diff options
| author | a1012112796 <1012112796@qq.com> | 2023-01-28 17:28:55 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-01-28 17:28:55 +0800 |
| commit | 48f5d519088c2b33b48eb35f6ef3261e3ec677a1 (patch) | |
| tree | ee1061a6b129d2e5d889b7a372c8270e1c55aa61 | |
| parent | 95d9fbdcf39db7595a23a69ca48bfb49b845874a (diff) | |
| download | gitea-48f5d519088c2b33b48eb35f6ef3261e3ec677a1.tar.gz gitea-48f5d519088c2b33b48eb35f6ef3261e3ec677a1.zip | |
fix permission check for creating comment while mail (#22524)
only creating comment on locked issue request write permission,
for others, read permission is enough.
related to https://github.com/go-gitea/gitea/pull/22056
/cc @KN4CK3R
---------
Signed-off-by: a1012112796 <1012112796@qq.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
| -rw-r--r-- | services/mailer/incoming/incoming_handler.go | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/services/mailer/incoming/incoming_handler.go b/services/mailer/incoming/incoming_handler.go index 173b362a55..d89a5eab3d 100644 --- a/services/mailer/incoming/incoming_handler.go +++ b/services/mailer/incoming/incoming_handler.go @@ -71,11 +71,17 @@ func (h *ReplyHandler) Handle(ctx context.Context, content *MailContent, doer *u return err } - if !perm.CanWriteIssuesOrPulls(issue.IsPull) || issue.IsLocked && !doer.IsAdmin { + // Locked issues require write permissions + if issue.IsLocked && !perm.CanWriteIssuesOrPulls(issue.IsPull) && !doer.IsAdmin { log.Debug("can't write issue or pull") return nil } + if !perm.CanReadIssuesOrPulls(issue.IsPull) { + log.Debug("can't read issue or pull") + return nil + } + switch r := ref.(type) { case *issues_model.Issue: attachmentIDs := make([]string, 0, len(content.Attachments)) |