Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-20 03:28:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: grant limited-org unit read access to authenticated non-members (#38871)

Browse Source 
Fixes #38870

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
water
2026-08-18 14:58:37 +08:00
committed by GitHub
parent e8e1973e16
commit c082b9a5ff
3 changed files with 24 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/web.go
+6 -12
View File
@@ -441,19 +441,13 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
}
}
reqUnitAccess := func(unitType unit.Type, accessMode perm.AccessMode, ignoreGlobal bool) func(ctx *context.Context) {
reqAnyRepoUnitAccess := func(unitType unit.Type, accessMode perm.AccessMode, ignoreGlobal bool) func(ctx *context.Context) {
return func(ctx *context.Context) {
// only check global disabled units when ignoreGlobal is false
if !ignoreGlobal && unitType.UnitGlobalDisabled() {
ctx.NotFound(nil)
return
}
if ctx.ContextUser == nil {
ctx.NotFound(nil)
return
}
if ctx.ContextUser.IsOrganization() {
if ctx.Org.Organization.AnyRepoUnitPermission(ctx, ctx.Doer, unitType) < accessMode {
ctx.NotFound(nil)
@@ -1125,7 +1119,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
}
// at the moment, only editing "owner-level projects" need to "mention", maybe in the future we can relax the permission check
m.Get("/mentions-in-owner", reqUnitAccess(unit.TypeProjects, perm.AccessModeWrite, true), org.GetMentionsInOwner)
m.Get("/mentions-in-owner", reqAnyRepoUnitAccess(unit.TypeProjects, perm.AccessModeWrite, true), org.GetMentionsInOwner)
m.Get("/repositories", org.Repositories)
m.Get("/heatmap", user.DashboardHeatmap)
@@ -1134,7 +1128,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
m.Group("", func() {
m.Get("", org.Projects)
m.Get("/{id}", org.ViewProject)
}, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead, true))
}, reqAnyRepoUnitAccess(unit.TypeProjects, perm.AccessModeRead, true))
m.Group("", func() {
m.Get("/new", org.RenderNewProject)
m.Post("/new", web.Bind[*forms.CreateProjectForm](), org.NewProjectPost)
@@ -1147,17 +1141,17 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
addProjectBoardRoutes(m)
})
}, reqSignIn, reqUnitAccess(unit.TypeProjects, perm.AccessModeWrite, true), func(ctx *context.Context) {
}, reqSignIn, reqAnyRepoUnitAccess(unit.TypeProjects, perm.AccessModeWrite, true), func(ctx *context.Context) {
if ctx.ContextUser.IsIndividual() && ctx.ContextUser.ID != ctx.Doer.ID {
ctx.NotFound(nil)
return
}
})
}, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead, true), individualPermsChecker)
}, reqAnyRepoUnitAccess(unit.TypeProjects, perm.AccessModeRead, true), individualPermsChecker)
m.Group("", func() {
m.Get("/code", user.CodeSearch)
}, reqUnitAccess(unit.TypeCode, perm.AccessModeRead, false), individualPermsChecker)
}, reqAnyRepoUnitAccess(unit.TypeCode, perm.AccessModeRead, false), individualPermsChecker)
}, optSignIn, context.UserAssignmentWeb(), context.OrgAssignment(context.OrgAssignmentOptions{}))
// end "/{username}/-": packages, projects, code