Dont leak private users via extensions (#28023) (#28029)

Backport #28023 by @6543

there was no check in place if a user could see a other user, if you
append e.g. `.rss`

diff --git a/routers/web/user/home.go b/routers/web/user/home.go
index 76b9262eada5cad6ab58e98d16983264c9caf690..d0d24d7ed1031d3a8374bd45a32af7de41e863e9 100644 (file)
--- a/routers/web/user/home.go
+++ b/routers/web/user/home.go
@@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) {
        reloadParam := func(suffix string) (success bool) {
                ctx.SetParams("username", strings.TrimSuffix(username, suffix))
                context_service.UserAssignmentWeb()(ctx)
+               // check view permissions
+               if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
+                       ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name))
+                       return false
+               }
                return !ctx.Written()
        }
        switch {