Fix invalid issues in project boards

models/issues/issue_project.go

@@ -8,8 +8,11 @@ import (
 	"fmt"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/organization"
 	project_model "code.gitea.io/gitea/models/project"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/optional"
 )
 
 // LoadProject load the project the issue was assigned to
@@ -48,32 +51,36 @@ func (issue *Issue) ProjectBoardID(ctx context.Context) int64 {
 }
 
 // LoadIssuesFromBoard load issues assigned to this board
-func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList, error) {
+func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board, doer *user_model.User, org *organization.Organization, isClosed optional.Option[bool]) (IssueList, error) {
 	issueList := make(IssueList, 0, 10)
 
+	opts := &IssuesOptions{
+		ProjectID: b.ProjectID,
+		SortType:  "project-column-sorting",
+		IsClosed:  isClosed,
+	}
+
+	if doer != nil {
+		opts.User = doer
+		opts.Org = org
+	} else {
+		// non-login user can only access public repos
+		opts.AllPublic = true
+	}
+
 	if b.ID > 0 {
-		issues, err := Issues(ctx, &IssuesOptions{
-			ProjectBoardID: b.ID,
-			ProjectID:      b.ProjectID,
-			SortType:       "project-column-sorting",
-		})
-		if err != nil {
-			return nil, err
-		}
-		issueList = issues
+		opts.ProjectBoardID = b.ID
+	} else if b.Default {
+		opts.ProjectBoardID = db.NoConditionID
+	} else {
+		return issueList, nil
 	}
 
-	if b.Default {
-		issues, err := Issues(ctx, &IssuesOptions{
-			ProjectBoardID: db.NoConditionID,
-			ProjectID:      b.ProjectID,
-			SortType:       "project-column-sorting",
-		})
-		if err != nil {
-			return nil, err
-		}
-		issueList = append(issueList, issues...)
+	issues, err := Issues(ctx, opts)
+	if err != nil {
+		return nil, err
 	}
+	issueList = append(issueList, issues...)
 
 	if err := issueList.LoadComments(ctx); err != nil {
 		return nil, err
@@ -83,18 +90,52 @@ func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList
 }
 
 // LoadIssuesFromBoardList load issues assigned to the boards
-func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList) (map[int64]IssueList, error) {
+func LoadIssuesFromBoardList(ctx context.Context, bs project_model.BoardList, doer *user_model.User, org *organization.Organization, isClosed optional.Option[bool]) (map[int64]IssueList, error) {
+	if unit.TypeIssues.UnitGlobalDisabled() {
+		return nil, nil
+	}
 	issuesMap := make(map[int64]IssueList, len(bs))
-	for i := range bs {
-		il, err := LoadIssuesFromBoard(ctx, bs[i])
+	for _, b := range bs {
+		il, err := LoadIssuesFromBoard(ctx, b, doer, org, isClosed)
 		if err != nil {
 			return nil, err
 		}
-		issuesMap[bs[i].ID] = il
+		issuesMap[b.ID] = il
 	}
 	return issuesMap, nil
 }
 
+// NumIssuesInProjects returns counter of all issues assigned to a project list which doer can access
+func NumIssuesInProjects(ctx context.Context, pl project_model.ProjectList, doer *user_model.User, org *organization.Organization, isClosed optional.Option[bool]) (map[int64]int, error) {
+	numMap := make(map[int64]int, len(pl))
+	for _, p := range pl {
+		num, err := NumIssuesInProject(ctx, p, doer, org, isClosed)
+		if err != nil {
+			return nil, err
+		}
+		numMap[p.ID] = num
+	}
+
+	return numMap, nil
+}
+
+// NumIssuesInProject returns counter of all issues assigned to a project which doer can access
+func NumIssuesInProject(ctx context.Context, p *project_model.Project, doer *user_model.User, org *organization.Organization, isClosed optional.Option[bool]) (int, error) {
+	numIssuesInProject := int(0)
+	bs, err := p.GetBoards(ctx)
+	if err != nil {
+		return 0, err
+	}
+	im, err := LoadIssuesFromBoardList(ctx, bs, doer, org, isClosed)
+	if err != nil {
+		return 0, err
+	}
+	for _, il := range im {
+		numIssuesInProject += len(il)
+	}
+	return numIssuesInProject, nil
+}
+
 // ChangeProjectAssign changes the project associated with an issue
 func ChangeProjectAssign(ctx context.Context, issue *Issue, doer *user_model.User, newProjectID int64) error {
 	ctx, committer, err := db.TxContext(ctx)
@@ -123,8 +164,11 @@ func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.U
 		if err != nil {
 			return err
 		}
-		if newProject.RepoID != issue.RepoID && newProject.OwnerID != issue.Repo.OwnerID {
-			return fmt.Errorf("issue's repository is not the same as project's repository")
+
+		if canWriteByDoer, err := newProject.CanWriteByDoer(ctx, issue.Repo, doer); err != nil {
+			return err
+		} else if !canWriteByDoer {
+			return fmt.Errorf("doer have no write permission to project [id:%d]", newProjectID)
 		}
 	}
 

