tdsds.com/gitea
tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2024-12-22 16:44:26 +00:00
Code Releases Activity

Fix internal server error when updating labels without write permission (#32776)

Browse Source 
Fix #32775

if permission denined, `prepareForReplaceOrAdd` will return nothing, and
this case is not handled.
This commit is contained in:
yp05327 2024-12-11 03:42:52 +09:00 committed by GitHub
parent 8f271c6036
commit 2ac6f2b129
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
routers/api/v1/repo/issue_label.go
View File

@ -319,6 +319,11 @@ func prepareForReplaceOrAdd(ctx *context.APIContext, form api.IssueLabelsOption)
return nil, nil, err
}
if !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) {
ctx.Error(http.StatusForbidden, "CanWriteIssuesOrPulls", "write permission is required")
return nil, nil, fmt.Errorf("permission denied")
}
var (
labelIDs []int64
labelNames []string
@ -350,10 +355,5 @@ func prepareForReplaceOrAdd(ctx *context.APIContext, form api.IssueLabelsOption)
return nil, nil, err
}
if !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) {
ctx.Status(http.StatusForbidden)
return nil, nil, nil
}
return issue, labels, err
}