diff options
| author | Zettat123 <zettat123@gmail.com> | 2023-09-01 23:35:38 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-01 15:35:38 +0000 |
| commit | 04771b5ff79152a47aecce4b2b445daa4a96da33 (patch) | |
| tree | a707e5a7d6628df849a3883f31df1869da57b154 | |
| parent | 02efd990102481e8d6bd577d4feb874187a00182 (diff) | |
| download | gitea-04771b5ff79152a47aecce4b2b445daa4a96da33.tar.gz gitea-04771b5ff79152a47aecce4b2b445daa4a96da33.zip | |
Allow users with write permissions for issues to add attachments with API (#26837)
Fixes #24944
Since a user with write permissions for issues can add attachments to an
issue via the the web interface, the user should also be able to add
attachments via the API
| -rw-r--r-- | routers/api/v1/repo/issue_attachment.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/routers/api/v1/repo/issue_attachment.go b/routers/api/v1/repo/issue_attachment.go index ad83c206d9..c689e70a08 100644 --- a/routers/api/v1/repo/issue_attachment.go +++ b/routers/api/v1/repo/issue_attachment.go @@ -344,7 +344,7 @@ func getIssueAttachmentSafeRead(ctx *context.APIContext, issue *issues_model.Iss } func canUserWriteIssueAttachment(ctx *context.APIContext, issue *issues_model.Issue) bool { - canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin()) && ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) + canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin() || ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull)) if !canEditIssue { ctx.Error(http.StatusForbidden, "", "user should have permission to write issue") return false |