From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Mon, 12 Dec 2022 19:59:28 +0000 (+0800)
Subject: Fix permission check on issue/pull lock (#22114)
X-Git-Tag: v1.17.4~10
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=a8534ac4a4ff5d27479ed1f1d079d8fa54986711;p=gitea.git

Fix permission check on issue/pull lock (#22114)

Fix #22110
---

diff --git a/routers/web/web.go b/routers/web/web.go
index e4fea38244..3bcbc6d7c0 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -599,7 +599,6 @@ func RegisterRoutes(m *web.Route) {
 	reqRepoReleaseWriter := context.RequireRepoWriter(unit.TypeReleases)
 	reqRepoReleaseReader := context.RequireRepoReader(unit.TypeReleases)
 	reqRepoWikiWriter := context.RequireRepoWriter(unit.TypeWiki)
-	reqRepoIssueWriter := context.RequireRepoWriter(unit.TypeIssues)
 	reqRepoIssueReader := context.RequireRepoReader(unit.TypeIssues)
 	reqRepoPullsReader := context.RequireRepoReader(unit.TypePullRequests)
 	reqRepoIssuesOrPullsWriter := context.RequireRepoWriterOr(unit.TypeIssues, unit.TypePullRequests)
@@ -893,8 +892,8 @@ func RegisterRoutes(m *web.Route) {
 					})
 				})
 				m.Post("/reactions/{action}", bindIgnErr(forms.ReactionForm{}), repo.ChangeIssueReaction)
-				m.Post("/lock", reqRepoIssueWriter, bindIgnErr(forms.IssueLockForm{}), repo.LockIssue)
-				m.Post("/unlock", reqRepoIssueWriter, repo.UnlockIssue)
+				m.Post("/lock", reqRepoIssuesOrPullsWriter, bindIgnErr(forms.IssueLockForm{}), repo.LockIssue)
+				m.Post("/unlock", reqRepoIssuesOrPullsWriter, repo.UnlockIssue)
 				m.Post("/delete", reqRepoAdmin, repo.DeleteIssue)
 			}, context.RepoMustNotBeArchived())
 			m.Group("/{index}", func() {