diff options
| author | zeripath <art27@cantab.net> | 2022-01-26 22:09:07 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-01-26 22:09:07 +0000 |
| commit | cada7202aa0e5766eb770f7d5c95e8483386adf1 (patch) | |
| tree | 3ae727540403daba475042496c307fea1523f10d /routers | |
| parent | 0b331e2213e7b1efcc817dcd6be4d5e98a2c7b82 (diff) | |
| download | gitea-cada7202aa0e5766eb770f7d5c95e8483386adf1.tar.gz gitea-cada7202aa0e5766eb770f7d5c95e8483386adf1.zip | |
Only view milestones from current repo (#18414) (#18417)
Backport #18414
The endpoint /{username}/{reponame}/milestone/{id} is not currently restricted to
the repo. This PR restricts the milestones to those within the repo.
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/web/repo/issue.go | 4 | ||||
| -rw-r--r-- | routers/web/repo/milestone.go | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go index 9dee477537..8c707e1678 100644 --- a/routers/web/repo/issue.go +++ b/routers/web/repo/issue.go @@ -802,7 +802,7 @@ func NewIssue(ctx *context.Context) { milestoneID := ctx.FormInt64("milestone") if milestoneID > 0 { - milestone, err := models.GetMilestoneByID(milestoneID) + milestone, err := models.GetMilestoneByRepoID(ctx.Repo.Repository.ID, milestoneID) if err != nil { log.Error("GetMilestoneByID: %d: %v", milestoneID, err) } else { @@ -889,7 +889,7 @@ func ValidateRepoMetas(ctx *context.Context, form forms.CreateIssueForm, isPull // Check milestone. milestoneID := form.MilestoneID if milestoneID > 0 { - milestone, err := models.GetMilestoneByID(milestoneID) + milestone, err := models.GetMilestoneByRepoID(ctx.Repo.Repository.ID, milestoneID) if err != nil { ctx.ServerError("GetMilestoneByID", err) return nil, nil, 0, 0 diff --git a/routers/web/repo/milestone.go b/routers/web/repo/milestone.go index eadc89333f..df5fd411b4 100644 --- a/routers/web/repo/milestone.go +++ b/routers/web/repo/milestone.go @@ -264,7 +264,7 @@ func DeleteMilestone(ctx *context.Context) { // MilestoneIssuesAndPulls lists all the issues and pull requests of the milestone func MilestoneIssuesAndPulls(ctx *context.Context) { milestoneID := ctx.ParamsInt64(":id") - milestone, err := models.GetMilestoneByID(milestoneID) + milestone, err := models.GetMilestoneByRepoID(ctx.Repo.Repository.ID, milestoneID) if err != nil { if models.IsErrMilestoneNotExist(err) { ctx.NotFound("GetMilestoneByID", err) |