Add API management for issue/pull and comment attachments (#21783)

Close #14601
Fix #3690

Revive of #14601.
Updated to current code, cleanup and added more read/write checks.

Signed-off-by: Andrew Thornton <art27@cantab.net>
Signed-off-by: Andre Bruch <ab@andrebruch.com>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Norwin <git@nroo.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

7 files changed, 82 insertions, 60 deletions

diff --git a/modules/convert/attachment.go b/modules/convert/attachment.go
new file mode 100644
index 0000000000..ddba181a12
--- /dev/null
+++ b/modules/convert/attachment.go
@@ -0,0 +1,30 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package convert
+
+import (
+	repo_model "code.gitea.io/gitea/models/repo"
+	api "code.gitea.io/gitea/modules/structs"
+)
+
+// ToAttachment converts models.Attachment to api.Attachment
+func ToAttachment(a *repo_model.Attachment) *api.Attachment {
+	return &api.Attachment{
+		ID:            a.ID,
+		Name:          a.Name,
+		Created:       a.CreatedUnix.AsTime(),
+		DownloadCount: a.DownloadCount,
+		Size:          a.Size,
+		UUID:          a.UUID,
+		DownloadURL:   a.DownloadURL(),
+	}
+}
+
+func ToAttachments(attachments []*repo_model.Attachment) []*api.Attachment {
+	converted := make([]*api.Attachment, 0, len(attachments))
+	for _, attachment := range attachments {
+		converted = append(converted, ToAttachment(attachment))
+	}
+	return converted
+}
diff --git a/modules/convert/issue.go b/modules/convert/issue.go
index 3bc1006507..f3af03ed94 100644
--- a/modules/convert/issue.go
+++ b/modules/convert/issue.go
@@ -37,20 +37,21 @@ func ToAPIIssue(ctx context.Context, issue *issues_model.Issue) *api.Issue {
 	}
 
 	apiIssue := &api.Issue{
-		ID:       issue.ID,
-		URL:      issue.APIURL(),
-		HTMLURL:  issue.HTMLURL(),
-		Index:    issue.Index,
-		Poster:   ToUser(issue.Poster, nil),
-		Title:    issue.Title,
-		Body:     issue.Content,
-		Ref:      issue.Ref,
-		Labels:   ToLabelList(issue.Labels, issue.Repo, issue.Repo.Owner),
-		State:    issue.State(),
-		IsLocked: issue.IsLocked,
-		Comments: issue.NumComments,
-		Created:  issue.CreatedUnix.AsTime(),
-		Updated:  issue.UpdatedUnix.AsTime(),
+		ID:          issue.ID,
+		URL:         issue.APIURL(),
+		HTMLURL:     issue.HTMLURL(),
+		Index:       issue.Index,
+		Poster:      ToUser(issue.Poster, nil),
+		Title:       issue.Title,
+		Body:        issue.Content,
+		Attachments: ToAttachments(issue.Attachments),
+		Ref:         issue.Ref,
+		Labels:      ToLabelList(issue.Labels, issue.Repo, issue.Repo.Owner),
+		State:       issue.State(),
+		IsLocked:    issue.IsLocked,
+		Comments:    issue.NumComments,
+		Created:     issue.CreatedUnix.AsTime(),
+		Updated:     issue.UpdatedUnix.AsTime(),
 	}
 
 	apiIssue.Repo = &api.RepositoryMeta{
diff --git a/modules/convert/issue_comment.go b/modules/convert/issue_comment.go
index c4fed6b8a1..983354438a 100644
--- a/modules/convert/issue_comment.go
+++ b/modules/convert/issue_comment.go
@@ -16,14 +16,15 @@ import (
 // ToComment converts a issues_model.Comment to the api.Comment format
 func ToComment(c *issues_model.Comment) *api.Comment {
 	return &api.Comment{
-		ID:       c.ID,
-		Poster:   ToUser(c.Poster, nil),
-		HTMLURL:  c.HTMLURL(),
-		IssueURL: c.IssueURL(),
-		PRURL:    c.PRURL(),
-		Body:     c.Content,
-		Created:  c.CreatedUnix.AsTime(),
-		Updated:  c.UpdatedUnix.AsTime(),
+		ID:          c.ID,
+		Poster:      ToUser(c.Poster, nil),
+		HTMLURL:     c.HTMLURL(),
+		IssueURL:    c.IssueURL(),
+		PRURL:       c.PRURL(),
+		Body:        c.Content,
+		Attachments: ToAttachments(c.Attachments),
+		Created:     c.CreatedUnix.AsTime(),
+		Updated:     c.UpdatedUnix.AsTime(),
 	}
 }
 
diff --git a/modules/convert/release.go b/modules/convert/release.go
index 95c6d03ab1..3afa53c03f 100644
--- a/modules/convert/release.go
+++ b/modules/convert/release.go
@@ -10,10 +10,6 @@ import (
 
