mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 00:19:00 +00:00
ae17c14cff
Several handlers and model helpers skipped checks that their siblings already perform. - Only match principal keys when looking up SSH certificate principals - Return no attachments for an unsaved issue instead of every issue-less one - Reject issue and comment attachments when adding release attachments - Share one permission check for editing, deleting and reacting to issue content and for comment attachments between the web UI and the API, refusing them on locked issues for users who can't write - Reject issue edits, deletion and label changes in archived repositories via the API - Apply cross-origin protection to the repository topics endpoint - Return 404 for the repositories tab of individual users and respect profile visibility for the heatmap Fixes: https://github.com/go-gitea/gitea/issues/39226 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com>
74 lines
2.1 KiB
Go
74 lines
2.1 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
|
|
activities_model "gitea.dev/models/activities"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/services/context"
|
|
)
|
|
|
|
func prepareHeatmapURL(ctx *context.Context) {
|
|
ctx.Data["EnableHeatmap"] = setting.Service.EnableUserHeatmap
|
|
if !setting.Service.EnableUserHeatmap {
|
|
return
|
|
}
|
|
|
|
if ctx.Org.Organization == nil {
|
|
// for individual user
|
|
ctx.Data["HeatmapURL"] = ctx.Doer.HomeLink() + "/-/heatmap"
|
|
return
|
|
}
|
|
|
|
// for org or team
|
|
heatmapURL := ctx.Org.Organization.OrganisationLink() + "/dashboard/-/heatmap"
|
|
if ctx.Org.Team != nil {
|
|
heatmapURL += "/" + url.PathEscape(ctx.Org.Team.LowerName)
|
|
}
|
|
ctx.Data["HeatmapURL"] = heatmapURL
|
|
}
|
|
|
|
func writeHeatmapJSON(ctx *context.Context, hdata []*activities_model.UserHeatmapData) {
|
|
data := make([][2]int64, len(hdata))
|
|
var total int64
|
|
for i, v := range hdata {
|
|
data[i] = [2]int64{int64(v.Timestamp), v.Contributions}
|
|
total += v.Contributions
|
|
}
|
|
ctx.JSON(http.StatusOK, map[string]any{
|
|
"heatmapData": data,
|
|
"totalContributions": total,
|
|
})
|
|
}
|
|
|
|
// DashboardHeatmap returns heatmap data as JSON, for the individual user, organization or team dashboard.
|
|
func DashboardHeatmap(ctx *context.Context) {
|
|
if !setting.Service.EnableUserHeatmap {
|
|
ctx.NotFound(nil)
|
|
return
|
|
}
|
|
if ctx.Org.Organization == nil && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
|
|
// this end point is mounted on different routes, so we need to
|
|
// check if the user is visible to the viewer when there is no organization context (no visibility check)
|
|
ctx.NotFound(nil)
|
|
return
|
|
}
|
|
var data []*activities_model.UserHeatmapData
|
|
var err error
|
|
if ctx.Org.Organization == nil {
|
|
data, err = activities_model.GetUserHeatmapDataByUser(ctx, ctx.ContextUser, ctx.Doer)
|
|
} else {
|
|
data, err = activities_model.GetUserHeatmapDataByOrgTeam(ctx, ctx.Org.Organization, ctx.Org.Team, ctx.Doer)
|
|
}
|
|
if err != nil {
|
|
ctx.ServerError("GetUserHeatmapData", err)
|
|
return
|
|
}
|
|
writeHeatmapJSON(ctx, data)
|
|
}
|