From 3b672c9791b938583b92261b244aa01f465fcba0 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Tue, 12 Dec 2023 14:20:18 +0800 Subject: [PATCH] Do some missing checks (#28423) (#28432) backport #28423 (cherry picked from commit 265f485295e1bab4d6bf4aabec6e782fd1174d2f) --- routers/api/v1/api.go | 20 +++++++++++++++++++- routers/web/web.go | 22 ++++++++++++++++++++-- tests/integration/project_test.go | 23 +++++++++++++++++++++++ 3 files changed, 62 insertions(+), 3 deletions(-) create mode 100644 tests/integration/project_test.go diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index 8da4c1a80a..6601a86dbb 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -789,6 +789,24 @@ func verifyAuthWithOptions(options *common.VerifyOptions) func(ctx *context.APIC } } +func individualPermsChecker(ctx *context.APIContext) { + // org permissions have been checked in context.OrgAssignment(), but individual permissions haven't been checked. + if ctx.ContextUser.IsIndividual() { + switch { + case ctx.ContextUser.Visibility == api.VisibleTypePrivate: + if ctx.Doer == nil || (ctx.ContextUser.ID != ctx.Doer.ID && !ctx.Doer.IsAdmin) { + ctx.NotFound("Visit Project", nil) + return + } + case ctx.ContextUser.Visibility == api.VisibleTypeLimited: + if ctx.Doer == nil { + ctx.NotFound("Visit Project", nil) + return + } + } + } +} + // check for and warn against deprecated authentication options func checkDeprecatedAuthMethods(ctx *context.APIContext) { if ctx.FormString("token") != "" || ctx.FormString("access_token") != "" { @@ -898,7 +916,7 @@ func Routes() *web.Route { }, reqSelfOrAdmin(), reqBasicOrRevProxyAuth()) m.Get("/activities/feeds", user.ListUserActivityFeeds) - }, context_service.UserAssignmentAPI()) + }, context_service.UserAssignmentAPI(), individualPermsChecker) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser)) // Users (requires user scope) diff --git a/routers/web/web.go b/routers/web/web.go index d0142aa4f5..951df38306 100644 --- a/routers/web/web.go +++ b/routers/web/web.go @@ -798,6 +798,24 @@ func registerRoutes(m *web.Route) { } } + individualPermsChecker := func(ctx *context.Context) { + // org permissions have been checked in context.OrgAssignment(), but individual permissions haven't been checked. + if ctx.ContextUser.IsIndividual() { + switch { + case ctx.ContextUser.Visibility == structs.VisibleTypePrivate: + if ctx.Doer == nil || (ctx.ContextUser.ID != ctx.Doer.ID && !ctx.Doer.IsAdmin) { + ctx.NotFound("Visit Project", nil) + return + } + case ctx.ContextUser.Visibility == structs.VisibleTypeLimited: + if ctx.Doer == nil { + ctx.NotFound("Visit Project", nil) + return + } + } + } + } + // ***** START: Organization ***** m.Group("/org", func() { m.Group("/{org}", func() { @@ -984,11 +1002,11 @@ func registerRoutes(m *web.Route) { return } }) - }) + }, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead, true), individualPermsChecker) m.Group("", func() { m.Get("/code", user.CodeSearch) - }, reqUnitAccess(unit.TypeCode, perm.AccessModeRead, false)) + }, reqUnitAccess(unit.TypeCode, perm.AccessModeRead, false), individualPermsChecker) }, ignSignIn, context_service.UserAssignmentWeb(), context.OrgAssignment()) // for "/{username}/-" (packages, projects, code) m.Group("/{username}/{reponame}", func() { diff --git a/tests/integration/project_test.go b/tests/integration/project_test.go new file mode 100644 index 0000000000..45061c5b24 --- /dev/null +++ b/tests/integration/project_test.go @@ -0,0 +1,23 @@ +// Copyright 2023 The Gitea Authors. All rights reserved. +// SPDX-License-Identifier: MIT + +package integration + +import ( + "net/http" + "testing" + + "code.gitea.io/gitea/tests" +) + +func TestPrivateRepoProject(t *testing.T) { + defer tests.PrepareTestEnv(t)() + + // not logged in user + req := NewRequest(t, "GET", "/user31/-/projects") + MakeRequest(t, req, http.StatusNotFound) + + sess := loginUser(t, "user1") + req = NewRequest(t, "GET", "/user31/-/projects") + sess.MakeRequest(t, req, http.StatusOK) +}