diff options
| author | Lunny Xiao <xiaolunwen@gmail.com> | 2023-12-12 16:49:00 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-12 16:49:00 +0800 |
| commit | 782414ba8fde9c00b54f3a48cd87689a1d7e3e34 (patch) | |
| tree | 1c1e18dca9b80c63f47f4c218325044c52943154 | |
| parent | 59d88c47b801351d124e69d2beb47260e0f91133 (diff) | |
| download | gitea-release/v1.20.tar.gz gitea-release/v1.20.zip | |
Fix missing check (#28406) (#28413)release/v1.20
backport #28406
| -rw-r--r-- | routers/web/repo/issue_content_history.go | 22 | ||||
| -rw-r--r-- | routers/web/repo/issue_pin.go | 6 |
2 files changed, 24 insertions, 4 deletions
diff --git a/routers/web/repo/issue_content_history.go b/routers/web/repo/issue_content_history.go index b6345e434c..69fcb583ac 100644 --- a/routers/web/repo/issue_content_history.go +++ b/routers/web/repo/issue_content_history.go @@ -189,15 +189,29 @@ func SoftDeleteContentHistory(ctx *context.Context) { var comment *issues_model.Comment var history *issues_model.ContentHistory var err error + + if history, err = issues_model.GetIssueContentHistoryByID(ctx, historyID); err != nil { + log.Error("can not get issue content history %v. err=%v", historyID, err) + return + } + if history.IssueID != issue.ID { + ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{}) + return + } if commentID != 0 { + if history.CommentID != commentID { + ctx.NotFound("CompareCommentID", issues_model.ErrCommentNotExist{}) + return + } + if comment, err = issues_model.GetCommentByID(ctx, commentID); err != nil { log.Error("can not get comment for issue content history %v. err=%v", historyID, err) return } - } - if history, err = issues_model.GetIssueContentHistoryByID(ctx, historyID); err != nil { - log.Error("can not get issue content history %v. err=%v", historyID, err) - return + if comment.IssueID != issue.ID { + ctx.NotFound("CompareIssueID", issues_model.ErrCommentNotExist{}) + return + } } canSoftDelete := canSoftDeleteContentHistory(ctx, issue, comment, history) diff --git a/routers/web/repo/issue_pin.go b/routers/web/repo/issue_pin.go index bbfeaee6e8..6680de32a9 100644 --- a/routers/web/repo/issue_pin.go +++ b/routers/web/repo/issue_pin.go @@ -90,6 +90,12 @@ func IssuePinMove(ctx *context.Context) { return } + if issue.RepoID != ctx.Repo.Repository.ID { + ctx.Status(http.StatusNotFound) + log.Error("Issue does not belong to this repository") + return + } + err = issue.MovePin(ctx, form.Position) if err != nil { ctx.Status(http.StatusInternalServerError) |