From 9bd08c9a6674d21047e1ddedd72c83a359926c11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 15:41:10 +0100 Subject: [PATCH 01/16] enforce reqRepoReader(unit.TypeIssues) GET /repos/{owner}/{repo}/issues/pinned (cherry picked from commit 00fad97fc1b27db40a002c9ab3f709d04dc2cdd1) (cherry picked from commit a8a0784e3f4cf24973af3c86f9245beee82a9026) --- routers/api/v1/api.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index 487e669b64598..ec3ba6cda1cf7 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -1259,7 +1259,7 @@ func Routes() *web.Route { m.Group("/issues", func() { m.Combo("").Get(repo.ListIssues). Post(reqToken(), mustNotBeArchived, bind(api.CreateIssueOption{}), repo.CreateIssue) - m.Get("/pinned", repo.ListPinnedIssues) + m.Get("/pinned", reqRepoReader(unit.TypeIssues), repo.ListPinnedIssues) m.Group("/comments", func() { m.Get("", repo.ListRepoIssueComments) m.Group("/{id}", func() { From 3ff58e4f7bf62fc975ef4083db0eeec68d9ddada Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 15:42:22 +0100 Subject: [PATCH 02/16] enforce reqRepoReader(unit.TypeIssues) POST /repos/{owner}/{repo}/issues (cherry picked from commit d3db2fa8bc85e9d67f30854bba0a4c1e8b57b015) (cherry picked from commit e95565a6ad82a1fa5d61f3e02a76f696fcdcbf03) --- routers/api/v1/api.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index ec3ba6cda1cf7..0c8672f5aa7f1 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -1258,7 +1258,7 @@ func Routes() *web.Route { m.Group("/{username}/{reponame}", func() { m.Group("/issues", func() { m.Combo("").Get(repo.ListIssues). - Post(reqToken(), mustNotBeArchived, bind(api.CreateIssueOption{}), repo.CreateIssue) + Post(reqToken(), mustNotBeArchived, bind(api.CreateIssueOption{}), reqRepoReader(unit.TypeIssues), repo.CreateIssue) m.Get("/pinned", reqRepoReader(unit.TypeIssues), repo.ListPinnedIssues) m.Group("/comments", func() { m.Get("", repo.ListRepoIssueComments) From df818bbfc3017e0785891ea6da5606a2c37bc26f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 13:51:33 +0100 Subject: [PATCH 03/16] fix API usage of a PR index in place of issue index and vice versa (cherry picked from commit 7b95266de083c8de0ff224530a9b69e82c52c344) (cherry picked from commit 30f43dbcd47c80cc2dde2bb23e7f57e9bc7bfa61) --- models/issues/comment.go | 6 +++++- routers/api/v1/repo/issue.go | 22 +++++++++++++++++++ routers/api/v1/repo/issue_comment.go | 32 ++++++++++++++++++++++++++++ 3 files changed, 59 insertions(+), 1 deletion(-) diff --git a/models/issues/comment.go b/models/issues/comment.go index df1a300354e78..9eaa8a6eba64f 100644 --- a/models/issues/comment.go +++ b/models/issues/comment.go @@ -1016,6 +1016,7 @@ type FindCommentsOptions struct { Type CommentType IssueIDs []int64 Invalidated util.OptionalBool + IsPull util.OptionalBool } // ToConds implements FindOptions interface @@ -1050,6 +1051,9 @@ func (opts *FindCommentsOptions) ToConds() builder.Cond { if !opts.Invalidated.IsNone() { cond = cond.And(builder.Eq{"comment.invalidated": opts.Invalidated.IsTrue()}) } + if opts.IsPull != util.OptionalBoolNone { + cond = cond.And(builder.Eq{"issue.is_pull": opts.IsPull.IsTrue()}) + } return cond } @@ -1057,7 +1061,7 @@ func (opts *FindCommentsOptions) ToConds() builder.Cond { func FindComments(ctx context.Context, opts *FindCommentsOptions) (CommentList, error) { comments := make([]*Comment, 0, 10) sess := db.GetEngine(ctx).Where(opts.ToConds()) - if opts.RepoID > 0 { + if opts.RepoID > 0 || opts.IsPull != util.OptionalBoolNone { sess.Join("INNER", "issue", "issue.id = comment.issue_id") } diff --git a/routers/api/v1/repo/issue.go b/routers/api/v1/repo/issue.go index 9405a5f13db4e..aca21879608c6 100644 --- a/routers/api/v1/repo/issue.go +++ b/routers/api/v1/repo/issue.go @@ -462,6 +462,24 @@ func ListIssues(ctx *context.APIContext) { isPull = util.OptionalBoolNone } + if isPull != util.OptionalBoolNone && !ctx.Repo.CanWriteIssuesOrPulls(isPull.IsTrue()) { + ctx.NotFound() + return + } + + if