88a03a6133
We need to make sure a user can't confirm the existence of a user with private visibility * Follow up on #21533 ### Before #### User  #### Admin  ### After #### User  #### Admin  Signed-off-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
33 lines
952 B
Go
33 lines
952 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// Use of this source code is governed by a MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package markup
|
|
|
|
import (
|
|
"context"
|
|
|
|
"code.gitea.io/gitea/models/user"
|
|
gitea_context "code.gitea.io/gitea/modules/context"
|
|
"code.gitea.io/gitea/modules/markup"
|
|
)
|
|
|
|
func ProcessorHelper() *markup.ProcessorHelper {
|
|
return &markup.ProcessorHelper{
|
|
IsUsernameMentionable: func(ctx context.Context, username string) bool {
|
|
mentionedUser, err := user.GetUserByName(ctx, username)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
giteaCtx, ok := ctx.(*gitea_context.Context)
|
|
if !ok {
|
|
// when using general context, use user's visibility to check
|
|
return mentionedUser.Visibility.IsPublic()
|
|
}
|
|
|
|
// when using gitea context (web context), use user's visibility and user's permission to check
|
|
return user.IsUserVisibleToViewer(giteaCtx, mentionedUser, giteaCtx.Doer)
|
|
},
|
|
}
|
|
}
|