tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-08-14 05:28:27 +00:00
Code Releases Activity

Fix comment permissions (#28213) (#28217)

Browse Source 
backport #28213 

This PR will fix some missed checks for private repositories' data on
web routes and API routes.
This commit is contained in:
Lunny Xiao
2023-11-26 07:21:41 +08:00
committed by GitHub
parent 41b2d0be93
commit dfd511faf3
35 changed files with 422 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
models/asymkey/gpg_key.go
View File

@@ -93,9 +93,9 @@ func CountUserGPGKeys(userID int64) (int64, error) {
}
// GetGPGKeyByID returns public key by given ID.
func GetGPGKeyByID(keyID int64) (*GPGKey, error) {
func GetGPGKeyForUserByID(ownerID, keyID int64) (*GPGKey, error) {
key := new(GPGKey)
has, err := db.GetEngine(db.DefaultContext).ID(keyID).Get(key)
has, err := db.GetEngine(db.DefaultContext).Where("id=? AND owner_id=?", keyID, ownerID).Get(key)
if err != nil {
return nil, err
} else if !has {
@@ -225,7 +225,7 @@ func deleteGPGKey(ctx context.Context, keyID string) (int64, error) {
// DeleteGPGKey deletes GPG key information in database.
func DeleteGPGKey(doer *user_model.User, id int64) (err error) {
key, err := GetGPGKeyByID(id)
key, err := GetGPGKeyForUserByID(doer.ID, id)
if err != nil {
if IsErrGPGKeyNotExist(err) {
return nil
@@ -233,11 +233,6 @@ func DeleteGPGKey(doer *user_model.User, id int64) (err error) {
return fmt.Errorf("GetPublicKeyByID: %w", err)
}
// Check if user has access to delete this key.
if !doer.IsAdmin && doer.ID != key.OwnerID {
return ErrGPGKeyAccessDenied{doer.ID, key.ID}
}
ctx, committer, err := db.TxContext(db.DefaultContext)
if err != nil {
return err