From 15c3d14d554f95423ea34ceeb0dc91bc479861f2 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Fri, 16 Dec 2016 19:42:39 +0800 Subject: fixed vulnerabilities on deleting release (#399) --- models/release.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'models/release.go') diff --git a/models/release.go b/models/release.go index c047b2f557..41fd145bea 100644 --- a/models/release.go +++ b/models/release.go @@ -189,7 +189,7 @@ func UpdateRelease(gitRepo *git.Repository, rel *Release) (err error) { } // DeleteReleaseByID deletes a release and corresponding Git tag by given ID. -func DeleteReleaseByID(id int64) error { +func DeleteReleaseByID(id int64, u *User) error { rel, err := GetReleaseByID(id) if err != nil { return fmt.Errorf("GetReleaseByID: %v", err) @@ -200,6 +200,13 @@ func DeleteReleaseByID(id int64) error { return fmt.Errorf("GetRepositoryByID: %v", err) } + has, err := HasAccess(u, repo, AccessModeWrite) + if err != nil { + return fmt.Errorf("HasAccess: %v", err) + } else if !has { + return fmt.Errorf("DeleteReleaseByID: permission denied") + } + _, stderr, err := process.ExecDir(-1, repo.RepoPath(), fmt.Sprintf("DeleteReleaseByID (git tag -d): %d", rel.ID), "git", "tag", "-d", rel.TagName) -- cgit v1.2.3