Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)

backport #36798 

- fix wrong parameter of HasOrgOrUserVisible in
routers/api/v1/org/org.go
- add integration tests covering the bug fix
- merge permissions API tests

---
Generated by a coding agent with Codex 5.2
This commit is contained in:
Lunny Xiao
2026-03-08 16:26:08 +00:00
committed by GitHub
parent 4f562da975
commit 96515c0f20
2 changed files with 59 additions and 17 deletions
+1 -1
View File
@@ -135,7 +135,7 @@ func GetUserOrgsPermissions(ctx *context.APIContext) {
op := api.OrganizationPermissions{}
if !organization.HasOrgOrUserVisible(ctx, o, ctx.ContextUser) {
if !organization.HasOrgOrUserVisible(ctx, o, ctx.Doer) {
ctx.APIErrorNotFound("HasOrgOrUserVisible", nil)
return
}