Skip to content

Commit bb82a31

Browse files
Zettat123GiteaBot
authored andcommitted
Fix access check for org-level project (go-gitea#26182)
Fix go-gitea#25934 Add `ignoreGlobal` parameter to `reqUnitAccess` and only check global disabled units when `ignoreGlobal` is true. So the org-level projects and user-level projects won't be affected by global disabled `repo.projects` unit.
1 parent 0981411 commit bb82a31

File tree

3 files changed

+74
-6
lines changed

3 files changed

+74
-6
lines changed

models/fixtures/team_unit.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,3 +280,9 @@
280280
team_id: 20
281281
type: 9 # package
282282
access_mode: 2
283+
284+
-
285+
id: 48
286+
team_id: 2
287+
type: 8
288+
access_mode: 2

routers/web/web.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -262,9 +262,10 @@ func registerRoutes(m *web.Route) {
262262
}
263263
}
264264

265-
reqUnitAccess := func(unitType unit.Type, accessMode perm.AccessMode) func(ctx *context.Context) {
265+
reqUnitAccess := func(unitType unit.Type, accessMode perm.AccessMode, ignoreGlobal bool) func(ctx *context.Context) {
266266
return func(ctx *context.Context) {
267-
if unitType.UnitGlobalDisabled() {
267+
// only check global disabled units when ignoreGlobal is false
268+
if !ignoreGlobal && unitType.UnitGlobalDisabled() {
268269
ctx.NotFound(unitType.String(), nil)
269270
return
270271
}
@@ -828,7 +829,7 @@ func registerRoutes(m *web.Route) {
828829
m.Group("", func() {
829830
m.Get("", org.Projects)
830831
m.Get("/{id}", org.ViewProject)
831-
}, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead))
832+
}, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead, true))
832833
m.Group("", func() { //nolint:dupl
833834
m.Get("/new", org.RenderNewProject)
834835
m.Post("/new", web.Bind(forms.CreateProjectForm{}), org.NewProjectPost)
@@ -849,17 +850,17 @@ func registerRoutes(m *web.Route) {
849850
m.Post("/move", org.MoveIssues)
850851
})
851852
})
852-
}, reqSignIn, reqUnitAccess(unit.TypeProjects, perm.AccessModeWrite), func(ctx *context.Context) {
853+
}, reqSignIn, reqUnitAccess(unit.TypeProjects, perm.AccessModeWrite, true), func(ctx *context.Context) {
853854
if ctx.ContextUser.IsIndividual() && ctx.ContextUser.ID != ctx.Doer.ID {
854855
ctx.NotFound("NewProject", nil)
855856
return
856857
}
857858
})
858-
}, repo.MustEnableProjects)
859+
})
859860

860861
m.Group("", func() {
861862
m.Get("/code", user.CodeSearch)
862-
}, reqUnitAccess(unit.TypeCode, perm.AccessModeRead))
863+
}, reqUnitAccess(unit.TypeCode, perm.AccessModeRead, false))
863864
}, ignSignIn, context_service.UserAssignmentWeb(), context.OrgAssignment()) // for "/{username}/-" (packages, projects, code)
864865

865866
// ***** Release Attachment Download without Signin

tests/integration/org_project_test.go

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Copyright 2023 The Gitea Authors. All rights reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
package integration
5+
6+
import (
7+
"net/http"
8+
"testing"
9+
10+
unit_model "code.gitea.io/gitea/models/unit"
11+
"code.gitea.io/gitea/tests"
12+
)
13+
14+
func TestOrgProjectAccess(t *testing.T) {
15+
defer tests.PrepareTestEnv(t)()
16+
17+
// disable repo project unit
18+
unit_model.DisabledRepoUnits = []unit_model.Type{unit_model.TypeProjects}
19+
20+
// repo project, 404
21+
req := NewRequest(t, "GET", "/user2/repo1/projects")
22+
MakeRequest(t, req, http.StatusNotFound)
23+
24+
// user project, 200
25+
req = NewRequest(t, "GET", "/user2/-/projects")
26+
MakeRequest(t, req, http.StatusOK)
27+
28+
// org project, 200
29+
req = NewRequest(t, "GET", "/user3/-/projects")
30+
MakeRequest(t, req, http.StatusOK)
31+
32+
// change the org's visibility to private
33+
session := loginUser(t, "user2")
34+
req = NewRequestWithValues(t, "POST", "/org/user3/settings", map[string]string{
35+
"_csrf": GetCSRF(t, session, "/user3/-/projects"),
36+
"name": "user3",
37+
"visibility": "2",
38+
})
39+
session.MakeRequest(t, req, http.StatusSeeOther)
40+
41+
// user4 can still access the org's project because its team(team1) has the permission
42+
session = loginUser(t, "user4")
43+
req = NewRequest(t, "GET", "/user3/-/projects")
44+
session.MakeRequest(t, req, http.StatusOK)
45+
46+
// disable team1's project unit
47+
session = loginUser(t, "user2")
48+
req = NewRequestWithValues(t, "POST", "/org/user3/teams/team1/edit", map[string]string{
49+
"_csrf": GetCSRF(t, session, "/user3/-/projects"),
50+
"team_name": "team1",
51+
"repo_access": "specific",
52+
"permission": "read",
53+
"unit_8": "0",
54+
})
55+
session.MakeRequest(t, req, http.StatusSeeOther)
56+
57+
// user4 can no longer access the org's project
58+
session = loginUser(t, "user4")
59+
req = NewRequest(t, "GET", "/user3/-/projects")
60+
session.MakeRequest(t, req, http.StatusNotFound)
61+
}

0 commit comments

Comments
 (0)