Skip to content

Commit c9325c8

Browse files
wxiaoguangwxiaoguang
committed
fix
1 parent 98637fe commit c9325c8

File tree

9 files changed

+112
-98
lines changed

9 files changed

+112
-98
lines changed

‎models/perm/access/repo_permission.go

+34-14
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,19 @@ func (p *Permission) GetFirstUnitRepoID() int64 {
7373
}
7474

7575
// UnitAccessMode returns current user access mode to the specify unit of the repository
76-
// It also considers "everyone access mode"
7776
func (p *Permission) UnitAccessMode(unitType unit.Type) perm_model.AccessMode {
7877
// if the units map contains the access mode, use it, but admin/owner mode could override it
7978
if m, ok := p.unitsMode[unitType]; ok {
8079
return util.Iif(p.AccessMode >= perm_model.AccessModeAdmin, p.AccessMode, m)
8180
}
81+
return p.AccessMode
82+
}
83+
84+
// UnitAccessModeWithEveryone works like UnitAccessMode, it also considers "everyone access mode"
85+
func (p *Permission) UnitAccessModeWithEveryone(unitType unit.Type) perm_model.AccessMode {
86+
if m := p.UnitAccessMode(unitType); m > perm_model.AccessModeNone {
87+
return m
88+
}
8289
// if the units map does not contain the access mode, return the default access mode if the unit exists
8390
unitDefaultAccessMode := max(p.AccessMode, p.everyoneAccessMode[unitType])
8491
hasUnit := slices.ContainsFunc(p.units, func(u *repo_model.RepoUnit) bool { return u.Type == unitType })
@@ -98,6 +105,11 @@ func (p *Permission) CanAccess(mode perm_model.AccessMode, unitType unit.Type) b
98105
return p.UnitAccessMode(unitType) >= mode
99106
}
100107

108+
// CanAccessWithEveryone works like CanAccess but also considers "everyone access mode"
109+
func (p *Permission) CanAccessWithEveryone(mode perm_model.AccessMode, unitType unit.Type) bool {
110+
return p.UnitAccessModeWithEveryone(unitType) >= mode
111+
}
112+
101113
// CanAccessAny returns true if user has mode access to any of the units of the repository
102114
func (p *Permission) CanAccessAny(mode perm_model.AccessMode, unitTypes ...unit.Type) bool {
103115
for _, u := range unitTypes {
@@ -177,6 +189,7 @@ func (p *Permission) LogString() string {
177189

178190
func applyEveryoneRepoPermission(user *user_model.User, perm *Permission) {
179191
if user == nil || user.ID <= 0 {
192+
perm.units = nil
180193
return
181194
}
182195
for _, u := range perm.units {
@@ -187,6 +200,25 @@ func applyEveryoneRepoPermission(user *user_model.User, perm *Permission) {
187200
perm.everyoneAccessMode[u.Type] = u.EveryoneAccessMode
188201
}
189202
}
203+
// remove no permission units
204+
origPermUnits := perm.units
205+
perm.units = make([]*repo_model.RepoUnit, 0, len(perm.units))
206+
for _, u := range origPermUnits {
207+
shouldKeep := false
208+
for t := range perm.unitsMode {
209+
if shouldKeep = u.Type == t; shouldKeep {
210+
break
211+
}
212+
}
213+
for t := range perm.everyoneAccessMode {
214+
if shouldKeep = shouldKeep || u.Type == t; shouldKeep {
215+
break
216+
}
217+
}
218+
if shouldKeep {
219+
perm.units = append(perm.units, u)
220+
}
221+
}
190222
}
191223

192224
// GetUserRepoPermission returns the user permissions to the repository
@@ -195,9 +227,7 @@ func GetUserRepoPermission(ctx context.Context, repo *repo_model.Repository, use
195227
if err == nil {
196228
applyEveryoneRepoPermission(user, &perm)
197229
}
198-
if log.IsTrace() {
199-
log.Trace("Permission Loaded for user %-v in repo %-v, permissions: %-+v", user, repo, perm)
200-
}
230+
log.Trace("Permission Loaded for user %-v in repo %-v, permissions: %-+v", user, repo, perm)
201231
}()
202232

203233
if err = repo.LoadUnits(ctx); err != nil {
@@ -294,16 +324,6 @@ func GetUserRepoPermission(ctx context.Context, repo *repo_model.Repository, use
294324
}
295325
}
296326

