ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-16 01:43:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(api): hide limited users from restricted viewers (#39004)

Browse Source 
Use the canonical profile-visibility check for user API content and
prevent restricted users from enumerating public repositories owned by
limited users.

This keeps feeds, heatmaps, keys, and issue search consistent with
profile visibility.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-22 08:08:36 +00:00
committed by GitHub
co-authored by silverwind
parent f7072b0305
commit 6bb6ce678b
4 changed files with 84 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/repo/repo_list.go
+3 -9
View File
@@ -652,18 +652,12 @@ func SearchRepositoryIDsByCondition(ctx context.Context, cond builder.Cond) ([]i
Find(&repoIDs)
}
func userAllPublicRepoCond(cond builder.Cond, orgVisibilityLimit []structs.VisibleType) builder.Cond {
func userAllPublicRepoCond(cond builder.Cond, ownerVisibilityLimit []structs.VisibleType) builder.Cond {
return cond.Or(builder.And(
builder.Eq{"`repository`.is_private": false},
// Exclude owners who are not visible to the caller.
builder.NotIn("`repository`.owner_id", builder.Select("id").From("`user`").Where(
builder.Or(
builder.And(
builder.Eq{"type": user_model.UserTypeOrganization},
builder.In("visibility", orgVisibilityLimit)),
builder.And(
builder.Neq{"type": user_model.UserTypeOrganization},
builder.Neq{"visibility": structs.VisibleTypePublic}),
),
builder.In("visibility", ownerVisibilityLimit),
))))
}