ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 14:03:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(api): deny private org member enumeration via /members (#38213)

Browse Source
This commit is contained in:
bircni
2026-06-26 18:35:13 +00:00
committed by GitHub
parent 1b0992eb2e
commit 122ebcf0a8
3 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/api.go
+2 -2
View File
@@ -1719,7 +1719,7 @@ func Routes() *web.Router {
m.Get("", reqToken(), org.ListMembers)
m.Combo("/{username}").Get(reqToken(), org.IsMember).
Delete(reqToken(), reqOrgOwnership(), org.DeleteMember)
})
}, reqOrgVisible())
addActionsRoutes(
m,
reqOrgMembership(),
@@ -1731,7 +1731,7 @@ func Routes() *web.Router {
m.Combo("/{username}").Get(org.IsPublicMember).
Put(reqToken(), reqOrgMembership(), org.PublicizeMember).
Delete(reqToken(), reqOrgMembership(), org.ConcealMember)
})
}, reqOrgVisible())
m.Group("/teams", func() {
m.Get("", org.ListTeams)
m.Post("", reqOrgOwnership(), bind(api.CreateTeamOption{}), org.CreateTeam)