 // ToRelease convert a repo_model.Release to api.Release
 func ToRelease(r *repo_model.Release) *api.Release {
-	assets := make([]*api.Attachment, 0)
-	for _, att := range r.Attachments {
-		assets = append(assets, ToReleaseAttachment(att))
-	}
 	return &api.Release{
 		ID:           r.ID,
 		TagName:      r.TagName,
@@ -29,19 +25,6 @@ func ToRelease(r *repo_model.Release) *api.Release {
 		CreatedAt:    r.CreatedUnix.AsTime(),
 		PublishedAt:  r.CreatedUnix.AsTime(),
 		Publisher:    ToUser(r.Publisher, nil),
-		Attachments:  assets,
-	}
-}
-
-// ToReleaseAttachment converts models.Attachment to api.Attachment
-func ToReleaseAttachment(a *repo_model.Attachment) *api.Attachment {
-	return &api.Attachment{
-		ID:            a.ID,
-		Name:          a.Name,
-		Created:       a.CreatedUnix.AsTime(),
-		DownloadCount: a.DownloadCount,
-		Size:          a.Size,
-		UUID:          a.UUID,
-		DownloadURL:   a.DownloadURL(),
+		Attachments:  ToAttachments(r.Attachments),
 	}
 }
diff --git a/modules/notification/webhook/webhook.go b/modules/notification/webhook/webhook.go
index 6334583058..cf056f54c1 100644
--- a/modules/notification/webhook/webhook.go
+++ b/modules/notification/webhook/webhook.go
@@ -314,6 +314,11 @@ func (m *webhookNotifier) NotifyNewPullRequest(ctx context.Context, pull *issues
 }
 
 func (m *webhookNotifier) NotifyIssueChangeContent(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, oldContent string) {
+	if err := issue.LoadRepo(ctx); err != nil {
+		log.Error("LoadRepo: %v", err)
+		return
+	}
+
 	mode, _ := access_model.AccessLevel(ctx, issue.Poster, issue.Repo)
 	var err error
 	if issue.IsPull {
diff --git a/modules/structs/issue.go b/modules/structs/issue.go
index 00166b7a07..48e4e0e7e3 100644
--- a/modules/structs/issue.go
+++ b/modules/structs/issue.go
@@ -41,18 +41,19 @@ type RepositoryMeta struct {
 // Issue represents an issue in a repository
 // swagger:model
 type Issue struct {
-	ID               int64      `json:"id"`
-	URL              string     `json:"url"`
-	HTMLURL          string     `json:"html_url"`
-	Index            int64      `json:"number"`
-	Poster           *User      `json:"user"`
-	OriginalAuthor   string     `json:"original_author"`
-	OriginalAuthorID int64      `json:"original_author_id"`
-	Title            string     `json:"title"`
-	Body             string     `json:"body"`
-	Ref              string     `json:"ref"`
-	Labels           []*Label   `json:"labels"`
-	Milestone        *Milestone `json:"milestone"`
+	ID               int64         `json:"id"`
+	URL              string        `json:"url"`
+	HTMLURL          string        `json:"html_url"`
+	Index            int64         `json:"number"`
+	Poster           *User         `json:"user"`
+	OriginalAuthor   string        `json:"original_author"`
+	OriginalAuthorID int64         `json:"original_author_id"`
+	Title            string        `json:"title"`
+	Body             string        `json:"body"`
+	Ref              string        `json:"ref"`
+	Attachments      []*Attachment `json:"assets"`
+	Labels           []*Label      `json:"labels"`
+	Milestone        *Milestone    `json:"milestone"`
 	// deprecated
 	Assignee  *User   `json:"assignee"`
 	Assignees []*User `json:"assignees"`
diff --git a/modules/structs/issue_comment.go b/modules/structs/issue_comment.go
index 4a1085ba50..9e8f5c4bf3 100644
--- a/modules/structs/issue_comment.go
+++ b/modules/structs/issue_comment.go
@@ -9,14 +9,15 @@ import (
 
 // Comment represents a comment on a commit or issue
 type Comment struct {
-	ID               int64  `json:"id"`
-	HTMLURL          string `json:"html_url"`
-	PRURL            string `json:"pull_request_url"`
-	IssueURL         string `json:"issue_url"`
-	Poster           *User  `json:"user"`
-	OriginalAuthor   string `json:"original_author"`
-	OriginalAuthorID int64  `json:"original_author_id"`
-	Body             string `json:"body"`
+	ID               int64         `json:"id"`
+	HTMLURL          string        `json:"html_url"`
+	PRURL            string        `json:"pull_request_url"`
+	IssueURL         string        `json:"issue_url"`
+	Poster           *User         `json:"user"`
+	OriginalAuthor   string        `json:"original_author"`
+	OriginalAuthorID int64         `json:"original_author_id"`
+	Body             string        `json:"body"`
+	Attachments      []*Attachment `json:"assets"`
 	// swagger:strfmt date-time
 	Created time.Time `json:"created_at"`
 	// swagger:strfmt date-time