And there is another one ... (go-gitea#13350)

zeripath · web-flow · commit f825e2a56866 · 2020-10-29T20:48:58.000+08:00
Signed-off-by: Andrew Thornton &lt;art27@cantab.net&gt;
diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go
@@ -56,7 +56,11 @@ func GetIssueCommentReactions(ctx *context.APIContext) {
 		return
 	}
 
-	if !ctx.Repo.CanRead(models.UnitTypeIssues) {
+	if err := comment.LoadIssue(); err != nil {
+		ctx.Error(http.StatusInternalServerError, "comment.LoadIssue", err)
+	}
+
+	if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) {
 		ctx.Error(http.StatusForbidden, "GetIssueCommentReactions", errors.New("no permission to get reactions"))
 		return
 	}

Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,11 @@ func GetIssueCommentReactions(ctx *context.APIContext) {`
`56`	`56`	`return`
`57`	`57`	`}`
`58`	`58`
`59`		`- if !ctx.Repo.CanRead(models.UnitTypeIssues) {`
	`59`	`+ if err := comment.LoadIssue(); err != nil {`
	`60`	`+ ctx.Error(http.StatusInternalServerError, "comment.LoadIssue", err)`
	`61`	`+ }`
	`62`	`+`
	`63`	`+ if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) {`
`60`	`64`	`ctx.Error(http.StatusForbidden, "GetIssueCommentReactions", errors.New("no permission to get reactions"))`
`61`	`65`	`return`
`62`	`66`	`}`