact, some web routes like `LFS`, git `HTTP`, container, and attachments supports basic auth. This PR added scoped token check for them. Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
parent
89297c9355
commit
d2efd2bf73
11 changed files with 117 additions and 7 deletions
|
@ -86,6 +86,11 @@ func DownloadHandler(ctx *context.Context) {
|
|||
return
|
||||
}
|
||||
|
||||
repository := getAuthenticatedRepository(ctx, rc, true)
|
||||
if repository == nil {
|
||||
return
|
||||
}
|
||||
|
||||
// Support resume download using Range header
|
||||
var fromByte, toByte int64
|
||||
toByte = meta.Size - 1
|
||||
|
@ -360,6 +365,11 @@ func VerifyHandler(ctx *context.Context) {
|
|||
return
|
||||
}
|
||||
|
||||
repository := getAuthenticatedRepository(ctx, rc, true)
|
||||
if repository == nil {
|
||||
return
|
||||
}
|
||||
|
||||
contentStore := lfs_module.NewContentStore()
|
||||
ok, err := contentStore.Verify(meta.Pointer)
|
||||
|
||||
|
@ -423,6 +433,11 @@ func getAuthenticatedRepository(ctx *context.Context, rc *requestContext, requir
|
|||
return nil
|
||||
}
|
||||
|
||||
context.CheckRepoScopedToken(ctx, repository)
|
||||
if ctx.Written() {
|
||||
return nil
|
||||
}
|
||||
|
||||
return repository
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue