Make `owner/repo/pulls` handlers use "PR reader" permission (#32254)

Fix #32253 (partially)

diff --git a/routers/web/web.go b/routers/web/web.go
index 80399ec499c50af4234e1b140bc0fabbb3c91c8e..f28ec82c8f0b83b3d741246edf9c72bf3939b7c5 100644 (file)
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1461,6 +1461,35 @@ func registerRoutes(m *web.Router) {
        )
        // end "/{username}/{reponame}/activity"
 
+       m.Group("/{username}/{reponame}", func() {
+               m.Group("/pulls/{index}", func() {
+                       m.Get("", repo.SetWhitespaceBehavior, repo.GetPullDiffStats, repo.ViewIssue)
+                       m.Get(".diff", repo.DownloadPullDiff)
+                       m.Get(".patch", repo.DownloadPullPatch)
+                       m.Group("/commits", func() {
+                               m.Get("", context.RepoRef(), repo.SetWhitespaceBehavior, repo.GetPullDiffStats, repo.ViewPullCommits)
+                               m.Get("/list", context.RepoRef(), repo.GetPullCommits)
+                               m.Get("/{sha:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForSingleCommit)
+                       })
+                       m.Post("/merge", context.RepoMustNotBeArchived(), web.Bind(forms.MergePullRequestForm{}), repo.MergePullRequest)
+                       m.Post("/cancel_auto_merge", context.RepoMustNotBeArchived(), repo.CancelAutoMergePullRequest)
+                       m.Post("/update", repo.UpdatePullRequest)
+                       m.Post("/set_allow_maintainer_edit", web.Bind(forms.UpdateAllowEditsForm{}), repo.SetAllowEdits)
+                       m.Post("/cleanup", context.RepoMustNotBeArchived(), context.RepoRef(), repo.CleanUpPullRequest)
+                       m.Group("/files", func() {
+                               m.Get("", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForAllCommitsOfPr)
+                               m.Get("/{sha:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesStartingFromCommit)
+                               m.Get("/{shaFrom:[a-f0-9]{7,40}}..{shaTo:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForRange)
+                               m.Group("/reviews", func() {
+                                       m.Get("/new_comment", repo.RenderNewCodeCommentForm)
+                                       m.Post("/comments", web.Bind(forms.CodeCommentForm{}), repo.SetShowOutdatedComments, repo.CreateCodeComment)
+                                       m.Post("/submit", web.Bind(forms.SubmitReviewForm{}), repo.SubmitReview)
+                               }, context.RepoMustNotBeArchived())
+                       })
+               })
+       }, ignSignIn, context.RepoAssignment, repo.MustAllowPulls, reqRepoPullsReader)
+       // end "/{username}/{reponame}/pulls/{index}": repo pull request
+
        m.Group("/{username}/{reponame}", func() {
                m.Group("/activity_author_data", func() {
                        m.Get("", repo.ActivityAuthors)
@@ -1499,32 +1528,6 @@ func registerRoutes(m *web.Router) {
                        return cancel
                })
 
-               m.Group("/pulls/{index}", func() {
-                       m.Get("", repo.SetWhitespaceBehavior, repo.GetPullDiffStats, repo.ViewIssue)
-                       m.Get(".diff", repo.DownloadPullDiff)
-                       m.Get(".patch", repo.DownloadPullPatch)
-                       m.Group("/commits", func() {
-                               m.Get("", context.RepoRef(), repo.SetWhitespaceBehavior, repo.GetPullDiffStats, repo.ViewPullCommits)
-                               m.Get("/list", context.RepoRef(), repo.GetPullCommits)
-                               m.Get("/{sha:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForSingleCommit)
-                       })
-                       m.Post("/merge", context.RepoMustNotBeArchived(), web.Bind(forms.MergePullRequestForm{}), repo.MergePullRequest)
-                       m.Post("/cancel_auto_merge", context.RepoMustNotBeArchived(), repo.CancelAutoMergePullRequest)
-                       m.Post("/update", repo.UpdatePullRequest)
-                       m.Post("/set_allow_maintainer_edit", web.Bind(forms.UpdateAllowEditsForm{}), repo.SetAllowEdits)
-                       m.Post("/cleanup", context.RepoMustNotBeArchived(), context.RepoRef(), repo.CleanUpPullRequest)
-                       m.Group("/files", func() {
-                               m.Get("", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForAllCommitsOfPr)
-                               m.Get("/{sha:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesStartingFromCommit)
-                               m.Get("/{shaFrom:[a-f0-9]{7,40}}..{shaTo:[a-f0-9]{7,40}}", context.RepoRef(), repo.SetEditorconfigIfExists, repo.SetDiffViewStyle, repo.SetWhitespaceBehavior, repo.SetShowOutdatedComments, repo.ViewPullFilesForRange)
-                               m.Group("/reviews", func() {
-                                       m.Get("/new_comment", repo.RenderNewCodeCommentForm)
-                                       m.Post("/comments", web.Bind(forms.CodeCommentForm{}), repo.SetShowOutdatedComments, repo.CreateCodeComment)
-                                       m.Post("/submit", web.Bind(forms.SubmitReviewForm{}), repo.SubmitReview)
-                               }, context.RepoMustNotBeArchived())
-                       })
-               }, repo.MustAllowPulls)
-
                m.Group("/media", func() {
                        m.Get("/branch/*", context.RepoRefByType(context.RepoRefBranch), repo.SingleDownloadOrLFS)
                        m.Get("/tag/*", context.RepoRefByType(context.RepoRefTag), repo.SingleDownloadOrLFS)