realaravinth/forgejo-federation
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity

Ensure that feeds are appropriately restricted (#10018)

Browse source 
* Always limit results by what is accessible to the user

* Change signature of AccessibleRepoIDsQuery

* Ensure that user with ID <= 0 is handled

* Update models/repo_list.go
This commit is contained in:
zeripath 2020-01-28 11:39:37 +00:00 committed by GitHub
parent 797e6f8f4c
commit 206a031b38
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
models/action.go
View file

@ -312,8 +312,8 @@ func GetFeeds(opts GetFeedsOptions) ([]*Action, error) {
} }
cond = cond.And(builder.In("repo_id", repoIDs)) cond = cond.And(builder.In("repo_id", repoIDs))
} else if opts.Actor != nil { } else {
cond = cond.And(builder.In("repo_id", opts.Actor.AccessibleRepoIDsQuery())) cond = cond.And(builder.In("repo_id", AccessibleRepoIDsQuery(opts.Actor)))
} }
cond = cond.And(builder.Eq{"user_id": opts.RequestedUser.ID}) cond = cond.And(builder.Eq{"user_id": opts.RequestedUser.ID})

7
models/repo_list.go
View file

@ -319,9 +319,9 @@ func SearchRepository(opts *SearchRepoOptions) (RepositoryList, int64, error) {
func accessibleRepositoryCondition(user *User) builder.Cond { func accessibleRepositoryCondition(user *User) builder.Cond {
var cond = builder.NewCond() var cond = builder.NewCond()
if user == nil || !user.IsRestricted { if user == nil || !user.IsRestricted || user.ID <= 0 {
orgVisibilityLimit := []structs.VisibleType{structs.VisibleTypePrivate} orgVisibilityLimit := []structs.VisibleType{structs.VisibleTypePrivate}
if user == nil { if user == nil || user.ID <= 0 {
orgVisibilityLimit = append(orgVisibilityLimit, structs.VisibleTypeLimited) orgVisibilityLimit = append(orgVisibilityLimit, structs.VisibleTypeLimited)
} }
// 1. Be able to see all non-private repositories that either: // 1. Be able to see all non-private repositories that either:
@ -363,7 +363,8 @@ func SearchRepositoryByName(opts *SearchRepoOptions) (RepositoryList, int64, err
} }
// AccessibleRepoIDsQuery queries accessible repository ids. Usable as a subquery wherever repo ids need to be filtered. // AccessibleRepoIDsQuery queries accessible repository ids. Usable as a subquery wherever repo ids need to be filtered.
func (user *User) AccessibleRepoIDsQuery() *builder.Builder { func AccessibleRepoIDsQuery(user *User) *builder.Builder {
// NB: Please note this code needs to still work if user is nil
return builder.Select("id").From("repository").Where(accessibleRepositoryCondition(user)) return builder.Select("id").From("repository").Where(accessibleRepositoryCondition(user))
} }