isPull == util.OptionalBoolNone { + canReadIssues := ctx.Repo.CanRead(unit.TypeIssues) + canReadPulls := ctx.Repo.CanRead(unit.TypePullRequests) + if !canReadIssues && !canReadPulls { + ctx.NotFound() + return + } else if !canReadIssues { + isPull = util.OptionalBoolTrue + } else if !canReadPulls { + isPull = util.OptionalBoolFalse + } + } + // FIXME: we should be more efficient here createdByID := getUserIDForFilter(ctx, "created_by") if ctx.Written() { @@ -593,6 +611,10 @@ func GetIssue(ctx *context.APIContext) { } return } + if !ctx.Repo.CanReadIssuesOrPulls(issue.IsPull) { + ctx.NotFound() + return + } ctx.JSON(http.StatusOK, convert.ToAPIIssue(ctx, issue)) } diff --git a/routers/api/v1/repo/issue_comment.go b/routers/api/v1/repo/issue_comment.go index 872ce10db08ba..8856a2f6a2489 100644 --- a/routers/api/v1/repo/issue_comment.go +++ b/routers/api/v1/repo/issue_comment.go @@ -12,9 +12,11 @@ import ( issues_model "code.gitea.io/gitea/models/issues" access_model "code.gitea.io/gitea/models/perm/access" repo_model "code.gitea.io/gitea/models/repo" + "code.gitea.io/gitea/models/unit" user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/context" api "code.gitea.io/gitea/modules/structs" + "code.gitea.io/gitea/modules/util" "code.gitea.io/gitea/modules/web" "code.gitea.io/gitea/routers/api/v1/utils" "code.gitea.io/gitea/services/convert" @@ -71,6 +73,11 @@ func ListIssueComments(ctx *context.APIContext) { ctx.Error(http.StatusInternalServerError, "GetRawIssueByIndex", err) return } + if !ctx.Repo.CanReadIssuesOrPulls(issue.IsPull) { + ctx.NotFound() + return + } + issue.Repo = ctx.Repo.Repository opts := &issues_model.FindCommentsOptions{ @@ -271,12 +278,27 @@ func ListRepoIssueComments(ctx *context.APIContext) { return } + var isPull util.OptionalBool + canReadIssue := ctx.Repo.CanRead(unit.TypeIssues) + canReadPull := ctx.Repo.CanRead(unit.TypePullRequests) + if canReadIssue && canReadPull { + isPull = util.OptionalBoolNone + } else if canReadIssue { + isPull = util.OptionalBoolFalse + } else if canReadPull { + isPull = util.OptionalBoolTrue + } else { + ctx.NotFound() + return + } + opts := &issues_model.FindCommentsOptions{ ListOptions: utils.GetListOptions(ctx), RepoID: ctx.Repo.Repository.ID, Type: issues_model.CommentTypeComment, Since: since, Before: before, + IsPull: isPull, } comments, err := issues_model.FindComments(ctx, opts) @@ -365,6 +387,11 @@ func CreateIssueComment(ctx *context.APIContext) { return } + if !ctx.Repo.CanReadIssuesOrPulls(issue.IsPull) { + ctx.NotFound() + return + } + if issue.IsLocked && !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) && !ctx.Doer.IsAdmin { ctx.Error(http.StatusForbidden, "CreateIssueComment", errors.New(ctx.Tr("repo.issues.comment_on_locked"))) return @@ -434,6 +461,11 @@ func GetIssueComment(ctx *context.APIContext) { return } + if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) { + ctx.NotFound() + return + } + if comment.Type != issues_model.CommentTypeComment { ctx.Status(http.StatusNoContent) return From 81e348d63d981edf597f7b8c32b3d0e05c62d373 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 14:49:43 +0100 Subject: [PATCH 04/16] fix PATCH /api/v1/repos/{owner}/{repo}/issues/comments/{id} (cherry picked from commit 51c280e877765efe721e607aa95bcbb5aef364e0) (cherry picked from commit 383b4333cf7aa1165e20d8a9bd2c07e3212b9da8) --- routers/api/v1/repo/issue_comment.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/routers/api/v1/repo/issue_comment.go b/routers/api/v1/repo/issue_comment.go index 8856a2f6a2489..5cc8e9508a699 100644 --- a/routers/api/v1/repo/issue_comment.go +++ b/routers/api/v1/repo/issue_comment.go @@ -584,7 +584,17 @@ func editIssueComment(ctx *context.APIContext, form api.EditIssueCommentOption) return } - if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.IsAdmin()) { + if err := comment.LoadIssue(ctx); err != nil { + ctx.Error(http.StatusInternalServerError, "LoadIssue", err) + return + } + + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.Status(http.StatusNotFound) + return + } + + if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull)) { ctx.Status(http.StatusForbidden) return } From 0f1204dfefdf8fc599bfea5c55bb8c6f8c225865 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 15:14:32 +0100 Subject: [PATCH 05/16] fix {DELETE,POST} /repos/{owner}/{repo}/issues/comments/{id}/reactions (cherry picked from commit f499075c53752f983c6e4f8af17c449926ba94d9) (cherry picked from commit df1a01507f61790bb89de1f2d4cce474fc3a544e) --- routers/api/v1/repo/issue_reaction.