Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-19 21:38:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: grant limited-org unit read access to authenticated non-members (#38871)

Browse Source 
Fixes #38870

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
water
2026-08-18 14:58:37 +08:00
committed by GitHub
parent e8e1973e16
commit c082b9a5ff
3 changed files with 24 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/organization/org.go
+9 -15
View File
@@ -140,10 +140,6 @@ func (org *Organization) GetMembers(ctx context.Context, doer *user_model.User)
// HasMemberWithUserID returns true if user with userID is part of the u organisation.
func (org *Organization) HasMemberWithUserID(ctx context.Context, userID int64) bool {
return org.hasMemberWithUserID(ctx, userID)
}
func (org *Organization) hasMemberWithUserID(ctx context.Context, userID int64) bool {
isMember, err := IsOrganizationMember(ctx, org.ID, userID)
if err != nil {
log.Error("IsOrganizationMember: %v", err)
@@ -303,7 +299,7 @@ func (org *Organization) AnyRepoUnitPermission(ctx context.Context, doer *user_m
}
}
if org.Visibility.IsPublic() {
if ownerVisibilitySatisfiesDoer(org.AsUser(), doer) {
return perm.AccessModeRead
}
@@ -445,8 +441,7 @@ func GetUsersWhoCanCreateOrgRepo(ctx context.Context, orgID int64) (map[int64]*u
And("team_user.org_id = ?", orgID).Find(&users)
}
// HasOrgOrUserVisible tells if the given user can see the given org or user
func HasOrgOrUserVisible(ctx context.Context, orgOrUser, user *user_model.User) bool {
func ownerVisibilitySatisfiesDoer(orgOrUser, user *user_model.User) bool {
// If user is nil, it's an anonymous user/request.
// The Ghost user is handled like an anonymous user.
if user == nil || user.IsGhost() {
@@ -461,18 +456,17 @@ func HasOrgOrUserVisible(ctx context.Context, orgOrUser, user *user_model.User)
return true
}
if (orgOrUser.Visibility == structs.VisibleTypePrivate || user.IsRestricted) && !OrgFromUser(orgOrUser).hasMemberWithUserID(ctx, user.ID) {
return false
}
return true
return orgOrUser.Visibility != structs.VisibleTypePrivate && !user.IsRestricted
}
// HasOrgOrUserVisible tells if the given user can see the given org or user
func HasOrgOrUserVisible(ctx context.Context, owner, doer *user_model.User) bool {
return ownerVisibilitySatisfiesDoer(owner, doer) ||
(doer != nil && OrgFromUser(owner).HasMemberWithUserID(ctx, doer.ID))
}
// HasOrgsVisible tells if the given user can see at least one of the orgs provided
func HasOrgsVisible(ctx context.Context, orgs []*Organization, user *user_model.User) bool {
if len(orgs) == 0 {
return false
}
for _, org := range orgs {
if HasOrgOrUserVisible(ctx, org.AsUser(), user) {
return true