Fix missing authorization check on pull for public repos of private/limited org ...

Fixes #11651

(cherry picked from commit 02fa329a7c2190d947cd5e02ea90d2d4406653be)

diff --git a/routers/repo/http.go b/routers/repo/http.go
index 9c0834e5c3fa622f93e8e20da01dc4e360177f99..0c746e311e56e3412cd495627953c09d1f2650f8 100644 (file)
--- a/routers/repo/http.go
+++ b/routers/repo/http.go
@@ -29,6 +29,7 @@ import (
        "code.gitea.io/gitea/modules/log"
        "code.gitea.io/gitea/modules/process"
        "code.gitea.io/gitea/modules/setting"
+       "code.gitea.io/gitea/modules/structs"
        "code.gitea.io/gitea/modules/timeutil"
        repo_service "code.gitea.io/gitea/services/repository"
 )
@@ -135,6 +136,16 @@ func HTTP(ctx *context.Context) {
                environ      []string
        )
 
+       // don't allow anonymous pulls if organization is not public
+       if isPublicPull {
+               if err := repo.GetOwner(); err != nil {
+                       ctx.ServerError("GetOwner", err)
+                       return
+               }
+
+               askAuth = askAuth || (repo.Owner.Visibility != structs.VisibleTypePublic)
+       }
+
        // check access
        if askAuth {
                authUsername = ctx.Req.Header.Get(setting.ReverseProxyAuthUser)