models/issues/issue_search.go

@@ -202,7 +202,7 @@ func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) *xorm.Session
 		if opts.RepoCond == nil {
 			opts.RepoCond = builder.NewCond()
 		}
-		opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(builder.Eq{"is_private": false})))
+		opts.RepoCond = opts.RepoCond.Or(repo_model.PublicRepoCond("issue.repo_id"))
 	}
 	if opts.RepoCond != nil {
 		sess.And(opts.RepoCond)
@@ -340,6 +340,7 @@ func issuePullAccessibleRepoCond(repoIDstr string, userID int64, org *organizati
 	} else {
 		cond = cond.And(
 			builder.Or(
+				repo_model.PublicRepoCond(repoIDstr),                          // all public repos
 				repo_model.UserOwnedRepoCond(userID),                          // owned repos
 				repo_model.UserAccessRepoCond(repoIDstr, userID),              // user can access repo in a unit independent way
 				repo_model.UserAssignedRepoCond(repoIDstr, userID),            // user has been assigned accessible public repos

models/perm/access/repo_permission.go

@@ -424,3 +424,17 @@ func CheckRepoUnitUser(ctx context.Context, repo *repo_model.Repository, user *u
 
 	return perm.CanRead(unitType)
 }
+
+// CheckRepoUnitWriteUser check whether user could write the unit of this repository
+func CheckRepoUnitWriteUser(ctx context.Context, repo *repo_model.Repository, user *user_model.User, unitType unit.Type) bool {
+	if user != nil && user.IsAdmin {
+		return true
+	}
+	perm, err := GetUserRepoPermission(ctx, repo, user)
+	if err != nil {
+		log.Error("GetUserRepoPermission: %w", err)
+		return false
+	}
+
+	return perm.CanWrite(unitType)
+}

models/project/board.go

@@ -59,6 +59,8 @@ type Board struct {
 	ProjectID int64 `xorm:"INDEX NOT NULL"`
 	CreatorID int64 `xorm:"NOT NULL"`
 
+	Project *Project `xorm:"-"`
+
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
 }

models/project/project.go

@@ -9,8 +9,13 @@ import (
 	"html/template"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/organization"
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"
@@ -35,6 +40,9 @@ type (
 
 	// Type is used to identify the type of project in question and ownership
 	Type uint8
+
+	// List is used to identify a list of projects
+	ProjectList []*Project //nolint
 )
 
 const (
@@ -153,14 +161,155 @@ func (p *Project) IconName() string {
 	return "octicon-project-symlink"
 }
 
-func (p *Project) IsOrganizationProject() bool {
-	return p.Type == TypeOrganization
+func (p *Project) IsIndividualProject() bool {
+	return p.Type == TypeIndividual
 }
 
 func (p *Project) IsRepositoryProject() bool {
 	return p.Type == TypeRepository
 }
 
