mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-03-27 14:02:45 +00:00
The web route to update and delete variables of runners did not check if the ID that was given belonged to the context it was requested in, this made it possible to update and delete every existing runner variable of a instance for any authenticated user. The code has been reworked to always take into account the context of the request (owner and repository ID).
140 lines
3.5 KiB
Go
140 lines
3.5 KiB
Go
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package setting
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"code.gitea.io/gitea/modules/base"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
shared "code.gitea.io/gitea/routers/web/shared/actions"
|
|
shared_user "code.gitea.io/gitea/routers/web/shared/user"
|
|
"code.gitea.io/gitea/services/context"
|
|
)
|
|
|
|
const (
|
|
tplRepoVariables base.TplName = "repo/settings/actions"
|
|
tplOrgVariables base.TplName = "org/settings/actions"
|
|
tplUserVariables base.TplName = "user/settings/actions"
|
|
tplAdminVariables base.TplName = "admin/actions"
|
|
)
|
|
|
|
type variablesCtx struct {
|
|
OwnerID int64
|
|
RepoID int64
|
|
IsRepo bool
|
|
IsOrg bool
|
|
IsUser bool
|
|
IsGlobal bool
|
|
VariablesTemplate base.TplName
|
|
RedirectLink string
|
|
}
|
|
|
|
func getVariablesCtx(ctx *context.Context) (*variablesCtx, error) {
|
|
if ctx.Data["PageIsRepoSettings"] == true {
|
|
return &variablesCtx{
|
|
OwnerID: 0,
|
|
RepoID: ctx.Repo.Repository.ID,
|
|
IsRepo: true,
|
|
VariablesTemplate: tplRepoVariables,
|
|
RedirectLink: ctx.Repo.RepoLink + "/settings/actions/variables",
|
|
}, nil
|
|
}
|
|
|
|
if ctx.Data["PageIsOrgSettings"] == true {
|
|
err := shared_user.LoadHeaderCount(ctx)
|
|
if err != nil {
|
|
ctx.ServerError("LoadHeaderCount", err)
|
|
return nil, nil
|
|
}
|
|
return &variablesCtx{
|
|
OwnerID: ctx.ContextUser.ID,
|
|
RepoID: 0,
|
|
IsOrg: true,
|
|
VariablesTemplate: tplOrgVariables,
|
|
RedirectLink: ctx.Org.OrgLink + "/settings/actions/variables",
|
|
}, nil
|
|
}
|
|
|
|
if ctx.Data["PageIsUserSettings"] == true {
|
|
return &variablesCtx{
|
|
OwnerID: ctx.Doer.ID,
|
|
RepoID: 0,
|
|
IsUser: true,
|
|
VariablesTemplate: tplUserVariables,
|
|
RedirectLink: setting.AppSubURL + "/user/settings/actions/variables",
|
|
}, nil
|
|
}
|
|
|
|
if ctx.Data["PageIsAdmin"] == true {
|
|
return &variablesCtx{
|
|
OwnerID: 0,
|
|
RepoID: 0,
|
|
IsGlobal: true,
|
|
VariablesTemplate: tplAdminVariables,
|
|
RedirectLink: setting.AppSubURL + "/admin/actions/variables",
|
|
}, nil
|
|
}
|
|
|
|
return nil, errors.New("unable to set Variables context")
|
|
}
|
|
|
|
func Variables(ctx *context.Context) {
|
|
ctx.Data["Title"] = ctx.Tr("actions.variables")
|
|
ctx.Data["PageType"] = "variables"
|
|
ctx.Data["PageIsSharedSettingsVariables"] = true
|
|
|
|
vCtx, err := getVariablesCtx(ctx)
|
|
if err != nil {
|
|
ctx.ServerError("getVariablesCtx", err)
|
|
return
|
|
}
|
|
|
|
shared.SetVariablesContext(ctx, vCtx.OwnerID, vCtx.RepoID)
|
|
if ctx.Written() {
|
|
return
|
|
}
|
|
|
|
ctx.HTML(http.StatusOK, vCtx.VariablesTemplate)
|
|
}
|
|
|
|
func VariableCreate(ctx *context.Context) {
|
|
vCtx, err := getVariablesCtx(ctx)
|
|
if err != nil {
|
|
ctx.ServerError("getVariablesCtx", err)
|
|
return
|
|
}
|
|
|
|
if ctx.HasError() { // form binding validation error
|
|
ctx.JSONError(ctx.GetErrMsg())
|
|
return
|
|
}
|
|
|
|
shared.CreateVariable(ctx, vCtx.OwnerID, vCtx.RepoID, vCtx.RedirectLink)
|
|
}
|
|
|
|
func VariableUpdate(ctx *context.Context) {
|
|
vCtx, err := getVariablesCtx(ctx)
|
|
if err != nil {
|
|
ctx.ServerError("getVariablesCtx", err)
|
|
return
|
|
}
|
|
|
|
if ctx.HasError() { // form binding validation error
|
|
ctx.JSONError(ctx.GetErrMsg())
|
|
return
|
|
}
|
|
|
|
shared.UpdateVariable(ctx, vCtx.OwnerID, vCtx.RepoID, vCtx.RedirectLink)
|
|
}
|
|
|
|
func VariableDelete(ctx *context.Context) {
|
|
vCtx, err := getVariablesCtx(ctx)
|
|
if err != nil {
|
|
ctx.ServerError("getVariablesCtx", err)
|
|
return
|
|
}
|
|
shared.DeleteVariable(ctx, vCtx.OwnerID, vCtx.RepoID, vCtx.RedirectLink)
|
|
}
|