From 1751d5fcf200b7d78ec5543fa620174c69d2746a Mon Sep 17 00:00:00 2001 From: Manush Dodunekov Date: Mon, 13 Jan 2020 19:33:46 +0200 Subject: Restricted users (#6274) * Restricted users (#4334): initial implementation * Add User.IsRestricted & UI to edit it * Pass user object instead of user id to places where IsRestricted flag matters * Restricted users: maintain access rows for all referenced repos (incl public) * Take logged in user & IsRestricted flag into account in org/repo listings, searches and accesses * Add basic repo access tests for restricted users Signed-off-by: Manush Dodunekov * Mention restricted users in the faq Signed-off-by: Manush Dodunekov * Revert unnecessary change `.isUserPartOfOrg` -> `.IsUserPartOfOrg` Signed-off-by: Manush Dodunekov * Remove unnecessary `org.IsOrganization()` call Signed-off-by: Manush Dodunekov * Revert to an `int64` keyed `accessMap` * Add type `userAccess` * Add convenience func updateUserAccess() * Turn accessMap into a `map[int64]userAccess` Signed-off-by: Manush Dodunekov * or even better: `map[int64]*userAccess` * updateUserAccess(): use tighter syntax as suggested by lafriks * even tighter * Avoid extra loop * Don't disclose limited orgs to unauthenticated users * Don't assume block only applies to orgs * Use an array of `VisibleType` for filtering * fix yet another thinko * Ok - no need for u * Revert "Ok - no need for u" This reverts commit 5c3e886aabd5acd997a3b35687d322439732c200. Co-authored-by: Antoine GIRARD Co-authored-by: Lauris BH --- models/repo_permission.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'models/repo_permission.go') diff --git a/models/repo_permission.go b/models/repo_permission.go index cd20224912..0b3e5b341a 100644 --- a/models/repo_permission.go +++ b/models/repo_permission.go @@ -202,7 +202,7 @@ func getUserRepoPermission(e Engine, repo *Repository, user *User) (perm Permiss } // plain user - perm.AccessMode, err = accessLevel(e, user.ID, repo) + perm.AccessMode, err = accessLevel(e, user, repo) if err != nil { return } @@ -250,8 +250,8 @@ func getUserRepoPermission(e Engine, repo *Repository, user *User) (perm Permiss } } - // for a public repo on an organization, user have read permission on non-team defined units. - if !found && !repo.IsPrivate { + // for a public repo on an organization, a non-restricted user has read permission on non-team defined units. + if !found && !repo.IsPrivate && !user.IsRestricted { if _, ok := perm.UnitsMode[u.Type]; !ok { perm.UnitsMode[u.Type] = AccessModeRead } @@ -284,7 +284,7 @@ func isUserRepoAdmin(e Engine, repo *Repository, user *User) (bool, error) { return true, nil } - mode, err := accessLevel(e, user.ID, repo) + mode, err := accessLevel(e, user, repo) if err != nil { return false, err } -- cgit v1.2.3