+func (p *Project) IsOrganizationProject() bool {
+	return p.Type == TypeOrganization
+}
+
+func (pl ProjectList) getOwnerIDs() []int64 {
+	ids := make(container.Set[int64], len(pl))
+	for _, p := range pl {
+		if p.OwnerID == 0 {
+			continue
+		}
+		ids.Add(p.OwnerID)
+	}
+	return ids.Values()
+}
+
+func (pl ProjectList) getRepoIDs() []int64 {
+	ids := make(container.Set[int64], len(pl))
+	for _, p := range pl {
+		if p.RepoID == 0 {
+			continue
+		}
+		ids.Add(p.RepoID)
+	}
+	return ids.Values()
+}
+
+func (pl ProjectList) LoadOwners(ctx context.Context) ([]*user_model.User, error) {
+	if len(pl) == 0 {
+		return nil, nil
+	}
+
+	userIDs := pl.getOwnerIDs()
+	usersMap := make(map[int64]*user_model.User, len(userIDs))
+	if err := db.GetEngine(ctx).
+		Where("id > 0").
+		In("id", userIDs).
+		Find(&usersMap); err != nil {
+		return nil, fmt.Errorf("find users: %w", err)
+	}
+	for _, p := range pl {
+		if p.OwnerID > 0 && p.Owner == nil {
+			p.Owner = usersMap[p.OwnerID]
+		}
+	}
+	users := make([]*user_model.User, 0, len(usersMap))
+	for _, u := range usersMap {
+		if u != nil {
+			users = append(users, u)
+		}
+	}
+	return users, nil
+}
+
+func (pl ProjectList) LoadRepositories(ctx context.Context) (repo_model.RepositoryList, error) {
+	if len(pl) == 0 {
+		return nil, nil
+	}
+
+	repoIDs := pl.getRepoIDs()
+	repos := make(map[int64]*repo_model.Repository, len(repoIDs))
+	if err := db.GetEngine(ctx).
+		In("id", repoIDs).
+		Find(&repos); err != nil {
+		return nil, fmt.Errorf("find repository: %w", err)
+	}
+	for _, p := range pl {
+		if p.RepoID > 0 && p.Repo == nil {
+			p.Repo = repos[p.RepoID]
+		}
+	}
+	return repo_model.ValuesRepository(repos), nil
+}
+
+func (pl ProjectList) FilterWritableByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (ProjectList, error) {
+	// non-login user have no write permission
+	if doer == nil {
+		return nil, nil
+	}
+
+	// Check valid individual/organization projects
+	owners, err := pl.LoadOwners(ctx)
+	if err != nil {
+		return nil, err
+	}
+	validOwnerIDs := make(container.Set[int64], len(owners))
+	for _, owner := range owners {
+		if CheckUserUnitWriteDoer(ctx, owner, doer, unit.TypeProjects) {
+			validOwnerIDs.Add(owner.ID)
+		}
+	}
+
+	// Check valid repo projects
+	repos, err := pl.LoadRepositories(ctx)
+	if err != nil {
+		return nil, err
+	}
+	validRepoIDs := make(container.Set[int64], len(repos))
+	for _, repo := range repos {
+		if access_model.CheckRepoUnitWriteUser(ctx, repo, doer, unit.TypeProjects) {
+			validRepoIDs.Add(repo.ID)
+		}
+	}
+
+	projectList := pl[:0]
+	for _, p := range pl {
+		if (p.RepoID > 0 && p.RepoID == repo.ID && validRepoIDs.Contains(p.RepoID)) ||
+			(p.OwnerID > 0 && p.OwnerID == repo.OwnerID && validOwnerIDs.Contains(p.OwnerID)) {
+			projectList = append(projectList, p)
+		}
+	}
+	return projectList, nil
+}
+
+// CheckUserUnitWriteDoer return whether doer have write permission to the individual/organization project
+func CheckUserUnitWriteDoer(ctx context.Context, user, doer *user_model.User, unitType unit.Type) bool {
+	if user == nil {
+		return false
+	}
+	if user.IsIndividual() && user.ID != doer.ID {
+		return false
+	}
+	if user.IsOrganization() && (*organization.Organization)(user).UnitPermission(ctx, doer, unitType) < perm.AccessModeWrite {
+		return false
+	}
+	return true
+}
+
+// CanWriteByDoer return whether doer have write permission to the project
+func (p Project) CanWriteByDoer(ctx context.Context, repo *repo_model.Repository, doer *user_model.User) (bool, error) {
+	var err error
+	projectList := ProjectList{&p}
+	projectList, err = projectList.FilterWritableByDoer(ctx, repo, doer)
+	if err != nil {
+		return false, err
+	}
+	if len(projectList) == 0 {
+		return false, nil
+	}
+	return true, nil
+}
+
 func init() {
 	db.RegisterModel(new(Project))
 }