Fix users cannot visit issue attachment bug (#25019)

Caused by #24362 Co-authored-by: Giteabot <teabot@gitea.io>
go-gitea · May 31, 2023 · 5d23c88 · 5d23c88
1 parent 48bfea6
commit 5d23c88
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
@@ -110,11 +110,6 @@ func ServeAttachment(ctx *context.Context, uuid string) {
 			return
 		}
 	} else { // If we have the repository we check access
-		context.CheckRepoScopedToken(ctx, repository)
-		if ctx.Written() {
-			return
-		}
-
 		perm, err := access_model.GetUserRepoPermission(ctx, repository, ctx.Doer)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err.Error())

diff --git a/tests/integration/attachment_test.go b/tests/integration/attachment_test.go
@@ -89,6 +89,9 @@ func TestCreateIssueAttachment(t *testing.T) {
 	// Validate that attachment is available
 	req = NewRequest(t, "GET", "/attachments/"+uuid)
 	session.MakeRequest(t, req, http.StatusOK)
+
+	// anonymous visit should be allowed because user2/repo1 is a public repository
+	MakeRequest(t, req, http.StatusOK)
 }
 
 func TestGetAttachment(t *testing.T) {