diff options
Diffstat (limited to 'routers/routes')
| -rw-r--r-- | routers/routes/routes.go | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/routers/routes/routes.go b/routers/routes/routes.go index 8ab7ff9bea..b73b030a51 100644 --- a/routers/routes/routes.go +++ b/routers/routes/routes.go @@ -432,6 +432,13 @@ func RegisterRoutes(m *macaron.Macaron) { reqRepoIssuesOrPullsWriter := context.RequireRepoWriterOr(models.UnitTypeIssues, models.UnitTypePullRequests) reqRepoIssuesOrPullsReader := context.RequireRepoReaderOr(models.UnitTypeIssues, models.UnitTypePullRequests) + reqRepoIssueWriter := func(ctx *context.Context) { + if !ctx.Repo.CanWrite(models.UnitTypeIssues) { + ctx.Error(403) + return + } + } + // ***** START: Organization ***** m.Group("/org", func() { m.Group("", func() { @@ -574,7 +581,7 @@ func RegisterRoutes(m *macaron.Macaron) { m.Post("/add", repo.AddDependency) m.Post("/delete", repo.RemoveDependency) }) - m.Combo("/comments").Post(bindIgnErr(auth.CreateCommentForm{}), repo.NewComment) + m.Combo("/comments").Post(repo.MustAllowUserComment, bindIgnErr(auth.CreateCommentForm{}), repo.NewComment) m.Group("/times", func() { m.Post("/add", bindIgnErr(auth.AddTimeManuallyForm{}), repo.AddTimeManually) m.Group("/stopwatch", func() { @@ -583,6 +590,8 @@ func RegisterRoutes(m *macaron.Macaron) { }) }) m.Post("/reactions/:action", bindIgnErr(auth.ReactionForm{}), repo.ChangeIssueReaction) + m.Post("/lock", reqRepoIssueWriter, bindIgnErr(auth.IssueLockForm{}), repo.LockIssue) + m.Post("/unlock", reqRepoIssueWriter, repo.UnlockIssue) }, context.RepoMustNotBeArchived()) m.Post("/labels", reqRepoIssuesOrPullsWriter, repo.UpdateIssueLabel) |