Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-04 08:27:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden access checks and migration validation (#38324)

Browse Source 
Harden access checks for issue dependencies, team repository membership,
notifications, stars, tracked times and repository migrations.
This commit is contained in:
bircni
2026-07-10 19:30:43 +02:00
committed by GitHub
parent f452c369ac
commit aab3242f7b
15 changed files with 304 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/api_user_star_test.go
+20
View File
@@ -224,3 +224,23 @@ func TestAPIStarPublicOnly(t *testing.T) {
require.Len(t, repos, 1)
assert.Equal(t, "user5/repo4", repos[0].FullName)
}
func TestAPIStarredReposOmitsInaccessiblePrivateRepos(t *testing.T) {
defer tests.PrepareTestEnv(t)()
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
privateRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
assert.True(t, privateRepo.IsPrivate)
assert.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), privateRepo, user, perm.AccessModeRead))
assert.NoError(t, repo_model.StarRepo(t.Context(), user, privateRepo, true))
assert.NoError(t, repo_service.DeleteCollaboration(t.Context(), privateRepo, user))
token := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository)
req := NewRequest(t, "GET", "/api/v1/user/starred").AddTokenAuth(token)
resp := MakeRequest(t, req, http.StatusOK)
repos := DecodeJSON(t, resp, []api.Repository{})
for _, repo := range repos {
assert.NotEqual(t, privateRepo.FullName(), repo.FullName)
}
}