diff options
| author | Manush Dodunekov <manush@stendahls.se> | 2020-01-13 19:33:46 +0200 |
|---|---|---|
| committer | Antoine GIRARD <sapk@users.noreply.github.com> | 2020-01-13 18:33:46 +0100 |
| commit | 1751d5fcf200b7d78ec5543fa620174c69d2746a (patch) | |
| tree | dfc9584c2c60ede1fcef436de02dc66d28fd9647 /models/org.go | |
| parent | 0b3aaa61964faa85b8008b04487388cc362ab436 (diff) | |
| download | gitea-1751d5fcf200b7d78ec5543fa620174c69d2746a.tar.gz gitea-1751d5fcf200b7d78ec5543fa620174c69d2746a.zip | |
Restricted users (#6274)
* Restricted users (#4334): initial implementation
* Add User.IsRestricted & UI to edit it
* Pass user object instead of user id to places where IsRestricted flag matters
* Restricted users: maintain access rows for all referenced repos (incl public)
* Take logged in user & IsRestricted flag into account in org/repo listings, searches and accesses
* Add basic repo access tests for restricted users
Signed-off-by: Manush Dodunekov <manush@stendahls.se>
* Mention restricted users in the faq
Signed-off-by: Manush Dodunekov <manush@stendahls.se>
* Revert unnecessary change `.isUserPartOfOrg` -> `.IsUserPartOfOrg`
Signed-off-by: Manush Dodunekov <manush@stendahls.se>
* Remove unnecessary `org.IsOrganization()` call
Signed-off-by: Manush Dodunekov <manush@stendahls.se>
* Revert to an `int64` keyed `accessMap`
* Add type `userAccess`
* Add convenience func updateUserAccess()
* Turn accessMap into a `map[int64]userAccess`
Signed-off-by: Manush Dodunekov <manush@stendahls.se>
* or even better: `map[int64]*userAccess`
* updateUserAccess(): use tighter syntax as suggested by lafriks
* even tighter
* Avoid extra loop
* Don't disclose limited orgs to unauthenticated users
* Don't assume block only applies to orgs
* Use an array of `VisibleType` for filtering
* fix yet another thinko
* Ok - no need for u
* Revert "Ok - no need for u"
This reverts commit 5c3e886aabd5acd997a3b35687d322439732c200.
Co-authored-by: Antoine GIRARD <sapk@users.noreply.github.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
Diffstat (limited to 'models/org.go')
| -rw-r--r-- | models/org.go | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/models/org.go b/models/org.go index dbc71761f2..d79c0db84e 100644 --- a/models/org.go +++ b/models/org.go @@ -432,7 +432,7 @@ func hasOrgVisible(e Engine, org *User, user *User) bool { return true } - if org.Visibility == structs.VisibleTypePrivate && !org.isUserPartOfOrg(e, user.ID) { + if (org.Visibility == structs.VisibleTypePrivate || user.IsRestricted) && !org.isUserPartOfOrg(e, user.ID) { return false } return true @@ -735,7 +735,7 @@ type AccessibleReposEnvironment interface { type accessibleReposEnv struct { org *User - userID int64 + user *User teamIDs []int64 e Engine keyword string @@ -749,13 +749,23 @@ func (org *User) AccessibleReposEnv(userID int64) (AccessibleReposEnvironment, e } func (org *User) accessibleReposEnv(e Engine, userID int64) (AccessibleReposEnvironment, error) { + var user *User + + if userID > 0 { + u, err := getUserByID(e, userID) + if err != nil { + return nil, err + } + user = u + } + teamIDs, err := org.getUserTeamIDs(e, userID) if err != nil { return nil, err } return &accessibleReposEnv{ org: org, - userID: userID, + user: user, teamIDs: teamIDs, e: e, orderBy: SearchOrderByRecentUpdated, @@ -763,9 +773,12 @@ func (org *User) accessibleReposEnv(e Engine, userID int64) (AccessibleReposEnvi } func (env *accessibleReposEnv) cond() builder.Cond { - var cond builder.Cond = builder.Eq{ - "`repository`.owner_id": env.org.ID, - "`repository`.is_private": false, + var cond = builder.NewCond() + if env.user == nil || !env.user.IsRestricted { + cond = cond.Or(builder.Eq{ + "`repository`.owner_id": env.org.ID, + "`repository`.is_private": false, + }) } if len(env.teamIDs) > 0 { cond = cond.Or(builder.In("team_repo.team_id", env.teamIDs)) |