Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-14 19:22:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)

Browse Source 
backport #38894, partially #38862
This commit is contained in:
wxiaoguang
2026-08-13 17:59:07 +08:00
committed by GitHub
parent 88b56d408d
commit 0acbcc58a7
8 changed files with 38 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/auth/httpsign.go
-2
View File
@@ -78,8 +78,6 @@ func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataSt
return nil, err
}
store.GetData()["IsApiToken"] = true
log.Trace("HTTP Sign: Logged in user %-v", u)
return u, nil
services/repository/collaboration.go
+3 -1
View File
@@ -19,7 +19,9 @@ import (
)
func AddOrUpdateCollaborator(ctx context.Context, repo *repo_model.Repository, u *user_model.User, mode perm.AccessMode) error {
// only allow valid access modes, read, write and admin
// Only allow valid access modes, read, write and admin
// Keep in mind: do not allow "owner" here: because "admin" user can update collaborators but not make dangerous operations.
// If the "admin" user updates a user to "owner", then it means that the admin user can use owner permission, which is not expected.
if mode < perm.AccessModeRead || mode > perm.AccessModeAdmin {
return perm.ErrInvalidAccessMode
}
services/repository/collaboration_test.go
+11 -7
View File
@@ -20,16 +20,20 @@ import (
func TestRepository_AddCollaborator(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
testSuccess := func(repoID, userID int64) {
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repoID})
repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
repo3 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
testSuccess := func(repo *repo_model.Repository, user *user_model.User) {
assert.NoError(t, repo.LoadOwner(t.Context()))
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: userID})
assert.NoError(t, AddOrUpdateCollaborator(t.Context(), repo, user, perm.AccessModeWrite))
unittest.CheckConsistencyFor(t, &repo_model.Repository{ID: repoID}, &user_model.User{ID: userID})
unittest.CheckConsistencyFor(t, repo, user)
}
testSuccess(1, 4)
testSuccess(1, 4)
testSuccess(3, 4)
testSuccess(repo1, user4)
testSuccess(repo1, user4)
testSuccess(repo3, user4)
assert.Error(t, AddOrUpdateCollaborator(t.Context(), repo1, user4, perm.AccessModeOwner))
assert.NoError(t, AddOrUpdateCollaborator(t.Context(), repo1, user4, perm.AccessModeAdmin))
}
func TestRepository_DeleteCollaboration(t *testing.T) {