Dont leak private users via extensions (go-gitea#28023)

fuxiaohei · Jan 17, 2024 · 076d08b · 076d08b
1 parent 582aca8
commit 076d08b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/routers/web/user/home.go b/routers/web/user/home.go
@@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) {
 	reloadParam := func(suffix string) (success bool) {
 		ctx.SetParams("username", strings.TrimSuffix(username, suffix))
 		context_service.UserAssignmentWeb()(ctx)
+		// check view permissions
+		if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
+			ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name))
+			return false
+		}
 		return !ctx.Written()
 	}
 	switch {