297-
// remove no permission units
298-
perm.units = make([]*repo_model.RepoUnit, 0, len(repo.Units))
299-
for t := range perm.unitsMode {
300-
for _, u := range repo.Units {
301-
if u.Type == t {
302-
perm.units = append(perm.units, u)
303-
}
304-
}
305-
}
306-
307327
return perm, err
308328
}
309329

‎models/perm/access/repo_permission_test.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
5151
},
5252
}
5353
applyEveryoneRepoPermission(nil, &perm)
54+
assert.Empty(t, perm.units)
5455
assert.False(t, perm.CanRead(unit.TypeWiki))
5556

5657
perm = Permission{
@@ -60,16 +61,20 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
6061
},
6162
}
6263
applyEveryoneRepoPermission(&user_model.User{ID: 0}, &perm)
64+
assert.Empty(t, perm.units)
6365
assert.False(t, perm.CanRead(unit.TypeWiki))
6466

6567
perm = Permission{
6668
AccessMode: perm_model.AccessModeNone,
6769
units: []*repo_model.RepoUnit{
6870
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
71+
{Type: unit.TypeCode}, // will be removed
6972
},
7073
}
7174
applyEveryoneRepoPermission(&user_model.User{ID: 1}, &perm)
72-
assert.True(t, perm.CanRead(unit.TypeWiki))
75+
assert.Len(t, perm.units, 1)
76+
assert.False(t, perm.CanAccess(perm_model.AccessModeRead, unit.TypeWiki))
77+
assert.True(t, perm.CanAccessWithEveryone(perm_model.AccessModeRead, unit.TypeWiki))
7378

7479
perm = Permission{
7580
AccessMode: perm_model.AccessModeWrite,
@@ -79,7 +84,7 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
7984
}
8085
applyEveryoneRepoPermission(&user_model.User{ID: 1}, &perm)
8186
// it should work the same as "EveryoneAccessMode: none" because the default AccessMode should be applied to units
82-
assert.True(t, perm.CanWrite(unit.TypeWiki))
87+
assert.True(t, perm.CanWrite(unit.TypeWiki)) // no unitsMode, so it uses AccessMode
8388

8489
perm = Permission{
8590
units: []*repo_model.RepoUnit{

‎options/locale/locale_en-US.ini

+1-1
Original file line numberDiff line numberDiff line change
@@ -2160,7 +2160,7 @@ settings.advanced_settings = Advanced Settings
21602160
settings.wiki_desc = Enable Repository Wiki
21612161
settings.use_internal_wiki = Use Built-In Wiki
21622162
settings.default_wiki_branch_name = Default Wiki Branch Name
2163-
settings.default_wiki_everyone_access = Default Access Permission for signed-in users:
2163+
settings.default_permission_everyone_access = Default access permission for all signed-in users:
21642164
settings.failed_to_change_default_wiki_branch = Failed to change the default wiki branch.
21652165
settings.use_external_wiki = Use External Wiki
21662166
settings.external_wiki_url = External Wiki URL

‎routers/web/repo/issue_poster.go

+3-7
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,9 @@ type userSearchResponse struct {
2626
Results []*userSearchInfo `json:"results"`
2727
}
2828

29-
// IssuePosters get posters for current repo's issues/pull requests
30-
func IssuePosters(ctx *context.Context) {
31-
issuePosters(ctx, false)
32-
}
33-
34-
func PullPosters(ctx *context.Context) {
35-
issuePosters(ctx, true)
29+
func IssuePullPosters(ctx *context.Context) {
30+
isPullList := ctx.PathParam("type") == "pulls"
31+
issuePosters(ctx, isPullList)
3632
}
3733

3834
func issuePosters(ctx *context.Context, isPullList bool) {

‎routers/web/repo/setting/setting.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -447,8 +447,9 @@ func SettingsPost(ctx *context.Context) {
447447