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go index 29c99184e7649..736f9ef24149b 100644 --- a/routers/api/v1/repo/issue_reaction.go +++ b/routers/api/v1/repo/issue_reaction.go @@ -190,9 +190,19 @@ func changeIssueCommentReaction(ctx *context.APIContext, form api.EditReactionOp return } - err = comment.LoadIssue(ctx) - if err != nil { + if err = comment.LoadIssue(ctx); err != nil { ctx.Error(http.StatusInternalServerError, "comment.LoadIssue() failed", err) + return + } + + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound() + return + } + + if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) { + ctx.NotFound() + return } if comment.Issue.IsLocked && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull) { From 594ce979da30d10f50d9c6f1ca6e8633581cdf59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 15:19:12 +0100 Subject: [PATCH 06/16] fix GET /repos/{owner}/{repo}/issues/comments/{id}/reactions (cherry picked from commit a146e3d0f9ff8ac1aee4be8a3632c76b35fc3482) (cherry picked from commit 2f6dc175aab7541581401b1005b23b054906ee77) --- routers/api/v1/repo/issue_reaction.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go index 736f9ef24149b..c886bd71b7687 100644 --- a/routers/api/v1/repo/issue_reaction.go +++ b/routers/api/v1/repo/issue_reaction.go @@ -61,6 +61,12 @@ func GetIssueCommentReactions(ctx *context.APIContext) { if err := comment.LoadIssue(ctx); err != nil { ctx.Error(http.StatusInternalServerError, "comment.LoadIssue", err) + return + } + + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound() + return } if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) { From f503719a43c0c6b0c126438b7d832a453d05c325 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 15:31:34 +0100 Subject: [PATCH 07/16] fix DELETE /api/v1/repos/{owner}/{repo}/issues/comments/{id} (cherry picked from commit 521eed2312f45bef7de28c9c03c04257862a453c) (cherry picked from commit 7ef02b03d1fbebf5c1cbae5688381ff732d25391) --- routers/api/v1/repo/issue_comment.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/routers/api/v1/repo/issue_comment.go b/routers/api/v1/repo/issue_comment.go index 5cc8e9508a699..1339312e503e5 100644 --- a/routers/api/v1/repo/issue_comment.go +++ b/routers/api/v1/repo/issue_comment.go @@ -697,7 +697,17 @@ func deleteIssueComment(ctx *context.APIContext) { return } - if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.IsAdmin()) { + if err := comment.LoadIssue(ctx); err != nil { + ctx.Error(http.StatusInternalServerError, "LoadIssue", err) + return + } + + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.Status(http.StatusNotFound) + return + } + + if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull)) { ctx.Status(http.StatusForbidden) return } else if comment.Type != issues_model.CommentTypeComment { From 1b1c36ffb3a5dfba0422100452657973e0c0acc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 16:41:34 +0100 Subject: [PATCH 08/16] fix POST /{owner}/{repo}/comments/{id}/delete (cherry picked from commit 1b57d8493882d9d659164acd3b4a5a99c769d8ed) (cherry picked from commit ffe70563fed45d384e0a20a1a4be76114a515075) --- routers/web/repo/issue.