Allow users with write permissions for issues to add attachments with API (#26837)

Zettat123 · web-flow · commit 04771b5ff791 · 2023-09-01T15:35:38.000Z
Fixes #24944 Since a user with write permissions for issues can add attachments to an issue via the the web interface, the user should also be able to add attachments via the API
diff --git a/routers/api/v1/repo/issue_attachment.go b/routers/api/v1/repo/issue_attachment.go
@@ -344,7 +344,7 @@ func getIssueAttachmentSafeRead(ctx *context.APIContext, issue *issues_model.Iss
 }
 
 func canUserWriteIssueAttachment(ctx *context.APIContext, issue *issues_model.Issue) bool {
-	canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin()) && ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull)
+	canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin() || ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull))
 	if !canEditIssue {
 		ctx.Error(http.StatusForbidden, "", "user should have permission to write issue")
 		return false

Original file line number	Diff line number	Diff line change
`@@ -344,7 +344,7 @@ func getIssueAttachmentSafeRead(ctx context.APIContext, issue issues_model.Iss`
`344`	`344`	`}`
`345`	`345`
`346`	`346`	`func canUserWriteIssueAttachment(ctx context.APIContext, issue issues_model.Issue) bool {`
`347`		`- canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID \|\| ctx.IsUserRepoAdmin() \|\| ctx.IsUserSiteAdmin()) && ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull)`
	`347`	`+ canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID \|\| ctx.IsUserRepoAdmin() \|\| ctx.IsUserSiteAdmin() \|\| ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull))`
`348`	`348`	`if !canEditIssue {`
`349`	`349`	`ctx.Error(http.StatusForbidden, "", "user should have permission to write issue")`
`350`	`350`	`return false`