Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-02 19:09:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(actions): prevent bulk actions from affecting all runners (#38453)

Browse Source 
Fix the bug in the site-admin runner bulk actions introduced by #37869:
the runner IDs are empty then all runners will be deleted.

Fixes #38449

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
xkm
2026-07-15 10:36:03 +08:00
committed by GitHub
parent 7c629e1ba7
commit 880ddb5724
4 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/shared/actions/runners.go
+9 -7
View File
@@ -373,16 +373,18 @@ func RunnerBulkActionPost(ctx *context.Context) {
return
}
var runnerIDs []int64
if rCtx.IsAdmin {
// ATTENTION: it completely depends on the assumption that the doer is "site admin"
// So it doesn't do extra permission check to the runner IDs
// In the future, if you need to support such operation on non-admin pages, be careful!
runnerIDs = ctx.FormStringInt64s("ids")
} else {
if !rCtx.IsAdmin {
ctx.HTTPError(http.StatusForbidden, "bulk actions are admin-only")
return
}
// ATTENTION: it completely depends on the assumption that the doer is "site admin"
// So it doesn't do extra permission check to the runner IDs
// In the future, if you need to support such operation on non-admin pages, be careful!
runnerIDs := ctx.FormStringInt64s("ids")
if len(runnerIDs) == 0 {
ctx.HTTPError(http.StatusBadRequest, "missing runner IDs")
return
}
action := ctx.FormString("action")
var successKey, failedKey string