diff options
| author | KN4CK3R <admin@oldschoolhack.me> | 2022-11-20 20:37:20 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-20 19:37:20 +0000 |
| commit | b2369830bbb9059301011ca41802e76bfc2739c1 (patch) | |
| tree | f3d14f4edbe6f389a11e60d4863813d08bcc6661 /models | |
| parent | ef08998bf6711f696524c7ed5fadc8949458a8ed (diff) | |
| download | gitea-b2369830bbb9059301011ca41802e76bfc2739c1.tar.gz gitea-b2369830bbb9059301011ca41802e76bfc2739c1.zip | |
Do not allow Ghost access to limited visible user/org (#21849) (#21876)
Backport of #21849
Diffstat (limited to 'models')
| -rw-r--r-- | models/organization/org.go | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/models/organization/org.go b/models/organization/org.go index 993ca3f10d..217fa623bf 100644 --- a/models/organization/org.go +++ b/models/organization/org.go @@ -458,8 +458,9 @@ func CountOrgs(opts FindOrgOptions) (int64, error) { // HasOrgOrUserVisible tells if the given user can see the given org or user func HasOrgOrUserVisible(ctx context.Context, orgOrUser, user *user_model.User) bool { - // Not SignedUser - if user == nil { + // If user is nil, it's an anonymous user/request. + // The Ghost user is handled like an anonymous user. + if user == nil || user.IsGhost() { return orgOrUser.Visibility == structs.VisibleTypePublic } |