diff options
Diffstat (limited to 'routers/api/v1/repo/repo.go')
| -rw-r--r-- | routers/api/v1/repo/repo.go | 23 |
1 files changed, 15 insertions, 8 deletions
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go index ccfe0440c8..c6c5d4aec3 100644 --- a/routers/api/v1/repo/repo.go +++ b/routers/api/v1/repo/repo.go @@ -306,16 +306,23 @@ func Migrate(ctx *context.APIContext, form auth.MigrateRepoForm) { return } - if ctxUser.IsOrganization() && !ctx.User.IsAdmin { - // Check ownership of organization. - isOwner, err := ctxUser.IsOwnedBy(ctx.User.ID) - if err != nil { - ctx.Error(500, "IsOwnedBy", err) - return - } else if !isOwner { - ctx.Error(403, "", "Given user is not owner of organization.") + if !ctx.User.IsAdmin { + if !ctxUser.IsOrganization() && ctx.User.ID != ctxUser.ID { + ctx.Error(403, "", "Given user is not an organization.") return } + + if ctxUser.IsOrganization() { + // Check ownership of organization. + isOwner, err := ctxUser.IsOwnedBy(ctx.User.ID) + if err != nil { + ctx.Error(500, "IsOwnedBy", err) + return + } else if !isOwner { + ctx.Error(403, "", "Given user is not owner of organization.") + return + } + } } remoteAddr, err := form.ParseRemoteAddr(ctx.User) |