Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-13 23:41:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): don't expose private org membership via public_members (#38145)

Browse Source
This commit is contained in:
bircni
2026-06-22 05:50:02 +02:00
committed by GitHub
parent e5891263f8
commit 685b62c60f
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/org/member.go
+11
View File
@@ -119,6 +119,12 @@ func ListPublicMembers(ctx *context.APIContext) {
// "404":
// "$ref": "#/responses/notFound"
// don't disclose membership of organizations the doer cannot see
if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
ctx.APIErrorNotFound()
return
}
listMembers(ctx, false)
}
@@ -201,6 +207,11 @@ func IsPublicMember(ctx *context.APIContext) {
if ctx.Written() {
return
}
// don't disclose membership of organizations the doer cannot see
if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
ctx.APIErrorNotFound()
return
}
is, err := organization.IsPublicMembership(ctx, ctx.Org.Organization.ID, userToCheck.ID)
if err != nil {
ctx.APIErrorInternal(err)