From 6d6f1d568ec36786b1020f4b43cbd872228c6633 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Mon, 20 Jan 2020 20:00:32 +0800 Subject: Fix wrong permissions check when issues/prs shared operations (#9885) * Fix wrong permissions check when issues/prs shared operations * move redirect to the last of the function * fix swagger Co-authored-by: zeripath Co-authored-by: Lauris BH --- modules/context/repo.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules/context') diff --git a/modules/context/repo.go b/modules/context/repo.go index 3815fc8cea..1f6e5037cc 100644 --- a/modules/context/repo.go +++ b/modules/context/repo.go @@ -134,7 +134,7 @@ func (r *Repository) CanUseTimetracker(issue *models.Issue, user *models.User) b // 2. Is the user a contributor, admin, poster or assignee and do the repository policies require this? isAssigned, _ := models.IsUserAssignedToIssue(issue, user) return r.Repository.IsTimetrackerEnabled() && (!r.Repository.AllowOnlyContributorsToTrackTime() || - r.Permission.CanWrite(models.UnitTypeIssues) || issue.IsPoster(user.ID) || isAssigned) + r.Permission.CanWriteIssuesOrPulls(issue.IsPull) || issue.IsPoster(user.ID) || isAssigned) } // CanCreateIssueDependencies returns whether or not a user can create dependencies. -- cgit v1.2.3