mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-20 08:20:04 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
71 lines
2.1 KiB
Go
71 lines
2.1 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package context
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/session"
|
|
)
|
|
|
|
// UserAssignmentWeb returns a middleware to handle context-user assignment for web routes
|
|
func UserAssignmentWeb() func(ctx *Context) {
|
|
return func(ctx *Context) {
|
|
errorFn := func(status int, msg string) {
|
|
err := fmt.Errorf("%s", msg)
|
|
if status == http.StatusNotFound {
|
|
ctx.NotFound(err)
|
|
} else {
|
|
ctx.ServerError("UserAssignmentWeb", err)
|
|
}
|
|
}
|
|
ctx.ContextUser = userAssignment(ctx.Base, ctx.Doer, errorFn)
|
|
ctx.Data["ContextUser"] = ctx.ContextUser
|
|
}
|
|
}
|
|
|
|
// UserAssignmentAPI returns a middleware to handle context-user assignment for api routes
|
|
func UserAssignmentAPI() func(ctx *APIContext) {
|
|
return func(ctx *APIContext) {
|
|
ctx.ContextUser = userAssignment(ctx.Base, ctx.Doer, ctx.APIError)
|
|
}
|
|
}
|
|
|
|
func userAssignment(ctx *Base, doer *user_model.User, errCb func(int, string)) (contextUser *user_model.User) {
|
|
username := ctx.PathParam("username")
|
|
|
|
if doer != nil && strings.EqualFold(doer.LowerName, username) {
|
|
contextUser = doer
|
|
} else {
|
|
var err error
|
|
contextUser, err = user_model.GetUserByName(ctx, username)
|
|
if err != nil {
|
|
if user_model.IsErrUserNotExist(err) {
|
|
if redirectUserID, err := user_model.LookupUserRedirect(ctx, username); err == nil {
|
|
RedirectToUser(ctx, doer, username, redirectUserID)
|
|
} else if user_model.IsErrUserRedirectNotExist(err) {
|
|
errCb(http.StatusNotFound, err.Error())
|
|
} else {
|
|
errCb(http.StatusInternalServerError, fmt.Sprintf("LookupUserRedirect: %v", err))
|
|
}
|
|
} else {
|
|
errCb(http.StatusInternalServerError, fmt.Sprintf("GetUserByName: %v", err))
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
if !user_model.DoerTokenAllowsOwner(doer, contextUser) {
|
|
errCb(http.StatusNotFound, user_model.ErrUserRedirectNotExist{Name: username}.Error())
|
|
return nil
|
|
}
|
|
return contextUser
|
|
}
|
|
|
|
func IsDoerSessionImpersonated(sess session.Store) bool {
|
|
return sess.Get(session.KeyImpersonatorData) != nil
|
|
}
|