From: Giteabot <teabot@gitea.io>
Date: Tue, 13 Jun 2023 07:26:47 +0000 (-0400)
Subject: Hide limited users if viewed by anonymous ghost (#25214) (#25224)
X-Git-Tag: v1.19.4~7
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=a9ebf911faefb286d25c3731668740e0b2ed1904;p=gitea.git

Hide limited users if viewed by anonymous ghost (#25214) (#25224)

Backport #25214 by @KN4CK3R

The ghost user leads to inclusion of limited users/orgs in
`BuildCanSeeUserCondition`.

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
---

diff --git a/models/packages/container/search.go b/models/packages/container/search.go
index b65c8634d6..e02aedfc9d 100644
--- a/models/packages/container/search.go
+++ b/models/packages/container/search.go
@@ -271,6 +271,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st
 		cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)})
 	}
 
+	if actor.IsGhost() {
+		actor = nil
+	}
+
 	cond = cond.And(user_model.BuildCanSeeUserCondition(actor))
 
 	sess := db.GetEngine(ctx).