448448
if form.EnableCode && !unit_model.TypeCode.UnitGlobalDisabled() {
449449
units = append(units, repo_model.RepoUnit{
450-
RepoID: repo.ID,
451-
Type: unit_model.TypeCode,
450+
RepoID: repo.ID,
451+
Type: unit_model.TypeCode,
452+
EveryoneAccessMode: perm.ParseAccessMode(form.DefaultCodeEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead),
452453
})
453454
} else if !unit_model.TypeCode.UnitGlobalDisabled() {
454455
deleteUnitTypes = append(deleteUnitTypes, unit_model.TypeCode)
@@ -524,6 +525,7 @@ func SettingsPost(ctx *context.Context) {
524525
AllowOnlyContributorsToTrackTime: form.AllowOnlyContributorsToTrackTime,
525526
EnableDependencies: form.EnableIssueDependencies,
526527
},
528+
EveryoneAccessMode: perm.ParseAccessMode(form.DefaultIssuesEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead),
527529
})
528530
deleteUnitTypes = append(deleteUnitTypes, unit_model.TypeExternalTracker)
529531
} else {

‎routers/web/web.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -1169,13 +1169,12 @@ func registerRoutes(m *web.Router) {
11691169
// end "/{username}/{reponame}": repo code: find, compare, list
11701170

11711171
m.Group("/{username}/{reponame}", func() {
1172-
m.Get("/issues/posters", repo.IssuePosters) // it can't use {type:issues|pulls} because it would conflict with other routes like "/pulls/{index}"
1173-
m.Get("/pulls/posters", repo.PullPosters)
11741172
m.Get("/comments/{id}/attachments", repo.GetCommentAttachments)
11751173
m.Get("/labels", repo.RetrieveLabelsForList, repo.Labels)
11761174
m.Get("/milestones", repo.Milestones)
11771175
m.Get("/milestone/{id}", context.RepoRef(), repo.MilestoneIssuesAndPulls)
11781176
m.Group("/{type:issues|pulls}", func() {
1177+
m.Get("/posters", repo.IssuePullPosters)
11791178
m.Group("/{index}", func() {
11801179
m.Get("/info", repo.GetIssueInfo)
11811180
m.Get("/attachments", repo.GetIssueAttachments)

‎services/context/permission.go

+5-41
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,13 @@ import (
99
auth_model "code.gitea.io/gitea/models/auth"
1010
repo_model "code.gitea.io/gitea/models/repo"
1111
"code.gitea.io/gitea/models/unit"
12-
"code.gitea.io/gitea/modules/log"
1312
)
1413

1514
// RequireRepoAdmin returns a middleware for requiring repository admin permission
1615
func RequireRepoAdmin() func(ctx *Context) {
1716
return func(ctx *Context) {
1817
if !ctx.IsSigned || !ctx.Repo.IsAdmin() {
19-
ctx.NotFound(ctx.Req.URL.RequestURI(), nil)
18+
ctx.NotFound("RequireRepoAdmin denies the request", nil)
2019
return
2120
}
2221
}
@@ -26,7 +25,7 @@ func RequireRepoAdmin() func(ctx *Context) {
2625
func RequireRepoWriter(unitType unit.Type) func(ctx *Context) {
2726
return func(ctx *Context) {
2827
if !ctx.Repo.CanWrite(unitType) {
29-
ctx.NotFound(ctx.Req.URL.RequestURI(), nil)
28+
ctx.NotFound("RequireRepoWriter denies the request", nil)
3029
return
3130
}
3231
}
@@ -50,7 +49,7 @@ func RequireRepoWriterOr(unitTypes ...unit.Type) func(ctx *Context) {
5049
return
5150
}
5251
}
53-
ctx.NotFound(ctx.Req.URL.RequestURI(), nil)
52+
ctx.NotFound("RequireRepoWriterOr denies the request", nil)
5453
}
5554
}
5655

