Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-24 18:24:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(repo): require organization owners for team access (#39046)

Browse Source 
Require organization ownership before changing repository team
associations when team access is restricted.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-23 08:35:55 +02:00
committed by GitHub
parent bedd2afb47
commit 204c0bafd3
10 changed files with 106 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_team_test.go
+9
View File
@@ -275,6 +275,15 @@ func TestAPIAddRemoveTeamRepositoryRequiresOrgOwnerOrSetting(t *testing.T) {
req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusForbidden)
unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
siteAdmin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
token = getUserToken(t, siteAdmin.Name, auth_model.AccessTokenScopeWriteOrganization)
req = NewRequest(t, "DELETE", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertNotExistsBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
req = NewRequest(t, "PUT", url).AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
unittest.AssertExistsAndLoadBean(t, &organization.TeamRepo{TeamID: team.ID, RepoID: targetRepo.ID})
}
func TestAPITeamVisibilityAccess(t *testing.T) {