ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

fix(markup): enforce same-repository issue access (#39045) (#39054)

Browse Source 
Backport #39045 by @bircni

Enforce Issues and Pull Requests access for references within the
current repository.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Giteabot
2026-08-22 20:06:24 +00:00
committed by GitHub
co-authored by bircni silverwind wxiaoguang
parent 6e2cf10687
commit 25fff4c043
2 changed files with 47 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/markup/renderhelper_issueicontitle.go
+5 -4
View File
@@ -42,14 +42,15 @@ func renderRepoIssueIconTitle(ctx context.Context, opts markup.RenderIssueIconTi
return "", err
}
permission := webCtx.Repo.Permission
if webCtx.Repo.Repository == nil || dbRepo.ID != webCtx.Repo.Repository.ID {
perms, err := access.GetDoerRepoPermission(ctx, dbRepo, webCtx.Doer)
permission, err = access.GetDoerRepoPermission(ctx, dbRepo, webCtx.Doer)
if err != nil {
return "", err
}
if !perms.CanReadIssuesOrPulls(issue.IsPull) {
return "", util.ErrPermissionDenied
}
}
if !permission.CanReadIssuesOrPulls(issue.IsPull) {
return "", util.ErrPermissionDenied
}
if issue.IsPull {