Skip to content

Commit c7519aa

Browse files
KN4CK3RGiteaBot
KN4CK3R
and
GiteaBot
committed
Revert package access change from go-gitea#23879 (go-gitea#25707)
Fixes (?) go-gitea#25538 Fixes https://codeberg.org/forgejo/forgejo/issues/972 Regression go-gitea#23879 go-gitea#23879 introduced a change which prevents read access to packages if a user is not a member of an organization. That PR also contained a change which disallows package access if the team unit is configured with "no access" for packages. I don't think this change makes sense (at the moment). It may be relevant for private orgs. But for public or limited orgs that's useless because an unauthorized user would have more access rights than the team member. This PR restores the old behaviour "If a user has read access for an owner, they can read packages". --------- Co-authored-by: Giteabot <teabot@gitea.io>
1 parent ea2c9de commit c7519aa

File tree

8 files changed

+385
-28
lines changed

8 files changed

+385
-28
lines changed

‎models/fixtures/org_user.yml

+18
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,21 @@
8181
uid: 5
8282
org_id: 23
8383
is_public: false
84+
85+
-
86+
id: 15
87+
uid: 1
88+
org_id: 35
89+
is_public: true
90+
91+
-
92+
id: 16
93+
uid: 1
94+
org_id: 36
95+
is_public: true
96+
97+
-
98+
id: 17
99+
uid: 5
100+
org_id: 36
101+
is_public: true

‎models/fixtures/team.yml

+33
Original file line numberDiff line numberDiff line change
@@ -184,3 +184,36 @@
184184
num_members: 1
185185
includes_all_repositories: false
186186
can_create_org_repo: true
187+
188+
-
189+
id: 18
190+
org_id: 35
191+
lower_name: owners
192+
name: Owners
193+
authorize: 4 # owner
194+
num_repos: 0
195+
num_members: 1
196+
includes_all_repositories: false
197+
can_create_org_repo: true
198+
199+
-
200+
id: 19
201+
org_id: 36
202+
lower_name: owners
203+
name: Owners
204+
authorize: 4 # owner
205+
num_repos: 0
206+
num_members: 1
207+
includes_all_repositories: false
208+
can_create_org_repo: true
209+
210+
-
211+
id: 20
212+
org_id: 36
213+
lower_name: team20writepackage
214+
name: team20writepackage
215+
authorize: 1
216+
num_repos: 0
217+
num_members: 1
218+
includes_all_repositories: false
219+
can_create_org_repo: true

‎models/fixtures/team_unit.yml

+7-1
Original file line numberDiff line numberDiff line change
@@ -273,4 +273,10 @@
273273
id: 46
274274
team_id: 17
275275
type: 9 # package
276-
access_mode: 0
276+
access_mode: 2
277+
278+
-
279+
id: 47
280+
team_id: 20
281+
type: 9 # package
282+
access_mode: 2

‎models/fixtures/team_user.yml

+18
Original file line numberDiff line numberDiff line change
@@ -105,3 +105,21 @@
105105
org_id: 23
106106
team_id: 17
107107
uid: 5
108+
109+
-
110+
id: 19
111+
org_id: 35
112+
team_id: 18
113+
uid: 1
114+
115+
-
116+
id: 20
117+
org_id: 36
118+
team_id: 19
119+
uid: 1
120+
121+
-
122+
id: 21
123+
org_id: 36
124+
team_id: 20
125+
uid: 5

