Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-21 19:10:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce public-only scope for compare heads (#39006) (#39013)

Browse Source 
Backport #39006 by @bircni

Enforce public-only token scope for repositories resolved as compare
heads.

_Assisted-by: Codex:GPT-5_

Co-authored-by: bircni <bircni@icloud.com>
This commit is contained in:
Giteabot
2026-08-21 02:15:02 -07:00
committed by GitHub
parent 078bb4fa07
commit 320b44df58
2 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/repo/pull.go
+4
View File
@@ -1099,6 +1099,10 @@ func parseCompareInfo(ctx *context.APIContext, compareParam string) (result *git
ctx.APIErrorInternal(err)
return nil, nil
}
if !ctx.TokenCanAccessRepo(headRepo) {
ctx.APIErrorNotFound()
return nil, nil
}
isSameRepo := baseRepo.ID == headRepo.ID
tests/integration/api_repo_compare_test.go
+20
View File
@@ -98,6 +98,26 @@ func TestAPICompareBranches(t *testing.T) {
})
}
func TestAPIComparePublicOnlyToken(t *testing.T) {
onGiteaRun(t, func(t *testing.T, _ *url.URL) {
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
org26 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 26})
pr := createOutdatedPR(t, user, org26)
require.NoError(t, pr.LoadBaseRepo(t.Context()))
require.NoError(t, pr.LoadHeadRepo(t.Context()))
require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(),
&repo_model.Repository{ID: pr.HeadRepo.ID, IsPrivate: true}, "is_private"))
compareURL := "/api/v1/repos/" + pr.BaseRepo.FullName() + "/compare/" + pr.BaseBranch + "..." + pr.HeadRepo.OwnerName + ":" + pr.HeadBranch
fullToken := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadRepository)
MakeRequest(t, NewRequest(t, "GET", compareURL).AddTokenAuth(fullToken), http.StatusOK)
publicOnlyToken := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
MakeRequest(t, NewRequest(t, "GET", compareURL).AddTokenAuth(publicOnlyToken), http.StatusNotFound)
})
}
func TestAPIDownloadCompareDiffOrPatch(t *testing.T) {
onGiteaRun(t, func(t *testing.T, _ *url.URL) {
session := loginUser(t, "user2")