Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-25 15:22:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(attachments): enforce owning repository path (#39048) (#39077)

Browse Source 
Backport #39048 by @bircni

Reject attachment requests routed through a repository other than the
attachment owner.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Giteabot
2026-08-24 11:11:53 -07:00
committed by GitHub
parent 25fff4c043
commit 565e12d47b
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/repo/attachment.go
+7 -7
View File
@@ -143,18 +143,18 @@ func ServeAttachment(ctx *context.Context, uuid string) {
return
}
// prevent visiting attachment from other repository directly
// The check will be ignored before this code merged.
if attach.CreatedUnix > repo_model.LegacyAttachmentMissingRepoIDCutoff && ctx.Repo.Repository != nil && ctx.Repo.Repository.ID != attach.RepoID {
ctx.HTTPError(http.StatusNotFound)
return
}
unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)
if err != nil {
ctx.ServerError("GetAttachmentLinkedTypeAndRepoID", err)
return
}
if repoID == 0 {
repoID = attach.RepoID
}
if ctx.Repo.Repository != nil && repoID != 0 && ctx.Repo.Repository.ID != repoID {
ctx.HTTPError(http.StatusNotFound)
return
}
if unitType == unit.TypeInvalid { // unlinked attachment can only be accessed by the uploader
if !(ctx.IsSigned && attach.UploaderID == ctx.Doer.ID) { // We block if not the uploader