diff options
| author | 6543 <m.huber@kithara.com> | 2023-11-13 23:30:24 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-13 16:30:24 -0600 |
| commit | c6366089df8390bc1f017006caaf4d4c69825880 (patch) | |
| tree | 7c19470631044c41cf433bffa3355a814e23c90e | |
| parent | 089ac06969030b0886d4e20bf8f7a757f785f158 (diff) | |
| download | gitea-c6366089df8390bc1f017006caaf4d4c69825880.tar.gz gitea-c6366089df8390bc1f017006caaf4d4c69825880.zip | |
Dont leak private users via extensions (#28023)
| -rw-r--r-- | routers/web/user/home.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/routers/web/user/home.go b/routers/web/user/home.go index 8b9a4cd224..db3778d9e1 100644 --- a/routers/web/user/home.go +++ b/routers/web/user/home.go @@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) { reloadParam := func(suffix string) (success bool) { ctx.SetParams("username", strings.TrimSuffix(username, suffix)) context_service.UserAssignmentWeb()(ctx) + // check view permissions + if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) { + ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name)) + return false + } return !ctx.Written() } switch { |