mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-02 13:44:16 +09:00
Backport https://github.com/go-gitea/gitea/pull/39945 API tokens and Actions task tokens could see data beyond their scope through user-scoped API routes and web profile pages. - Actions task tokens authenticate as a shared system user with a negative ID, which org, project and SSH/GPG key filters treated as "no owner filter". These filters now check `!= 0`, so system users own nothing. The `/api/v1/user` routes except `GET /api/v1/user` only accept individual and bot accounts, and repo search no longer skips access checks for the owner. - `/{username}` only accepts tokens for RSS/Atom feeds. HTML profile and org pages render as anonymous for token requests. - User and org feeds require `read:user` or `read:organization` from tokens, the same way repo feeds require `read:repository`. `release/v28` lacks https://github.com/go-gitea/gitea/pull/39967, so `/{username}` enables basic auth only for feed requests through a middleware. The profile page token tests from https://github.com/go-gitea/gitea/pull/39853 are folded into `TestFeedUser`, because profile pages no longer accept tokens. Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
171 lines
4.4 KiB
Go
171 lines
4.4 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package user
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
access_model "gitea.dev/models/perm/access"
|
|
repo_model "gitea.dev/models/repo"
|
|
user_model "gitea.dev/models/user"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/routers/api/v1/utils"
|
|
"gitea.dev/services/context"
|
|
"gitea.dev/services/convert"
|
|
)
|
|
|
|
// listUserRepos - List the repositories owned by the given user.
|
|
func listUserRepos(ctx *context.APIContext, u *user_model.User, private bool) {
|
|
opts := utils.GetListOptions(ctx)
|
|
|
|
searchOpts := repo_model.SearchRepoOptions{
|
|
Actor: u,
|
|
Private: private,
|
|
ListOptions: opts,
|
|
OrderBy: "id ASC",
|
|
}
|
|
searchOpts.ApplyPublicOnly(ctx.PublicOnly)
|
|
|
|
repos, count, err := repo_model.GetUserRepositories(ctx, searchOpts)
|
|
if err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
|
|
if err := repos.LoadAttributes(ctx); err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
|
|
apiRepos := make([]*api.Repository, 0, len(repos))
|
|
for i := range repos {
|
|
permission, err := access_model.GetDoerRepoPermission(ctx, repos[i], ctx.Doer)
|
|
if err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
if ctx.IsSigned && ctx.Doer.IsAdmin || permission.HasAnyUnitAccess() {
|
|
apiRepos = append(apiRepos, convert.ToRepo(ctx, repos[i], permission))
|
|
}
|
|
}
|
|
|
|
ctx.SetLinkHeader(count, opts.PageSize)
|
|
ctx.SetTotalCountHeader(count)
|
|
ctx.JSON(http.StatusOK, &apiRepos)
|
|
}
|
|
|
|
// ListUserRepos - list the repos owned by the given user.
|
|
func ListUserRepos(ctx *context.APIContext) {
|
|
// swagger:operation GET /users/{username}/repos user userListRepos
|
|
// ---
|
|
// summary: List the repos owned by the given user
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: username
|
|
// in: path
|
|
// description: username of the user whose owned repos are to be listed
|
|
// type: string
|
|
// required: true
|
|
// - name: page
|
|
// in: query
|
|
// description: page number of results to return (1-based)
|
|
// type: integer
|
|
// - name: limit
|
|
// in: query
|
|
// description: page size of results
|
|
// type: integer
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/RepositoryList"
|
|
// "404":
|
|
// "$ref": "#/responses/notFound"
|
|
|
|
listUserRepos(ctx, ctx.ContextUser, ctx.IsSigned)
|
|
}
|
|
|
|
// ListMyRepos - list the repositories you own or have access to.
|
|
func ListMyRepos(ctx *context.APIContext) {
|
|
// swagger:operation GET /user/repos user userCurrentListRepos
|
|
// ---
|
|
// summary: List the repos that the authenticated user owns
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: page
|
|
// in: query
|
|
// description: page number of results to return (1-based)
|
|
// type: integer
|
|
// - name: limit
|
|
// in: query
|
|
// description: page size of results
|
|
// type: integer
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/RepositoryList"
|
|
|
|
opts := repo_model.SearchRepoOptions{
|
|
ListOptions: utils.GetListOptions(ctx),
|
|
Actor: ctx.Doer,
|
|
OwnerID: ctx.Doer.ID,
|
|
Private: ctx.IsSigned,
|
|
IncludeDescription: true,
|
|
}
|
|
opts.ApplyPublicOnly(ctx.PublicOnly)
|
|
|
|
repos, count, err := repo_model.SearchRepository(ctx, opts)
|
|
if err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
|
|
results := make([]*api.Repository, len(repos))
|
|
for i, repo := range repos {
|
|
if err = repo.LoadOwner(ctx); err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
permission, err := access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)
|
|
if err != nil {
|
|
ctx.APIErrorInternal(err)
|
|
return
|
|
}
|
|
results[i] = convert.ToRepo(ctx, repo, permission)
|
|
}
|
|
|
|
ctx.SetLinkHeader(count, opts.ListOptions.PageSize)
|
|
ctx.SetTotalCountHeader(count)
|
|
ctx.JSON(http.StatusOK, &results)
|
|
}
|
|
|
|
// ListOrgRepos - list the repositories of an organization.
|
|
func ListOrgRepos(ctx *context.APIContext) {
|
|
// swagger:operation GET /orgs/{org}/repos organization orgListRepos
|
|
// ---
|
|
// summary: List an organization's repos
|
|
// produces:
|
|
// - application/json
|
|
// parameters:
|
|
// - name: org
|
|
// in: path
|
|
// description: name of the organization
|
|
// type: string
|
|
// required: true
|
|
// - name: page
|
|
// in: query
|
|
// description: page number of results to return (1-based)
|
|
// type: integer
|
|
// - name: limit
|
|
// in: query
|
|
// description: page size of results
|
|
// type: integer
|
|
// responses:
|
|
// "200":
|
|
// "$ref": "#/responses/RepositoryList"
|
|
// "404":
|
|
// "$ref": "#/responses/notFound"
|
|
|
|
listUserRepos(ctx, ctx.Org.Organization.AsUser(), ctx.IsSigned)
|
|
}
|