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index 59d6fe24d9c67..249b72c2cf3b7 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -3157,6 +3157,11 @@ func DeleteComment(ctx *context.Context) { return } + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } + if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull)) { ctx.Error(http.StatusForbidden) return From d1254d1dae9be3d0b4fef85ace9c9e088ce66344 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 17:00:30 +0100 Subject: [PATCH 09/16] fix POST /{owner}/{repo}/comments/{id} (cherry picked from commit 385a1f337462bec34ccc389d4efe21e3b2be8465) (cherry picked from commit 6e45c8d1cb1e55f477dd8f6dc793a7146c9c6675) --- routers/web/repo/issue.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index 249b72c2cf3b7..bbd50148e9584 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -3091,6 +3091,11 @@ func UpdateCommentContent(ctx *context.Context) { return } + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } + if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull)) { ctx.Error(http.StatusForbidden) return From 9a7bb5577aa1f7f9c4d7898ce7df75f46bcb74e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Thu, 2 Nov 2023 17:03:48 +0100 Subject: [PATCH 10/16] fix POST /{owner}/{repo}/comments/{id}/reactions/{action} (cherry picked from commit 21d4556cbeb9d0f825398114ba3a4816f331315b) (cherry picked from commit 3cd467f82f570e5a2c3075bdc2ec0c17a998ebb1) --- routers/web/repo/issue.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index bbd50148e9584..f413114f0c021 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -3293,6 +3293,11 @@ func ChangeCommentReaction(ctx *context.Context) { return } + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } + if !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull)) { if log.IsTrace() { if ctx.IsSigned { From 8606efd7a427598a8ea1291d4626fc3cbe52fdc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Sun, 12 Nov 2023 13:00:51 +0100 Subject: [PATCH 11/16] fix GET /{owner}/{repo}/comments/{id}/attachments (cherry picked from commit aed193ef9f5d59aed12cfd7518765d5598c7999f) (cherry picked from commit 12c8414d84c9c15b066652dbae04f48d02882494) --- routers/web/repo/issue.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index f413114f0c021..1ac139ceb512b 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -3441,6 +3441,16 @@ func GetCommentAttachments(ctx *context.Context) { return } + if err := comment.LoadIssue(ctx); err != nil { + ctx.NotFoundOrServerError("LoadIssue", issues_model.IsErrIssueNotExist, err) + return + } + + if comment.Issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } + if !comment.Type.HasAttachmentSupport() { ctx.ServerError("GetCommentAttachments", fmt.Errorf("comment type %v does not support attachments", comment.Type)) return From 485d48c50863ccbc274cec95b18e81491b2bd97f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Sun, 12 Nov 2023 18:24:56 +0100 Subject: [PATCH 12/16] fix POST /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/soft-delete (cherry picked from commit a11d82a42729eba02032310f7778a9197f4f8ead) (cherry picked from commit 020e2983bb1229f27538872842c955c8c3992461) --- routers/web/repo/issue_content_history.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/routers/web/repo/issue_content_history.go b/routers/web/repo/issue_content_history.go index 5c378fe9d79df..3d169077137c9 100644 --- a/routers/web/repo/issue_content_history.go +++ b/routers/web/repo/issue_content_history.go @@ -198,11 +198,19 @@ func SoftDeleteContentHistory(ctx *context.Context) { log.Error("can not get comment for issue content history %v. err=%v", historyID, err) return } + if comment.IssueID != issue.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } } if history, err = issues_model.GetIssueContentHistoryByID(ctx, historyID); err != nil { log.Error("can not get issue content history %v. err=%v", historyID, err) return } + if history.IssueID != issue.