tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-07-22 18:28:37 +00:00
Code Releases Activity

fix users being able bypass limits with repo transfers (#34031)

Browse Source 
prevent user from being able to transfer repo to user who cannot have
more repositories
This commit is contained in:
TheFox0x7
2025-03-31 22:19:32 +02:00
committed by GitHub
parent a2e8a289b2
commit 4d2323183d
6 changed files with 92 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
routers/api/v1/repo/transfer.go
View File

@@ -108,22 +108,19 @@ func Transfer(ctx *context.APIContext) {
oldFullname := ctx.Repo.Repository.FullName()
if err := repo_service.StartRepositoryTransfer(ctx, ctx.Doer, newOwner, ctx.Repo.Repository, teams); err != nil {
if repo_model.IsErrRepoTransferInProgress(err) {
switch {
case repo_model.IsErrRepoTransferInProgress(err):
ctx.APIError(http.StatusConflict, err)
return
}
if repo_model.IsErrRepoAlreadyExist(err) {
case repo_model.IsErrRepoAlreadyExist(err):
ctx.APIError(http.StatusUnprocessableEntity, err)
case repo_service.IsRepositoryLimitReached(err):
ctx.APIError(http.StatusForbidden, err)
case errors.Is(err, user_model.ErrBlockedUser):
ctx.APIError(http.StatusForbidden, err)
default:
ctx.APIErrorInternal(err)
return
}
if errors.Is(err, user_model.ErrBlockedUser) {
ctx.APIError(http.StatusForbidden, err)
} else {
ctx.APIErrorInternal(err)
}
return
}
if ctx.Repo.Repository.Status == repo_model.RepositoryPendingTransfer {
@@ -169,6 +166,8 @@ func AcceptTransfer(ctx *context.APIContext) {
ctx.APIError(http.StatusNotFound, err)
case errors.Is(err, util.ErrPermissionDenied):
ctx.APIError(http.StatusForbidden, err)
case repo_service.IsRepositoryLimitReached(err):
ctx.APIError(http.StatusForbidden, err)
default:
ctx.APIErrorInternal(err)
}