mirrors/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-10-31 22:38:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix auth check bug (#24382) (#24387)

Browse source 
Backport #24382 by @lunny

Fix https://github.com/go-gitea/gitea/pull/24362/files#r1179095324

`getAuthenticatedMeta` has checked them, these code are duplicated one.
And the first invokation has a wrong permission check. `DownloadHandle`
should require read permission but not write.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
(cherry picked from commit 5999349ce7)
This commit is contained in:
Giteabot 2023-04-27 18:49:50 -04:00 committed by Earl Warren
parent eeee32cdc3
commit 10d3ed53f1
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
2 changed files with 41 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
services/lfs/server.go
View file

@ -86,11 +86,6 @@ func DownloadHandler(ctx *context.Context) {
return return
} }
repository := getAuthenticatedRepository(ctx, rc, true)
if repository == nil {
return
}
// Support resume download using Range header // Support resume download using Range header
var fromByte, toByte int64 var fromByte, toByte int64
toByte = meta.Size - 1 toByte = meta.Size - 1
@ -365,11 +360,6 @@ func VerifyHandler(ctx *context.Context) {
return return
} }
repository := getAuthenticatedRepository(ctx, rc, true)
if repository == nil {
return
}
contentStore := lfs_module.NewContentStore() contentStore := lfs_module.NewContentStore()
ok, err := contentStore.Verify(meta.Pointer) ok, err := contentStore.Verify(meta.Pointer)

41
tests/integration/lfs_getobject_test.go
View file

@ -11,6 +11,7 @@ import (
"net/http/httptest" "net/http/httptest"
"testing" "testing"
"code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/models/db" "code.gitea.io/gitea/models/db"
git_model "code.gitea.io/gitea/models/git" git_model "code.gitea.io/gitea/models/git"
repo_model "code.gitea.io/gitea/models/repo" repo_model "code.gitea.io/gitea/models/repo"
@ -40,6 +41,31 @@ func storeObjectInRepo(t *testing.T, repositoryID int64, content *[]byte) string
return pointer.Oid return pointer.Oid
} }
func storeAndGetLfsToken(t *testing.T, ts auth.AccessTokenScope, content *[]byte, extraHeader *http.Header, expectedStatus int) *httptest.ResponseRecorder {
repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, "user2", "repo1")
assert.NoError(t, err)
oid := storeObjectInRepo(t, repo.ID, content)
defer git_model.RemoveLFSMetaObjectByOid(db.DefaultContext, repo.ID, oid)
token := getUserToken(t, "user2", ts)
// Request OID
req := NewRequest(t, "GET", "/user2/repo1.git/info/lfs/objects/"+oid+"/test")
req.Header.Set("Accept-Encoding", "gzip")
req.SetBasicAuth("user2", token)
if extraHeader != nil {
for key, values := range *extraHeader {
for _, value := range values {
req.Header.Add(key, value)
}
}
}
resp := MakeRequest(t, req, expectedStatus)
return resp
}
func storeAndGetLfs(t *testing.T, content *[]byte, extraHeader *http.Header, expectedStatus int) *httptest.ResponseRecorder { func storeAndGetLfs(t *testing.T, content *[]byte, extraHeader *http.Header, expectedStatus int) *httptest.ResponseRecorder {
repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, "user2", "repo1") repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, "user2", "repo1")
assert.NoError(t, err) assert.NoError(t, err)
@ -89,6 +115,21 @@ func TestGetLFSSmall(t *testing.T) {
checkResponseTestContentEncoding(t, &content, resp, false) checkResponseTestContentEncoding(t, &content, resp, false)
} }
func TestGetLFSSmallToken(t *testing.T) {
defer tests.PrepareTestEnv(t)()
content := []byte("A very small file\n")
resp := storeAndGetLfsToken(t, auth.AccessTokenScopePublicRepo, &content, nil, http.StatusOK)
checkResponseTestContentEncoding(t, &content, resp, false)
}
func TestGetLFSSmallTokenFail(t *testing.T) {
defer tests.PrepareTestEnv(t)()
content := []byte("A very small file\n")
storeAndGetLfsToken(t, auth.AccessTokenScopeNotification, &content, nil, http.StatusForbidden)
}
func TestGetLFSLarge(t *testing.T) { func TestGetLFSLarge(t *testing.T) {
defer tests.PrepareTestEnv(t)() defer tests.PrepareTestEnv(t)()
content := make([]byte, web.GzipMinSize*10) content := make([]byte, web.GzipMinSize*10)