diff options
| author | zeripath <art27@cantab.net> | 2021-03-12 17:45:49 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-12 18:45:49 +0100 |
| commit | 42b9b46ad22840966ecac70ae4e319c49fda3d7e (patch) | |
| tree | 783581b00b102d6795a57f0c07dac6bd18f42b0e /models/issue.go | |
| parent | ccfb205ad126ac6fa3490e43a8075947e05a731a (diff) | |
| download | gitea-42b9b46ad22840966ecac70ae4e319c49fda3d7e.tar.gz gitea-42b9b46ad22840966ecac70ae4e319c49fda3d7e.zip | |
Never add labels not from this repository or organisation and remove org labels on transfer (#14928)
* Never add labels not from this repository or organisation and remove org labels on transfer
Prevent the addition of labels from outside of the repository or
organisation and remove organisation labels on transfer.
Related #14908
* switch to use sql
* subquery alias
* once more around the merry go round
* fix api problem
Diffstat (limited to 'models/issue.go')
| -rw-r--r-- | models/issue.go | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/models/issue.go b/models/issue.go index 1b634ed9e8..3a7a0cd41a 100644 --- a/models/issue.go +++ b/models/issue.go @@ -513,6 +513,10 @@ func (issue *Issue) ReplaceLabels(labels []*Label, doer *User) (err error) { return err } + if err = issue.loadRepo(sess); err != nil { + return err + } + if err = issue.loadLabels(sess); err != nil { return err } @@ -527,10 +531,18 @@ func (issue *Issue) ReplaceLabels(labels []*Label, doer *User) (err error) { addLabel := labels[addIndex] removeLabel := issue.Labels[removeIndex] if addLabel.ID == removeLabel.ID { + // Silently drop invalid labels + if removeLabel.RepoID != issue.RepoID && removeLabel.OrgID != issue.Repo.OwnerID { + toRemove = append(toRemove, removeLabel) + } + addIndex++ removeIndex++ } else if addLabel.ID < removeLabel.ID { - toAdd = append(toAdd, addLabel) + // Only add if the label is valid + if addLabel.RepoID == issue.RepoID || addLabel.OrgID == issue.Repo.OwnerID { + toAdd = append(toAdd, addLabel) + } addIndex++ } else { toRemove = append(toRemove, removeLabel) |