ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 14:03:24 +09:00
Code Issues Projects Releases Wiki Activity

fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)

Browse Source 
Backport #38453

Co-authored-by: xkm <fzc_study@163.com>
This commit is contained in:
Giteabot
2026-07-14 20:06:17 -07:00
committed by GitHub
co-authored by xkm
parent c32af046a2
commit 6e86c4cde8
4 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/shared/actions/runners.go
+9 -7
View File
@@ -373,16 +373,18 @@ func RunnerBulkActionPost(ctx *context.Context) {
return
}
var runnerIDs []int64
if rCtx.IsAdmin {
// ATTENTION: it completely depends on the assumption that the doer is "site admin"
// So it doesn't do extra permission check to the runner IDs
// In the future, if you need to support such operation on non-admin pages, be careful!
runnerIDs = ctx.FormStringInt64s("ids")
} else {
if !rCtx.IsAdmin {
ctx.HTTPError(http.StatusForbidden, "bulk actions are admin-only")
return
}
// ATTENTION: it completely depends on the assumption that the doer is "site admin"
// So it doesn't do extra permission check to the runner IDs
// In the future, if you need to support such operation on non-admin pages, be careful!
runnerIDs := ctx.FormStringInt64s("ids")
if len(runnerIDs) == 0 {
ctx.HTTPError(http.StatusBadRequest, "missing runner IDs")
return
}
action := ctx.FormString("action")
var successKey, failedKey string