mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-19 16:18:11 +00:00
silverwindandwxiaoguang
5264304a34
The token a request authenticated with now lives on the doer, so permission and visibility checks apply its scope from the doer alone. Replaces https://github.com/go-gitea/gitea/pull/39167, following https://github.com/go-gitea/gitea/pull/39167#issuecomment-6063839619. 1. Public-only tokens get 404 instead of 403 for hidden users, orgs and repos, like GitHub. 2. Org ownership, site admin, repo and org creation, generation and transfer endpoints reject public-only tokens. 3. API pull request responses set `head.repo` to `null` and `head.repo_id` to `-1` when the caller cannot see the head repository. 4. Public-only tokens see org memberships like anonymous callers, so concealed members stay hidden. 5. Site admin access in activity feeds, follower lists, org members, Actions run lists and packages needs a session or an `all`-scoped token. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
35 lines
994 B
Go
35 lines
994 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package feed
|
|
|
|
import (
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/services/context"
|
|
)
|
|
|
|
// checkRepoFeedTokenScope ensures an API token has repository read scope before a
|
|
// feed serves private repository content, mirroring checkDownloadTokenScope for
|
|
// downloads. Returns false (and writes the response) when the token is denied.
|
|
func checkRepoFeedTokenScope(ctx *context.Context) bool {
|
|
context.CheckRepoScopedToken(ctx, auth_model.Read)
|
|
return !ctx.Written()
|
|
}
|
|
|
|
// RenderBranchFeed render format for branch or file
|
|
func RenderBranchFeed(ctx *context.Context, feedType string) {
|
|
if ctx.Repo.TreePath == "" {
|
|
ShowBranchFeed(ctx, ctx.Repo.Repository, feedType)
|
|
} else {
|
|
ShowFileFeed(ctx, ctx.Repo.Repository, feedType)
|
|
}
|
|
}
|
|
|
|
func RenderBranchFeedRSS(ctx *context.Context) {
|
|
RenderBranchFeed(ctx, "rss")
|
|
}
|
|
|
|
func RenderBranchFeedAtom(ctx *context.Context) {
|
|
RenderBranchFeed(ctx, "atom")
|
|
}
|