Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-07 21:19:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): stop leaking private repo metadata after access revocation (#38321)

Browse Source 
The `/user/starred` and `/user/subscriptions` endpoints returned private
repositories a user had starred/watched even after their access to those
repositories was revoked, still exposing the repository name,
description and visibility (including later metadata changes).

Private repositories in the starred/watched queries are now gated on the
actor's current access via `AccessibleRepositoryCondition`, so users who
no longer have access no longer receive the metadata. Public
repositories and public-only tokens are unaffected.
This commit is contained in:
bircni
2026-07-10 00:21:44 +02:00
committed by GitHub
parent 66a3723cbb
commit 362539b78e
4 changed files with 65 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/repo/user_repo.go
+14 -2
View File
@@ -22,6 +22,9 @@ type StarredReposOptions struct {
StarrerID int64
RepoOwnerID int64
IncludePrivate bool
// Actor is the user the private repositories are gated on: a private repo is only
// returned when Actor still has access to it, even if it was starred while access was granted.
Actor *user_model.User
}
func (opts *StarredReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -39,7 +42,10 @@ func (opts *StarredReposOptions) ToConds() builder.Cond {
"repository.owner_id": opts.RepoOwnerID,
})
}
if !opts.IncludePrivate {
if opts.IncludePrivate {
// only include private repos the actor can still access, so metadata does not leak after access revocation
cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
} else {
cond = cond.And(builder.Eq{
"repository.is_private": false,
})
@@ -66,6 +72,9 @@ type WatchedReposOptions struct {
WatcherID int64
RepoOwnerID int64
IncludePrivate bool
// Actor is the user the private repositories are gated on: a private repo is only
// returned when Actor still has access to it, even if it was watched while access was granted.
Actor *user_model.User
}
func (opts *WatchedReposOptions) ApplyPublicOnly(publicOnly bool) {
@@ -83,7 +92,10 @@ func (opts *WatchedReposOptions) ToConds() builder.Cond {
"repository.owner_id": opts.RepoOwnerID,
})
}
if !opts.IncludePrivate {
if opts.IncludePrivate {
// only include private repos the actor can still access, so metadata does not leak after access revocation
cond = cond.And(AccessibleRepositoryCondition(opts.Actor, unit.TypeInvalid))
} else {
cond = cond.And(builder.Eq{
"repository.is_private": false,
})