Collaborator trust model should trust collaborators (#18539)

* Collaborator trust model should trust collaborators

There was an unintended regression in #17917 which leads to only
repository admin commits being trusted. This PR restores the old logic.

Fix #18501

Signed-off-by: Andrew Thornton <art27@cantab.net>

diff --git a/models/asymkey/gpg_key_commit_verification.go b/models/asymkey/gpg_key_commit_verification.go
index 4b9d0cfda4b1e355927ec1f0a8730eb93075f9b0..2f66863091aec60d60d5165b5abd4ac2f9bf181f 100644 (file)
--- a/models/asymkey/gpg_key_commit_verification.go
+++ b/models/asymkey/gpg_key_commit_verification.go
@@ -71,7 +71,7 @@ const (
 )
 
 // ParseCommitsWithSignature checks if signaute of commits are corresponding to users gpg keys.
-func ParseCommitsWithSignature(oldCommits []*user_model.UserCommit, repoTrustModel repo_model.TrustModelType, isCodeReader func(*user_model.User) (bool, error)) []*SignCommit {
+func ParseCommitsWithSignature(oldCommits []*user_model.UserCommit, repoTrustModel repo_model.TrustModelType, isOwnerMemberCollaborator func(*user_model.User) (bool, error)) []*SignCommit {
        newCommits := make([]*SignCommit, 0, len(oldCommits))
        keyMap := map[string]bool{}
 
@@ -81,7 +81,7 @@ func ParseCommitsWithSignature(oldCommits []*user_model.UserCommit, repoTrustMod
                        Verification: ParseCommitWithSignature(c.Commit),
                }
 
-               _ = CalculateTrustStatus(signCommit.Verification, repoTrustModel, isCodeReader, &keyMap)
+               _ = CalculateTrustStatus(signCommit.Verification, repoTrustModel, isOwnerMemberCollaborator, &keyMap)
 
                newCommits = append(newCommits, signCommit)
        }
@@ -455,7 +455,7 @@ func hashAndVerifyForKeyID(sig *packet.Signature, payload string, committer *use
 
 // CalculateTrustStatus will calculate the TrustStatus for a commit verification within a repository
 // There are several trust models in Gitea
-func CalculateTrustStatus(verification *CommitVerification, repoTrustModel repo_model.TrustModelType, isCodeReader func(*user_model.User) (bool, error), keyMap *map[string]bool) (err error) {
+func CalculateTrustStatus(verification *CommitVerification, repoTrustModel repo_model.TrustModelType, isOwnerMemberCollaborator func(*user_model.User) (bool, error), keyMap *map[string]bool) (err error) {
        if !verification.Verified {
                return
        }
@@ -500,11 +500,11 @@ func CalculateTrustStatus(verification *CommitVerification, repoTrustModel repo_
                        var has bool
                        isMember, has = (*keyMap)[verification.SigningKey.KeyID]
                        if !has {
-                               isMember, err = isCodeReader(verification.SigningUser)
+                               isMember, err = isOwnerMemberCollaborator(verification.SigningUser)
                                (*keyMap)[verification.SigningKey.KeyID] = isMember
                        }
                } else {
-                       isMember, err = isCodeReader(verification.SigningUser)
+                       isMember, err = isOwnerMemberCollaborator(verification.SigningUser)
                }
 
                if !isMember {

diff --git a/models/commit.go b/models/commit.go
index 5df6964a1d06ee5b4ba539d51558242e05bbd76a..92a839b7808fc9f22b472630ff9af404b24bea68 100644 (file)
--- a/models/commit.go
+++ b/models/commit.go
@@ -18,7 +18,7 @@ func ConvertFromGitCommit(commits []*git.Commit, repo *repo_model.Repository) []
                        user_model.ValidateCommitsWithEmails(commits),
                        repo.GetTrustModel(),
                        func(user *user_model.User) (bool, error) {
-                               return IsUserRepoAdmin(repo, user)
+                               return IsOwnerMemberCollaborator(repo, user.ID)
                        },
                ),
                repo,

diff --git a/modules/gitgraph/graph_models.go b/modules/gitgraph/graph_models.go
index 44773a3b9a31cef6c3055d7fa61ead8bfd281cfa..653384252dacae1e898cb4ed7b3f6de6313bd44d 100644 (file)
--- a/modules/gitgraph/graph_models.go
+++ b/modules/gitgraph/graph_models.go
@@ -117,7 +117,7 @@ func (graph *Graph) LoadAndProcessCommits(repository *repo_model.Repository, git
                c.Verification = asymkey_model.ParseCommitWithSignature(c.Commit)
 
                _ = asymkey_model.CalculateTrustStatus(c.Verification, repository.GetTrustModel(), func(user *user_model.User) (bool, error) {
-                       return models.IsUserRepoAdmin(repository, user)
+                       return models.IsOwnerMemberCollaborator(repository, user.ID)
                }, &keyMap)
 
                statuses, _, err := models.GetLatestCommitStatus(repository.ID, c.Commit.ID.String(), db.ListOptions{})

diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index 12457e45ee7074c225a97573fcf3739cde59b098..36cc005cec91f4b4a7545e6826399536c3fdd8e9 100644 (file)
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -351,7 +351,7 @@ func Diff(ctx *context.Context) {
        ctx.Data["DiffNotAvailable"] = diff.NumFiles == 0
 
        if err := asymkey_model.CalculateTrustStatus(verification, ctx.Repo.Repository.GetTrustModel(), func(user *user_model.User) (bool, error) {
-               return models.IsUserRepoAdmin(ctx.Repo.Repository, user)
+               return models.IsOwnerMemberCollaborator(ctx.Repo.Repository, user.ID)
        }, nil); err != nil {
                ctx.ServerError("CalculateTrustStatus", err)
                return

diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 150ace212b32705ed8e105bd63373f9dce28a207..7c6f031907db34e3b80c8a238dbca2f1e03093fc 100644 (file)
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -799,7 +799,7 @@ func renderDirectoryFiles(ctx *context.Context, timeout time.Duration) git.Entri
                verification := asymkey_model.ParseCommitWithSignature(latestCommit)
 
                if err := asymkey_model.CalculateTrustStatus(verification, ctx.Repo.Repository.GetTrustModel(), func(user *user_model.User) (bool, error) {
-                       return models.IsUserRepoAdmin(ctx.Repo.Repository, user)
+                       return models.IsOwnerMemberCollaborator(ctx.Repo.Repository, user.ID)
                }, nil); err != nil {
                        ctx.ServerError("CalculateTrustStatus", err)
                        return nil