Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-19 07:33:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): deny private org member enumeration via /members (#38213)

Browse Source
This commit is contained in:
bircni
2026-06-26 20:35:13 +02:00
committed by GitHub
parent 1b0992eb2e
commit 122ebcf0a8
3 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_org_test.go
+6
View File
@@ -284,10 +284,16 @@ func TestAPIOrgPrivateMembersNotLeaked(t *testing.T) {
MakeRequest(t, req, http.StatusNotFound)
req = NewRequest(t, "GET", "/api/v1/orgs/"+orgName+"/public_members").AddTokenAuth(outsiderToken)
MakeRequest(t, req, http.StatusNotFound)
// the full member list of a private org must not be enumerable by an outsider either
req = NewRequest(t, "GET", "/api/v1/orgs/"+orgName+"/members").AddTokenAuth(outsiderToken)
MakeRequest(t, req, http.StatusNotFound)
// the member can still see the public membership of their own org
req = NewRequest(t, "GET", "/api/v1/orgs/"+orgName+"/public_members/"+memberName).AddTokenAuth(memberToken)
MakeRequest(t, req, http.StatusNoContent)
// and the member can still list the org's members
req = NewRequest(t, "GET", "/api/v1/orgs/"+orgName+"/members").AddTokenAuth(memberToken)
MakeRequest(t, req, http.StatusOK)
}
func testAPIDeleteOrgRepos(t *testing.T) {