diff options
| author | Cirno the Strongest <1447794+CirnoT@users.noreply.github.com> | 2020-05-29 16:47:17 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-05-29 15:47:17 +0100 |
| commit | 02fa329a7c2190d947cd5e02ea90d2d4406653be (patch) | |
| tree | 518834752a39393c0bb09391e12f69c1b14d54cc /routers/repo | |
| parent | 0d9f9f7de195a22db714ec872877f7722b6c1db0 (diff) | |
| download | gitea-02fa329a7c2190d947cd5e02ea90d2d4406653be.tar.gz gitea-02fa329a7c2190d947cd5e02ea90d2d4406653be.zip | |
Fix missing authorization check on pull for public repos of private/limited org (#11656)
Fixes #11651
Diffstat (limited to 'routers/repo')
| -rw-r--r-- | routers/repo/http.go | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/routers/repo/http.go b/routers/repo/http.go index 650642a581..1eec033882 100644 --- a/routers/repo/http.go +++ b/routers/repo/http.go @@ -29,6 +29,7 @@ import ( "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/process" "code.gitea.io/gitea/modules/setting" + "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/modules/timeutil" repo_service "code.gitea.io/gitea/services/repository" ) @@ -135,6 +136,16 @@ func HTTP(ctx *context.Context) { environ []string ) + // don't allow anonymous pulls if organization is not public + if isPublicPull { + if err := repo.GetOwner(); err != nil { + ctx.ServerError("GetOwner", err) + return + } + + askAuth = askAuth || (repo.Owner.Visibility != structs.VisibleTypePublic) + } + // check access if askAuth { authUsername = ctx.Req.Header.Get(setting.ReverseProxyAuthUser) |