And there is another one ... (#13350)

Signed-off-by: Andrew Thornton <art27@cantab.net>

diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go
index 4ac6439d1ba1d66be01cb75567c1652d61e7ab38..596c4908273c454a56001c1ca0a539de6556f67b 100644 (file)
--- a/routers/api/v1/repo/issue_reaction.go
+++ b/routers/api/v1/repo/issue_reaction.go
@@ -56,7 +56,11 @@ func GetIssueCommentReactions(ctx *context.APIContext) {
                return
        }
 
-       if !ctx.Repo.CanRead(models.UnitTypeIssues) {
+       if err := comment.LoadIssue(); err != nil {
+               ctx.Error(http.StatusInternalServerError, "comment.LoadIssue", err)
+       }
+
+       if !ctx.Repo.CanReadIssuesOrPulls(comment.Issue.IsPull) {
                ctx.Error(http.StatusForbidden, "GetIssueCommentReactions", errors.New("no permission to get reactions"))
                return
        }