From 36292060d603452deaad03e5e686fae3f7c3f8a8 Mon Sep 17 00:00:00 2001 From: Unknown Date: Fri, 4 Jul 2014 01:25:06 -0400 Subject: [PATCH] Fix bug that collaborators are able to modify settings of repository --- cmd/web.go | 4 ++-- modules/middleware/repo.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/web.go b/cmd/web.go index 905602957..2f552d866 100644 --- a/cmd/web.go +++ b/cmd/web.go @@ -186,7 +186,7 @@ func runWeb(*cli.Context) { m.Get("/template/**", dev.TemplatePreview) } - reqOwner := middleware.RequireOwner() + reqTrueOwner := middleware.RequireTrueOwner() m.Group("/org", func(r martini.Router) { r.Get("/create", org.New) @@ -218,7 +218,7 @@ func runWeb(*cli.Context) { r.Get("/hooks/:id", repo.WebHooksEdit) r.Post("/hooks/:id", bindIgnErr(auth.NewWebhookForm{}), repo.WebHooksEditPost) }) - }, reqSignIn, middleware.RepoAssignment(true), reqOwner) + }, reqSignIn, middleware.RepoAssignment(true), reqTrueOwner) m.Group("/:username/:reponame", func(r martini.Router) { r.Get("/action/:action", repo.Action) diff --git a/modules/middleware/repo.go b/modules/middleware/repo.go index 1cfae0b77..8aa4a6a8a 100644 --- a/modules/middleware/repo.go +++ b/modules/middleware/repo.go @@ -260,7 +260,7 @@ func RepoAssignment(redirect bool, args ...bool) martini.Handler { } } -func RequireOwner() martini.Handler { +func RequireTrueOwner() martini.Handler { return func(ctx *Context) { if !ctx.Repo.IsTrueOwner { if !ctx.IsSigned {