forked from NYANDEV/forgejo
Restrict permission check on repositories and fix some problems (#5314)
* fix units permission problems * fix some bugs and merge LoadUnits to repoAssignment * refactor permission struct and add some copyright heads * remove unused codes * fix routes units check * improve permission check * add unit tests for permission * fix typo * fix tests * fix some routes * fix api permission check * improve permission check * fix some permission check * fix tests * fix tests * improve some permission check * fix some permission check * refactor AccessLevel * fix bug * fix tests * fix tests * fix tests * fix AccessLevel * rename CanAccess * fix tests * fix comment * fix bug * add missing unit for test repos * fix bug * rename some functions * fix routes check
This commit is contained in:
parent
0222623be9
commit
eabbddcd98
80 changed files with 1360 additions and 774 deletions
|
@ -286,7 +286,12 @@ func Issues(ctx *context.Context) {
|
|||
repo := showReposMap[repoID]
|
||||
|
||||
// Check if user has access to given repository.
|
||||
if !repo.IsOwnedBy(ctxUser.ID) && !repo.HasAccess(ctxUser) {
|
||||
perm, err := models.GetUserRepoPermission(repo, ctxUser)
|
||||
if err != nil {
|
||||
ctx.ServerError("GetUserRepoPermission", fmt.Errorf("[%d]%v", repoID, err))
|
||||
return
|
||||
}
|
||||
if !perm.CanRead(models.UnitTypeIssues) {
|
||||
ctx.Status(404)
|
||||
return
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue