Skip to content

Commit 5558a74

Browse files
author
Gusted
committed
Add more permission checking
1 parent aeba85e commit 5558a74

File tree

10 files changed

+53
-20
lines changed

10 files changed

+53
-20
lines changed

‎models/issues/issue.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -743,7 +743,10 @@ func doChangeIssueStatus(ctx context.Context, issue *Issue, doer *user_model.Use
743743
}
744744

745745
// ChangeIssueStatus changes issue status to open or closed.
746-
func ChangeIssueStatus(ctx context.Context, issue *Issue, doer *user_model.User, isClosed bool) (*Comment, error) {
746+
func ChangeIssueStatus(ctx context.Context, issue *Issue, repoID int64, doer *user_model.User, isClosed bool) (*Comment, error) {
747+
if issue.RepoID != repoID {
748+
return nil, fmt.Errorf("issue's repository is not correct")
749+
}
747750
if err := issue.LoadRepo(ctx); err != nil {
748751
return nil, err
749752
}

‎models/issues/issue_project.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -124,21 +124,21 @@ func ChangeProjectAssign(issue *Issue, doer *user_model.User, newProjectID int64
124124
func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.User, newProjectID int64) error {
125125
oldProjectID := issue.projectID(ctx)
126126

127-
if _, err := db.GetEngine(ctx).Where("project_issue.issue_id=?", issue.ID).Delete(&project_model.ProjectIssue{}); err != nil {
127+
newProject, err := project_model.GetProjectByID(ctx, newProjectID)
128+
if err != nil {
128129
return err
129130
}
131+
if newProject.RepoID != issue.RepoID {
132+
return fmt.Errorf("issue's repository is not the same as project's repository")
133+
}
130134

131-
if err := issue.LoadRepo(ctx); err != nil {
135+
if _, err := db.GetEngine(ctx).Where("project_issue.issue_id=?", issue.ID).Delete(&project_model.ProjectIssue{}); err != nil {
132136
return err
133137
}
134138

135-
newProject, err := project_model.GetProjectByID(ctx, newProjectID)
136-
if err != nil {
139+
if err := issue.LoadRepo(ctx); err != nil {
137140
return err
138141
}
139-
if newProject.RepoID != issue.RepoID {
140-
return fmt.Errorf("Issue's repository is not the same as project's repository")
141-
}
142142

143143
if oldProjectID > 0 || newProjectID > 0 {
144144
if _, err := CreateCommentCtx(ctx, &CreateCommentOptions{

‎models/issues/milestone.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,11 @@ func NewMilestone(m *Milestone) (err error) {
124124
return committer.Commit()
125125
}
126126

127+
// HasMilestoneByRepoID returns if the milestone exists in the repository.
128+
func HasMilestoneByRepoID(ctx context.Context, repoID, id int64) (bool, error) {
129+
return db.GetEngine(ctx).ID(id).Where("repo_id=?", repoID).Exist(new(Milestone))
130+
}
131+
127132
// GetMilestoneByRepoID returns the milestone in a repository.
128133
func GetMilestoneByRepoID(ctx context.Context, repoID, id int64) (*Milestone, error) {
129134
m := new(Milestone)

‎routers/api/v1/repo/pull_review.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -886,7 +886,7 @@ func dismissReview(ctx *context.APIContext, msg string, isDismiss bool) {
886886
return
887887
}
888888

889-
_, err := pull_service.DismissReview(ctx, review.ID, msg, ctx.Doer, isDismiss)
889+
_, err := pull_service.DismissReview(ctx, review.ID, ctx.Repo.Repository.ID, msg, ctx.Doer, isDismiss)
890890
if err != nil {
891891
ctx.Error(http.StatusInternalServerError, "pull_service.DismissReview", err)
892892
return

‎routers/web/repo/issue.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1042,7 +1042,8 @@ func NewIssuePost(ctx *context.Context) {
10421042
return
10431043
}
10441044

1045-
if projectID > 0 {
1045+
// User must also be able to see the project.
1046+
if projectID > 0 && ctx.Repo.CanRead(unit.TypeProjects) {
10461047
if err := issues_model.ChangeProjectAssign(issue, ctx.Doer, projectID); err != nil {
10471048
ctx.ServerError("ChangeProjectAssign", err)
10481049
return
@@ -2503,6 +2504,10 @@ func UpdateIssueStatus(ctx *context.Context) {
25032504
return
25042505
}
25052506
for _, issue := range issues {
2507+
if issue.RepoID != ctx.Repo.Repository.ID {
2508+
ctx.NotFound("some issue's repoID is incorrect", errors.New("some issue's repoID is incorrect"))
2509+
return
2510+
}
25062511
if issue.IsClosed != isClosed {
25072512
if err := issue_service.ChangeStatus(issue, ctx.Doer, isClosed); err != nil {
25082513
if issues_model.IsErrDependenciesLeft(err) {

‎routers/web/repo/pull_review.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
package repo
66

77
import (
8+
"errors"
89
"fmt"
910
"net/http"
1011

@@ -118,6 +119,11 @@ func UpdateResolveConversation(ctx *context.Context) {
118119
return
119120
}
120121

