Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-27 00:13:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(packages): restrict limited owner package access (#39043)

Browse Source 
Apply restricted-viewer visibility rules when resolving package access.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-23 09:57:51 +02:00
committed by GitHub
parent adc3db1f27
commit 0bed1232ee
4 changed files with 56 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/context/package.go
+2 -3
View File
@@ -14,7 +14,6 @@ import (
"gitea.dev/models/unit"
user_model "gitea.dev/models/user"
"gitea.dev/modules/setting"
"gitea.dev/modules/structs"
"gitea.dev/modules/templates"
)
@@ -155,10 +154,10 @@ func determineAccessMode(ctx *Base, pkgOwner, doer *user_model.User) (perm.Acces
// 1. Check if user is package owner
if doer.ID == pkgOwner.ID {
accessMode = perm.AccessModeOwner
} else if pkgOwner.Visibility == structs.VisibleTypePublic || pkgOwner.Visibility == structs.VisibleTypeLimited { // 2. Check if package owner is public or limited
} else if pkgOwner.Visibility.IsPublic() || (pkgOwner.Visibility.IsLimited() && !doer.IsRestricted) { // 2. Check if package owner is visible to the doer
accessMode = perm.AccessModeRead
}
} else if pkgOwner.Visibility == structs.VisibleTypePublic { // 3. Check if package owner is public
} else if pkgOwner.Visibility.IsPublic() { // 3. Check if package owner is public
accessMode = perm.AccessModeRead
}
}