@@ -61,23 +60,7 @@ func RequireRepoReader(unitType unit.Type) func(ctx *Context) {
6160
if unitType == unit.TypeCode && canWriteAsMaintainer(ctx) {
6261
return
6362
}
64-
if log.IsTrace() {
65-
if ctx.IsSigned {
66-
log.Trace("Permission Denied: User %-v cannot read %-v in Repo %-v\n"+
67-
"User in Repo has Permissions: %-+v",
68-
ctx.Doer,
69-
unitType,
70-
ctx.Repo.Repository,
71-
ctx.Repo.Permission)
72-
} else {
73-
log.Trace("Permission Denied: Anonymous user cannot read %-v in Repo %-v\n"+
74-
"Anonymous user in Repo has Permissions: %-+v",
75-
unitType,
76-
ctx.Repo.Repository,
77-
ctx.Repo.Permission)
78-
}
79-
}
80-
ctx.NotFound(ctx.Req.URL.RequestURI(), nil)
63+
ctx.NotFound("RequireRepoReader denies the request", nil)
8164
return
8265
}
8366
}
@@ -91,26 +74,7 @@ func RequireRepoReaderOr(unitTypes ...unit.Type) func(ctx *Context) {
9174
return
9275
}
9376
}
94-
if log.IsTrace() {
95-
var format string
96-
var args []any
97-
if ctx.IsSigned {
98-
format = "Permission Denied: User %-v cannot read ["
99-
args = append(args, ctx.Doer)
100-
} else {
101-
format = "Permission Denied: Anonymous user cannot read ["
102-
}
103-
for _, unit := range unitTypes {
104-
format += "%-v, "
105-
args = append(args, unit)
106-
}
107-
108-
format = format[:len(format)-2] + "] in Repo %-v\n" +
109-
"User in Repo has Permissions: %-+v"
110-
args = append(args, ctx.Repo.Repository, ctx.Repo.Permission)
111-
log.Trace(format, args...)
112-
}
113-
ctx.NotFound(ctx.Req.URL.RequestURI(), nil)
77+
ctx.NotFound("RequireRepoReaderOr denies the request", nil)
11478
}
11579
}
11680

‎services/forms/repo_form.go

+38-28
Original file line numberDiff line numberDiff line change
@@ -110,41 +110,51 @@ type RepoSettingForm struct {
110110
EnablePrune bool
111111

112112
// Advanced settings
113-
EnableCode bool
114-
EnableWiki bool
115-
EnableExternalWiki bool
116-
DefaultWikiBranch string
117-
DefaultWikiEveryoneAccess string
118-
ExternalWikiURL string
113+
EnableCode bool
114+
DefaultCodeEveryoneAccess string
115+
116+
EnableWiki bool
117+
EnableExternalWiki bool
118+
DefaultWikiBranch string
119+
DefaultWikiEveryoneAccess string
120+
ExternalWikiURL string
121+
119122
EnableIssues bool
123+
DefaultIssuesEveryoneAccess string
120124
EnableExternalTracker bool
121125
ExternalTrackerURL string
122126
TrackerURLFormat string
123127
TrackerIssueStyle string
124128
ExternalTrackerRegexpPattern string
125129
EnableCloseIssuesViaCommitInAnyBranch bool
126-
EnableProjects bool
127-
ProjectsMode string
128-
EnableReleases bool
129-
EnablePackages bool
130-
EnablePulls bool
131-
EnableActions bool
132-
PullsIgnoreWhitespace bool
133-
PullsAllowMerge bool
134-
PullsAllowRebase bool
135-
PullsAllowRebaseMerge bool
136-
PullsAllowSquash bool
137-
PullsAllowFastForwardOnly bool
138-
PullsAllowManualMerge bool
139-
PullsDefaultMergeStyle string
140-
EnableAutodetectManualMerge bool
141-
PullsAllowRebaseUpdate bool
142-
DefaultDeleteBranchAfterMerge bool
143-
DefaultAllowMaintainerEdit bool
144-
EnableTimetracker bool
145-
AllowOnlyContributorsToTrackTime bool
146-
EnableIssueDependencies bool
147-
IsArchived bool
130+
131+
EnableProjects bool
132+
ProjectsMode string
133+
134+
EnableReleases bool
135+
136+
EnablePackages bool
137+
138+
EnablePulls bool
139+
PullsIgnoreWhitespace bool
140+
PullsAllowMerge bool
141+
PullsAllowRebase bool
142+
PullsAllowRebaseMerge bool
143+
PullsAllowSquash bool
144+
PullsAllowFastForwardOnly bool
145+
PullsAllowManualMerge bool
146+
PullsDefaultMergeStyle string
147+
EnableAutodetectManualMerge bool
148+
PullsAllowRebaseUpdate bool
149+
DefaultDeleteBranchAfterMerge bool
150+
DefaultAllowMaintainerEdit bool
151+
EnableTimetracker bool
152+
AllowOnlyContributorsToTrackTime bool
153+
EnableIssueDependencies bool
154+
155+
EnableActions bool
156+
157+
IsArchived bool
148158

149159
// Signing Settings
150160
TrustModel string

0 commit comments

Comments
 (0)