122+
if comment.Issue.RepoID != ctx.Repo.Repository.ID {
123+
ctx.NotFound("comment's repoID is incorrect", errors.New("comment's repoID is incorrect"))
124+
return
125+
}
126+
121127
var permResult bool
122128
if permResult, err = issues_model.CanMarkConversation(comment.Issue, ctx.Doer); err != nil {
123129
ctx.ServerError("CanMarkConversation", err)
@@ -236,7 +242,7 @@ func SubmitReview(ctx *context.Context) {
236242
// DismissReview dismissing stale review by repo admin
237243
func DismissReview(ctx *context.Context) {
238244
form := web.GetForm(ctx).(*forms.DismissReviewForm)
239-
comm, err := pull_service.DismissReview(ctx, form.ReviewID, form.Message, ctx.Doer, true)
245+
comm, err := pull_service.DismissReview(ctx, form.ReviewID, ctx.Repo.Repository.ID, form.Message, ctx.Doer, true)
240246
if err != nil {
241247
ctx.ServerError("pull_service.DismissReview", err)
242248
return

‎routers/web/web.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -898,7 +898,7 @@ func RegisterRoutes(m *web.Route) {
898898

899899
m.Post("/labels", reqRepoIssuesOrPullsWriter, repo.UpdateIssueLabel)
900900
m.Post("/milestone", reqRepoIssuesOrPullsWriter, repo.UpdateIssueMilestone)
901-
m.Post("/projects", reqRepoIssuesOrPullsWriter, repo.UpdateIssueProject)
901+
m.Post("/projects", reqRepoIssuesOrPullsWriter, reqRepoProjectsReader, repo.UpdateIssueProject)
902902
m.Post("/assignee", reqRepoIssuesOrPullsWriter, repo.UpdateIssueAssignee)
903903
m.Post("/request_review", reqRepoIssuesOrPullsReader, repo.UpdatePullReviewRequest)
904904
m.Post("/dismiss_review", reqRepoAdmin, bindIgnErr(forms.DismissReviewForm{}), repo.DismissReview)

‎services/issue/milestone.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,14 @@ import (
1515
)
1616

1717
func changeMilestoneAssign(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, oldMilestoneID int64) error {
18+
has, err := issues_model.HasMilestoneByRepoID(ctx, issue.RepoID, issue.MilestoneID)
19+
if err != nil {
20+
return fmt.Errorf("GetMilestoneByRepoID: %v", err)
21+
}
22+
if !has {
23+
return fmt.Errorf("GetMilestoneByRepoID: issue doesn't exist")
24+
}
25+
1826
if err := issues_model.UpdateIssueCols(ctx, issue, "milestone_id"); err != nil {
1927
return err
2028
}

‎services/issue/status.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ import (
1515
)
1616

1717
// ChangeStatus changes issue status to open or closed.
18-
func ChangeStatus(issue *issues_model.Issue, doer *user_model.User, closed bool) error {
19-
return changeStatusCtx(db.DefaultContext, issue, doer, closed)
18+
func ChangeStatus(issue *issues_model.Issue, repoID int64, doer *user_model.User, closed bool) error {
19+
return changeStatusCtx(db.DefaultContext, issue, repoID, doer, closed)
2020
}
2121

2222
// changeStatusCtx changes issue status to open or closed.
2323
// TODO: if context is not db.DefaultContext we get a deadlock!!!
24-
func changeStatusCtx(ctx context.Context, issue *issues_model.Issue, doer *user_model.User, closed bool) error {
24+
func changeStatusCtx(ctx context.Context, issue *issues_model.Issue, repoID int64, doer *user_model.User, closed bool) error {
2525
comment, err := issues_model.ChangeIssueStatus(ctx, issue, doer, closed)
2626
if err != nil {
2727
if issues_model.IsErrDependenciesLeft(err) && closed {

‎services/pull/review.go

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ func SubmitReview(ctx context.Context, doer *user_model.User, gitRepo *git.Repos
271271
}
272272

273273
// DismissReview dismissing stale review by repo admin
274-
func DismissReview(ctx context.Context, reviewID int64, message string, doer *user_model.User, isDismiss bool) (comment *issues_model.Comment, err error) {
274+
func DismissReview(ctx context.Context, reviewID, repoID int64, message string, doer *user_model.User, isDismiss bool) (comment *issues_model.Comment, err error) {
275275
review, err := issues_model.GetReviewByID(ctx, reviewID)
276276
if err != nil {
277277
return
@@ -281,6 +281,16 @@ func DismissReview(ctx context.Context, reviewID int64, message string, doer *us
281281
return nil, fmt.Errorf("not need to dismiss this review because it's type is not Approve or change request")
282282
}
283283

284+
// load data for notify
285+
if err = review.LoadAttributes(ctx); err != nil {
286+
return nil, err
287+
}
288+
289+
// Check if the review's repoID is the one we're currently expecting.
290+
if review.Issue.RepoID != repoID {
291+
return nil, fmt.Errorf("reviews's repository is not the same as the one we expect")
292+
}
293+
284294
if err = issues_model.DismissReview(review, isDismiss); err != nil {
285295
return
286296
}
@@ -289,10 +299,6 @@ func DismissReview(ctx context.Context, reviewID int64, message string, doer *us
289299
return nil, nil
290300
}
291301

292-
// load data for notify
293-
if err = review.LoadAttributes(ctx); err != nil {
294-
return
295-
}
296302
if err = review.Issue.LoadPullRequest(); err != nil {
297303
return
298304
}

0 commit comments

Comments
 (0)