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } canSoftDelete := canSoftDeleteContentHistory(ctx, issue, comment, history) if !canSoftDelete { From 352b68c76009206d53a89b29529120e4effb4f63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Sun, 12 Nov 2023 18:45:40 +0100 Subject: [PATCH 13/16] fix GET /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/detail (cherry picked from commit 0853dec293dd632a03948f66af69e75dd582a92d) (cherry picked from commit 8078a3d400e719e95277a9fcc452b4101e40002a) --- routers/web/repo/issue_content_history.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/routers/web/repo/issue_content_history.go b/routers/web/repo/issue_content_history.go index 3d169077137c9..216fec2c1c85f 100644 --- a/routers/web/repo/issue_content_history.go +++ b/routers/web/repo/issue_content_history.go @@ -129,6 +129,10 @@ func GetContentHistoryDetail(ctx *context.Context) { }) return } + if history.IssueID != issue.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } // get the related comment if this history revision is for a comment, otherwise the history revision is for an issue. var comment *issues_model.Comment From ef1e3946854d16e52829f940fec4109f60d58e08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Sun, 12 Nov 2023 20:02:07 +0100 Subject: [PATCH 14/16] fix POST /{username}/{reponame}/{tags,release}/delete (cherry picked from commit a6d2ad6310f754952998fd73118da9f91c563145) (cherry picked from commit 921256ccb15c1cc31da25196235e94c6ab1bb9e3) --- routers/web/repo/release.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/routers/web/repo/release.go b/routers/web/repo/release.go index 91ade32cccdd2..2d927cc4fb085 100644 --- a/routers/web/repo/release.go +++ b/routers/web/repo/release.go @@ -613,7 +613,17 @@ func DeleteTag(ctx *context.Context) { } func deleteReleaseOrTag(ctx *context.Context, isDelTag bool) { - if err := releaseservice.DeleteReleaseByID(ctx, ctx.FormInt64("id"), ctx.Doer, isDelTag); err != nil { + id := ctx.FormInt64("id") + rel, err := repo_model.GetReleaseByID(ctx, id) + if err != nil { + ctx.ServerError("GetRelease", err) + return + } + if ctx.Repo.Repository.ID != rel.RepoID { + ctx.NotFound("CompareRepoID", repo_model.ErrReleaseNotExist{}) + return + } + if err := releaseservice.DeleteReleaseByID(ctx, id, ctx.Doer, isDelTag); err != nil { if models.IsErrProtectedTagName(err) { ctx.Flash.Error(ctx.Tr("repo.release.tag_name_protected")) } else { From ba4c12d5355915be32e9cf383b80eefddb1fb84b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Sun, 12 Nov 2023 22:45:59 +0100 Subject: [PATCH 15/16] fix GET /api/v1/repos/{owner}/{repo}/keys/{id} (cherry picked from commit 768238d9f9982e99ad4cbf3942d2d2db5126a150) Conflicts: routers/api/v1/repo/key.go trivial context conflict (cherry picked from commit a6627d18257fbc601e459ff4a6a6a0c1da1eabb5) --- routers/api/v1/repo/key.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/routers/api/v1/repo/key.go b/routers/api/v1/repo/key.go index 7d97f5f5e20ff..921f04b70378b 100644 --- a/routers/api/v1/repo/key.go +++ b/routers/api/v1/repo/key.go @@ -159,6 +159,11 @@ func GetDeployKey(ctx *context.APIContext) { return } + if key.RepoID != ctx.Repo.Repository.ID { + ctx.Status(http.StatusNotFound) + return + } + if err = key.GetContent(); err != nil { ctx.Error(http.StatusInternalServerError, "GetContent", err) return From e56ce32039e553da07f69221b55f1c99736e8265 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Dachary?= Date: Mon, 20 Nov 2023 16:34:19 +0100 Subject: [PATCH 16/16] fix POST /{username}/{reponame}/{type:issues|pulls}/move_pin (cherry picked from commit 7eda733ed6a22c08a85fdc90deec0c440427cef7) (cherry picked from commit 2f9ba33d6dbece0836de7ddabc335a61e52c268c) --- routers/web/repo/issue_pin.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/routers/web/repo/issue_pin.go b/routers/web/repo/issue_pin.go index f853f72335e66..11072c07a12fe 100644 --- a/routers/web/repo/issue_pin.go +++ b/routers/web/repo/issue_pin.go @@ -89,6 +89,10 @@ func IssuePinMove(ctx *context.Context) { log.Error(err.Error()) return } + if issue.RepoID != ctx.Repo.Repository.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } err = issue.MovePin(ctx, form.Position) if err != nil {