Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 18:24:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(repo): require organization owners for team access (#39046)

Browse Source 
Require organization ownership before changing repository team
associations when team access is restricted.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-23 08:35:55 +02:00
committed by GitHub
parent bedd2afb47
commit 204c0bafd3
10 changed files with 106 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_repo_teams_test.go
+15
View File
@@ -9,10 +9,12 @@ import (
"testing"
auth_model "gitea.dev/models/auth"
"gitea.dev/models/organization"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
api "gitea.dev/modules/structs"
repo_service "gitea.dev/services/repository"
"gitea.dev/tests"
"github.com/stretchr/testify/assert"
@@ -61,6 +63,19 @@ func TestAPIRepoTeams(t *testing.T) {
AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
targetTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
existingTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 7})
assert.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, publicOrgRepo))
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
token = getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteRepository)
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), targetTeam.Name)).AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
assert.False(t, repo_service.HasRepository(t.Context(), targetTeam, publicOrgRepo.ID))
req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), existingTeam.Name)).AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
assert.True(t, repo_service.HasRepository(t.Context(), existingTeam, publicOrgRepo.ID))
// AddTeam with user2
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
session = loginUser(t, user.Name)
tests/integration/api_team_test.go
+9
View File
@@ -275,6 +275,15 @@ func TestAPIAddRemoveTeamRepositoryRequiresOrgOwnerOrSetting(t *testing.T) {
req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
siteAdmin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
token = getUserToken(t, siteAdmin.Name, auth_model.AccessTokenScopeWriteOrganization)
req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertNotExistsBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
req = NewRequest(t, "PUT", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
}
func TestAPITeamVisibilityAccess(t *testing.T) {