‎models/fixtures/user.yml

+74
Original file line numberDiff line numberDiff line change
@@ -1258,3 +1258,77 @@
12581258
repo_admin_change_team_access: false
12591259
theme: ""
12601260
keep_activity_private: false
1261+
1262+
-
1263+
id: 35
1264+
lower_name: private_org35
1265+
name: private_org35
1266+
full_name: Private Org 35
1267+
email: private_org35@example.com
1268+
keep_email_private: false
1269+
email_notifications_preference: enabled
1270+
passwd: ZogKvWdyEx:password
1271+
passwd_hash_algo: dummy
1272+
must_change_password: false
1273+
login_source: 0
1274+
login_name: private_org35
1275+
type: 1
1276+
salt: ZogKvWdyEx
1277+
max_repo_creation: -1
1278+
is_active: true
1279+
is_admin: false
1280+
is_restricted: false
1281+
allow_git_hook: false
1282+
allow_import_local: false
1283+
allow_create_organization: true
1284+
prohibit_login: false
1285+
avatar: avatar35
1286+
avatar_email: private_org35@example.com
1287+
use_custom_avatar: false
1288+
num_followers: 0
1289+
num_following: 0
1290+
num_stars: 0
1291+
num_repos: 0
1292+
num_teams: 1
1293+
num_members: 1
1294+
visibility: 2
1295+
repo_admin_change_team_access: false
1296+
theme: ""
1297+
keep_activity_private: false
1298+
1299+
-
1300+
id: 36
1301+
lower_name: limited_org36
1302+
name: limited_org36
1303+
full_name: Limited Org 36
1304+
email: limited_org36@example.com
1305+
keep_email_private: false
1306+
email_notifications_preference: enabled
1307+
passwd: ZogKvWdyEx:password
1308+
passwd_hash_algo: dummy
1309+
must_change_password: false
1310+
login_source: 0
1311+
login_name: limited_org36
1312+
type: 1
1313+
salt: ZogKvWdyEx
1314+
max_repo_creation: -1
1315+
is_active: true
1316+
is_admin: false
1317+
is_restricted: false
1318+
allow_git_hook: false
1319+
allow_import_local: false
1320+
allow_create_organization: true
1321+
prohibit_login: false
1322+
avatar: avatar22
1323+
avatar_email: limited_org36@example.com
1324+
use_custom_avatar: false
1325+
num_followers: 0
1326+
num_following: 0
1327+
num_stars: 0
1328+
num_repos: 0
1329+
num_teams: 2
1330+
num_members: 2
1331+
visibility: 1
1332+
repo_admin_change_team_access: false
1333+
theme: ""
1334+
keep_activity_private: false

‎modules/context/package.go

+17-7
Original file line numberDiff line numberDiff line change
@@ -108,18 +108,28 @@ func determineAccessMode(ctx *Base, pkg *Package, doer *user_model.User) (perm.A
108108

109109
if doer != nil && !doer.IsGhost() {
110110
// 1. If user is logged in, check all team packages permissions
111-
teams, err := organization.GetUserOrgTeams(ctx, org.ID, doer.ID)
111+
var err error
112+
accessMode, err = org.GetOrgUserMaxAuthorizeLevel(doer.ID)
112113
if err != nil {
113114
return accessMode, err
114115
}
115-
for _, t := range teams {
116-
perm := t.UnitAccessMode(ctx, unit.TypePackages)
117-
if accessMode < perm {
118-
accessMode = perm
116+
// If access mode is less than write check every team for more permissions
117+
// The minimum possible access mode is read for org members
118+
if accessMode < perm.AccessModeWrite {
119+
teams, err := organization.GetUserOrgTeams(ctx, org.ID, doer.ID)
120+
if err != nil {
121+
return accessMode, err
122+
}
123+
for _, t := range teams {
124+
perm := t.UnitAccessMode(ctx, unit.TypePackages)
125+
if accessMode < perm {
126+
accessMode = perm
127+
}
119128
}
120129
}
121-
} else if organization.HasOrgOrUserVisible(ctx, pkg.Owner, doer) {
122-
// 2. If user is non-login, check if org is visible to non-login user
130+
}
131+
if accessMode == perm.AccessModeNone && organization.HasOrgOrUserVisible(ctx, pkg.Owner, doer) {
132+
// 2. If user is unauthorized or no org member, check if org is visible
123133
accessMode = perm.AccessModeRead
124134
}
125135
} else {

‎tests/integration/api_org_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,9 @@ func TestAPIGetAll(t *testing.T) {
170170
var apiOrgList []*api.Organization
171171

172172
DecodeJSON(t, resp, &apiOrgList)
173-
assert.Len(t, apiOrgList, 9)
174-
assert.Equal(t, "org25", apiOrgList[1].FullName)
175-
assert.Equal(t, "public", apiOrgList[1].Visibility)
173+
assert.Len(t, apiOrgList, 11)
174+
assert.Equal(t, "Limited Org 36", apiOrgList[1].FullName)
175+
assert.Equal(t, "limited", apiOrgList[1].Visibility)
176176

177177
// accessing without a token will return only public orgs
178178
req = NewRequestf(t, "GET", "/api/v1/orgs")

0 commit comments

Comments
 (0)