diff options
| author | Zettat123 <zettat123@gmail.com> | 2023-09-01 23:35:38 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-01 15:35:38 +0000 |
| commit | 04771b5ff79152a47aecce4b2b445daa4a96da33 (patch) | |
| tree | a707e5a7d6628df849a3883f31df1869da57b154 /routers/api | |
| parent | 02efd990102481e8d6bd577d4feb874187a00182 (diff) | |
| download | gitea-04771b5ff79152a47aecce4b2b445daa4a96da33.tar.gz gitea-04771b5ff79152a47aecce4b2b445daa4a96da33.zip | |
Allow users with write permissions for issues to add attachments with API (#26837)
Fixes #24944
Since a user with write permissions for issues can add attachments to an
issue via the the web interface, the user should also be able to add
attachments via the API
Diffstat (limited to 'routers/api')
| -rw-r--r-- | routers/api/v1/repo/issue_attachment.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/routers/api/v1/repo/issue_attachment.go b/routers/api/v1/repo/issue_attachment.go index ad83c206d9..c689e70a08 100644 --- a/routers/api/v1/repo/issue_attachment.go +++ b/routers/api/v1/repo/issue_attachment.go @@ -344,7 +344,7 @@ func getIssueAttachmentSafeRead(ctx *context.APIContext, issue *issues_model.Iss } func canUserWriteIssueAttachment(ctx *context.APIContext, issue *issues_model.Issue) bool { - canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin()) && ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) + canEditIssue := ctx.IsSigned && (ctx.Doer.ID == issue.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin() || ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull)) if !canEditIssue { ctx.Error(http.StatusForbidden, "", "user should have permission to write issue") return false |