ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 14:03:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(markup): enforce same-repository issue access (#39045) (#39054)

Browse Source 
Backport #39045 by @bircni

Enforce Issues and Pull Requests access for references within the
current repository.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Giteabot
2026-08-22 20:06:24 +00:00
committed by GitHub
co-authored by bircni silverwind wxiaoguang
parent 6e2cf10687
commit 25fff4c043
2 changed files with 47 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/markup/renderhelper_issueicontitle.go
+5 -4
View File
@@ -42,14 +42,15 @@ func renderRepoIssueIconTitle(ctx context.Context, opts markup.RenderIssueIconTi
return "", err return "", err
} }
permission := webCtx.Repo.Permission
if webCtx.Repo.Repository == nil || dbRepo.ID != webCtx.Repo.Repository.ID { if webCtx.Repo.Repository == nil || dbRepo.ID != webCtx.Repo.Repository.ID {
perms, err := access.GetDoerRepoPermission(ctx, dbRepo, webCtx.Doer) permission, err = access.GetDoerRepoPermission(ctx, dbRepo, webCtx.Doer)
if err != nil { if err != nil {
return "", err return "", err
} }
if !perms.CanReadIssuesOrPulls(issue.IsPull) { }
return "", util.ErrPermissionDenied if !permission.CanReadIssuesOrPulls(issue.IsPull) {
} return "", util.ErrPermissionDenied
} }
if issue.IsPull { if issue.IsPull {
services/markup/renderhelper_issueicontitle_test.go
+42 -23
View File
@@ -6,7 +6,10 @@ package markup
import ( import (
"testing" "testing"
issue_model "gitea.dev/models/issues"
perm_model "gitea.dev/models/perm"
"gitea.dev/models/repo" "gitea.dev/models/repo"
"gitea.dev/models/unit"
"gitea.dev/models/unittest" "gitea.dev/models/unittest"
"gitea.dev/modules/markup" "gitea.dev/modules/markup"
"gitea.dev/modules/templates" "gitea.dev/modules/templates"
@@ -14,36 +17,52 @@ import (
"gitea.dev/services/contexttest" "gitea.dev/services/contexttest"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"xorm.io/builder"
) )
func TestRenderHelperIssueIconTitle(t *testing.T) { func TestRenderHelperIssueIconTitle(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase()) assert.NoError(t, unittest.PrepareTestDatabase())
ctx, _ := contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()}) t.Run("RenderInCurrentRepo", func(t *testing.T) {
ctx.Repo.Repository = unittest.AssertExistsAndLoadBean(t, &repo.Repository{ID: 1}) ctx, _ := contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()})
htm, err := renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{ contexttest.LoadRepo(t, ctx, 1)
LinkHref: "/link", htm, err := renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{
IssueIndex: 1, LinkHref: "/link",
}) IssueIndex: 1,
assert.NoError(t, err) })
assert.Equal(t, `<a href="/link"><span>octicon-issue-opened(16/tw-text-green)</span> issue1 (#1)</a>`, string(htm)) assert.NoError(t, err)
assert.Equal(t, `<a href="/link"><span>octicon-issue-opened(16/tw-text-green)</span> issue1 (#1)</a>`, string(htm))
ctx, _ = contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()}) ctx.Repo.Permission.SetUnitsWithDefaultAccessMode([]*repo.RepoUnit{{Type: unit.TypeWiki}}, perm_model.AccessModeRead)
htm, err = renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{ issueA := unittest.AssertExistsAndLoadBean(t, &issue_model.Issue{}, builder.Eq{"repo_id": 1, "`index`": 1, "is_pull": false})
OwnerName: "user2", issueB := unittest.AssertExistsAndLoadBean(t, &issue_model.Issue{}, builder.Eq{"repo_id": 1, "`index`": 2, "is_pull": true})
RepoName: "repo1", for _, issueIndex := range []int64{issueA.Index, issueB.Index} {
LinkHref: "/link", _, err = renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{
IssueIndex: 1, LinkHref: "/link",
IssueIndex: issueIndex,
})
assert.ErrorIs(t, err, util.ErrPermissionDenied)
}
}) })
assert.NoError(t, err)
assert.Equal(t, `<a href="/link"><span>octicon-issue-opened(16/tw-text-green)</span> issue1 (user2/repo1#1)</a>`, string(htm))
ctx, _ = contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()}) t.Run("RenderAcrossRepo", func(t *testing.T) {
_, err = renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{ ctx, _ := contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()})
OwnerName: "user2", htm, err := renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{
RepoName: "repo2", OwnerName: "user2",
LinkHref: "/link", RepoName: "repo1",
IssueIndex: 2, LinkHref: "/link",
IssueIndex: 1,
})
assert.NoError(t, err)
assert.Equal(t, `<a href="/link"><span>octicon-issue-opened(16/tw-text-green)</span> issue1 (user2/repo1#1)</a>`, string(htm))
ctx, _ = contexttest.MockContext(t, "/", contexttest.MockContextOption{Render: templates.PageRenderer()})
_, err = renderRepoIssueIconTitle(ctx, markup.RenderIssueIconTitleOptions{
OwnerName: "user2",
RepoName: "repo2",
LinkHref: "/link",
IssueIndex: 2,
})
assert.ErrorIs(t, err, util.ErrPermissionDenied)
}) })
assert.ErrorIs(t, err, util.ErrPermissionDenied)
} }