Skip to content

Commit

Permalink
Fix package access for admins and inactive users (go-gitea#21580) (go…
Browse files Browse the repository at this point in the history
…-gitea#21592)

Backport of go-gitea#21580

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
  • Loading branch information
3 people authored Oct 28, 2022
1 parent b0a057f commit 5bc3fbd
Show file tree
Hide file tree
Showing 4 changed files with 34 additions and 3 deletions.
4 changes: 4 additions & 0 deletions integrations/api_packages_container_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -433,6 +433,10 @@ func TestPackageContainer(t *testing.T) {

assert.Equal(t, fmt.Sprintf("%d", len(blobContent)), resp.Header().Get("Content-Length"))
assert.Equal(t, blobDigest, resp.Header().Get("Docker-Content-Digest"))

req = NewRequest(t, "HEAD", fmt.Sprintf("%s/blobs/%s", url, blobDigest))
addTokenAuthHeader(req, anonymousToken)
MakeRequest(t, req, http.StatusOK)
})

t.Run("GetBlob", func(t *testing.T) {
Expand Down
22 changes: 22 additions & 0 deletions integrations/api_packages_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import (

func TestPackageAPI(t *testing.T) {
defer prepareTestEnv(t)()

user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}).(*user_model.User)
session := loginUser(t, user.Name)
token := getTokenForLoggedInUser(t, session)
Expand Down Expand Up @@ -143,6 +144,27 @@ func TestPackageAPI(t *testing.T) {
})
}

func TestPackageAccess(t *testing.T) {
defer prepareTestEnv(t)()

admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).(*user_model.User)
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5}).(*user_model.User)
inactive := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 9}).(*user_model.User)

uploadPackage := func(doer, owner *user_model.User, expectedStatus int) {
url := fmt.Sprintf("/api/packages/%s/generic/test-package/1.0/file.bin", owner.Name)
req := NewRequestWithBody(t, "PUT", url, bytes.NewReader([]byte{1}))
AddBasicAuthHeader(req, doer.Name)
MakeRequest(t, req, expectedStatus)
}

uploadPackage(user, inactive, http.StatusUnauthorized)
uploadPackage(inactive, inactive, http.StatusUnauthorized)
uploadPackage(inactive, user, http.StatusUnauthorized)
uploadPackage(admin, inactive, http.StatusCreated)
uploadPackage(admin, user, http.StatusCreated)
}

func TestPackageCleanup(t *testing.T) {
defer prepareTestEnv(t)()

Expand Down
9 changes: 6 additions & 3 deletions modules/context/package.go
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,15 @@ func packageAssignment(ctx *Context, errCb func(int, string, interface{})) {
}

func determineAccessMode(ctx *Context) (perm.AccessMode, error) {
accessMode := perm.AccessModeNone

if setting.Service.RequireSignInView && ctx.Doer == nil {
return accessMode, nil
return perm.AccessModeNone, nil
}

if ctx.Doer != nil && !ctx.Doer.IsGhost() && (!ctx.Doer.IsActive || ctx.Doer.ProhibitLogin) {
return perm.AccessModeNone, nil
}

accessMode := perm.AccessModeNone
if ctx.Package.Owner.IsOrganization() {
org := organization.OrgFromUser(ctx.Package.Owner)

Expand Down
2 changes: 2 additions & 0 deletions routers/api/packages/api.go
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ func Routes() *web.Route {
authGroup := auth.NewGroup(authMethods...)
r.Use(func(ctx *context.Context) {
ctx.Doer = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
ctx.IsSigned = ctx.Doer != nil
})

r.Group("/{username}", func() {
Expand Down Expand Up @@ -256,6 +257,7 @@ func ContainerRoutes() *web.Route {
authGroup := auth.NewGroup(authMethods...)
r.Use(func(ctx *context.Context) {
ctx.Doer = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
ctx.IsSigned = ctx.Doer != nil
})

r.Get("", container.ReqContainerAccess, container.DetermineSupport)
Expand Down

0 comments on commit 5bc3fbd

Please sign in to comment.