issue-545: Enforce repository permissions in patch page

diff --git a/src/main/java/com/gitblit/wicket/pages/PatchPage.java b/src/main/java/com/gitblit/wicket/pages/PatchPage.java
index ece41367ff817173b6a2ac5b20638a1705ebb7c7..bd904e1f75c6cfd6280be0010b8bf694d2dee752 100644 (file)
--- a/src/main/java/com/gitblit/wicket/pages/PatchPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/PatchPage.java
@@ -20,6 +20,8 @@ import org.apache.wicket.markup.html.basic.Label;
 import org.eclipse.jgit.lib.Repository;\r
 import org.eclipse.jgit.revwalk.RevCommit;\r
 \r
+import com.gitblit.models.RepositoryModel;\r
+import com.gitblit.models.UserModel;\r
 import com.gitblit.utils.DiffUtils;\r
 import com.gitblit.utils.JGitUtils;\r
 import com.gitblit.utils.StringUtils;\r
@@ -31,13 +33,12 @@ import com.gitblit.wicket.WicketUtils;
 @CacheControl(LastModified.BOOT)\r
 public class PatchPage extends SessionPage {\r
 \r
-       public PatchPage(PageParameters params) {\r
+       public PatchPage(final PageParameters params) {\r
                super(params);\r
 \r
                if (!params.containsKey("r")) {\r
-                       GitBlitWebSession.get().cacheErrorMessage(getString("gb.repositoryNotSpecified"));\r
+                       error(getString("gb.repositoryNotSpecified"));\r
                        redirectToInterceptPage(new RepositoriesPage());\r
-                       return;\r
                }\r
 \r
                final String repositoryName = WicketUtils.getRepositoryName(params);\r
@@ -45,9 +46,20 @@ public class PatchPage extends SessionPage {
                final String objectId = WicketUtils.getObject(params);\r
                final String blobPath = WicketUtils.getPath(params);\r
 \r
+               GitBlitWebSession session = GitBlitWebSession.get();\r
+               UserModel user = session.getUser();\r
+\r
+               RepositoryModel model = app().repositories().getRepositoryModel(user, repositoryName);\r
+               if (model == null) {\r
+                       // user does not have permission\r
+                       error(getString("gb.canNotLoadRepository") + " " + repositoryName);\r
+                       redirectToInterceptPage(new RepositoriesPage());\r
+                       return;\r
+               }\r
+\r
                Repository r = app().repositories().getRepository(repositoryName);\r
                if (r == null) {\r
-                       GitBlitWebSession.get().cacheErrorMessage(getString("gb.canNotLoadRepository") + " " + repositoryName);\r
+                       error(getString("gb.canNotLoadRepository") + " " + repositoryName);\r
                        redirectToInterceptPage(new RepositoriesPage());\r
                        return;\r
                }\r
@@ -67,4 +79,5 @@ public class PatchPage extends SessionPage {
                add(new Label("patchText", patch));\r
                r.close();\r
        }\r
+\r
 }\r