Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-25 07:14:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): hide limited users from restricted viewers (#39004)

Browse Source 
Use the canonical profile-visibility check for user API content and
prevent restricted users from enumerating public repositories owned by
limited users.

This keeps feeds, heatmaps, keys, and issue search consistent with
profile visibility.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-22 10:08:36 +02:00
committed by GitHub
parent f7072b0305
commit 6bb6ce678b
4 changed files with 84 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/issues/issue_search.go
+1 -1
View File
@@ -221,7 +221,7 @@ func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
if opts.RepoCond == nil {
opts.RepoCond = builder.NewCond()
}
opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(builder.Eq{"is_private": false})))
opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(repo_model.PublicRepoUnderPublicOwnerCond())))
}
if opts.RepoCond != nil {
sess.And(opts.RepoCond)