BugFix: updateLabel can updated not allowed fields #11242 (#11242)

3 files changed, 16 insertions, 9 deletions

diff --git a/models/issue.go b/models/issue.go
index de7ac8c9f0..1a17f1b4a3 100644
--- a/models/issue.go
+++ b/models/issue.go
@@ -609,7 +609,7 @@ func (issue *Issue) changeStatus(e *xorm.Session, doer *User, isClosed, isMergeP
 		return nil, err
 	}
 	for idx := range issue.Labels {
-		if err = updateLabel(e, issue.Labels[idx]); err != nil {
+		if err = updateLabelCols(e, issue.Labels[idx], "num_issues", "num_closed_issue"); err != nil {
 			return nil, err
 		}
 	}
diff --git a/models/issue_label.go b/models/issue_label.go
index cb9c307e2b..aa2c8de009 100644
--- a/models/issue_label.go
+++ b/models/issue_label.go
@@ -246,7 +246,7 @@ func UpdateLabel(l *Label) error {
 	if !LabelColorPattern.MatchString(l.Color) {
 		return fmt.Errorf("bad color code: %s", l.Color)
 	}
-	return updateLabel(x, l)
+	return updateLabelCols(x, l, "name", "description", "color")
 }
 
 // DeleteLabel delete a label
@@ -587,7 +587,7 @@ func GetLabelsByIssueID(issueID int64) ([]*Label, error) {
 	return getLabelsByIssueID(x, issueID)
 }
 
-func updateLabel(e Engine, l *Label) error {
+func updateLabelCols(e Engine, l *Label, cols ...string) error {
 	_, err := e.ID(l.ID).
 		SetExpr("num_issues",
 			builder.Select("count(*)").From("issue_label").
@@ -601,7 +601,7 @@ func updateLabel(e Engine, l *Label) error {
 					"issue.is_closed":      true,
 				}),
 		).
-		AllCols().Update(l)
+		Cols(cols...).Update(l)
 	return err
 }
 
@@ -653,7 +653,7 @@ func newIssueLabel(e *xorm.Session, issue *Issue, label *Label, doer *User) (err
 		return err
 	}
 
-	return updateLabel(e, label)
+	return updateLabelCols(e, label, "num_issues", "num_closed_issue")
 }
 
 // NewIssueLabel creates a new issue-label relation.
@@ -729,7 +729,7 @@ func deleteIssueLabel(e *xorm.Session, issue *Issue, label *Label, doer *User) (
 		return err
 	}
 
-	return updateLabel(e, label)
+	return updateLabelCols(e, label, "num_issues", "num_closed_issue")
 }
 
 // DeleteIssueLabel deletes issue-label relation.
diff --git a/models/issue_label_test.go b/models/issue_label_test.go
index 8afba779e0..982f6b165a 100644
--- a/models/issue_label_test.go
+++ b/models/issue_label_test.go
@@ -252,9 +252,16 @@ func TestGetLabelsByIssueID(t *testing.T) {
 func TestUpdateLabel(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
 	label := AssertExistsAndLoadBean(t, &Label{ID: 1}).(*Label)
-	label.Color = "#ffff00"
-	label.Name = "newLabelName"
-	assert.NoError(t, UpdateLabel(label))
+	// make sure update wont overwrite it
+	update := &Label{
+		ID:          label.ID,
+		Color:       "#ffff00",
+		Name:        "newLabelName",
+		Description: label.Description,
+	}
+	label.Color = update.Color
+	label.Name = update.Name
+	assert.NoError(t, UpdateLabel(update))
 	newLabel := AssertExistsAndLoadBean(t, &Label{ID: 1}).(*Label)
 	assert.Equal(t, *label, *newLabel)
 	CheckConsistencyFor(t, &Label{}, &Repository{})