public/gitea
1
0 Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-28 16:47:01 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(feed): require code read access for the repo home branch feed (#39964)

Browse Source 
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Basavaraj S msilverwindwxiaoguang
 authored and GitHub committed 2026-10-28 00:33:35 +00:00
1 parent 178d33ed4d
commit 92ad81bb14
5 files changed
+17 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

routers/web/feed/branch.go
+1 -2
View File
@@ -13,8 +13,7 @@ import (
"github.com/gorilla/feeds"
)
// ShowBranchFeed shows tags and/or releases on the repo as RSS / Atom feed
func ShowBranchFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
func showBranchFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
if !checkRepoFeedTokenScope(ctx) {
return
}
routers/web/feed/file.go
+1 -2
View File
@@ -14,8 +14,7 @@ import (
"github.com/gorilla/feeds"
)
// ShowFileFeed shows tags and/or releases on the repo as RSS / Atom feed
func ShowFileFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
func showFileFeed(ctx *context.Context, repo *repo.Repository, formatType string) {
if !checkRepoFeedTokenScope(ctx) {
return
}
routers/web/feed/render.go
+2 -2
View File
@@ -19,9 +19,9 @@ func checkRepoFeedTokenScope(ctx *context.Context) bool {
// RenderBranchFeed render format for branch or file
func RenderBranchFeed(ctx *context.Context, feedType string) {
if ctx.Repo.TreePath == "" {
ShowBranchFeed(ctx, ctx.Repo.Repository, feedType)
showBranchFeed(ctx, ctx.Repo.Repository, feedType)
} else {
ShowFileFeed(ctx, ctx.Repo.Repository, feedType)
showFileFeed(ctx, ctx.Repo.Repository, feedType)
}
}
routers/web/repo/view_home.go
+5 -3
View File
@@ -349,10 +349,12 @@ func handleRepoHomeFeed(ctx *context.Context) bool {
}
if ctx.Link == fmt.Sprintf("%s.%s", ctx.Repo.RepoLink, showFeedType) {
feed.ShowRepoFeed(ctx, ctx.Repo.Repository, showFeedType)
} else if ctx.Repo.TreePath == "" {
feed.ShowBranchFeed(ctx, ctx.Repo.Repository, showFeedType)
} else if !ctx.Repo.Permission.CanRead(unit_model.TypeCode) && !ctx.Repo.CanWriteToBranch(ctx, ctx.Doer, ctx.Repo.BranchName) {
// the branch and file feeds list commits, so gate them like RequireUnitReader(TypeCode) on "/rss/branch/*",
// which also admits maintainers of a PR allowing maintainer edits, who can push to its head branch without code read access
ctx.NotFound(nil)
} else {
feed.ShowFileFeed(ctx, ctx.Repo.Repository, showFeedType)
feed.RenderBranchFeed(ctx, showFeedType)
}
return true
}
tests/integration/feed_user_test.go
+8
View File
@@ -153,4 +153,12 @@ func TestFeedUser(t *testing.T) {
assert.NotContains(t, data, "pre-release")
assert.NotContains(t, data, "some text for a pre release")
})
t.Run("RepoBranchFeedWithoutCodeAccess", func(t *testing.T) {
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
require.NoError(t, repo_service.UpdateRepositoryUnits(t.Context(), repo, nil, []unit_model.Type{unit_model.TypeCode}))
MakeRequest(t, NewRequest(t, "GET", "/user2/repo1").SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
MakeRequest(t, NewRequest(t, "GET", "/user2/repo1").SetHeader("Accept", "application/atom+xml"), http.StatusNotFound)
MakeRequest(t, NewRequest(t, "GET", "/user2/repo1.rss"), http.StatusOK)
})
}