mirrors/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-10-30 22:11:07 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix(api): deactivate issue api for disabled or external issue-tracker (#8829)

Browse source 
- When the issue unit is disabled for a repository, don't allow issue related APIs.
- Added integration tests.
- Resolves #8408

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8829
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
This commit is contained in:
zokki 2025-09-03 16:13:40 +02:00 • committed by Gusted
commit 4247c37300
7 changed files with 252 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

35
routers/api/v1/api.go
View file

@ -69,6 +69,7 @@ package v1
import (
"fmt"
"net/http"
"slices"
"strings"
actions_model "forgejo.org/models/actions"
@ -468,6 +469,12 @@ func reqAdmin() func(ctx *context.APIContext) {
// reqRepoWriter user should have a permission to write to a repo, or be a site admin
func reqRepoWriter(unitTypes ...unit.Type) func(ctx *context.APIContext) {
return func(ctx *context.APIContext) {
if !slices.ContainsFunc(unitTypes, func(unitType unit.Type) bool {
return ctx.Repo.Repository.UnitEnabled(ctx, unitType)
}) {
ctx.NotFound()
return
}
if !ctx.IsUserRepoWriter(unitTypes) && !ctx.IsUserRepoAdmin() && !ctx.IsUserSiteAdmin() {
ctx.Error(http.StatusForbidden, "reqRepoWriter", "user should have a permission to write to a repo")
return
@ -487,6 +494,10 @@ func reqRepoBranchWriter(ctx *context.APIContext) {
// reqRepoReader user should have specific read permission or be a repo admin or a site admin
func reqRepoReader(unitType unit.Type) func(ctx *context.APIContext) {
return func(ctx *context.APIContext) {
if !ctx.Repo.Repository.UnitEnabled(ctx, unitType) {
ctx.NotFound()
return
}
if !ctx.Repo.CanRead(unitType) && !ctx.IsUserRepoAdmin() && !ctx.IsUserSiteAdmin() {
ctx.Error(http.StatusForbidden, "reqRepoReader", "user should have specific read permission or be a repo admin or a site admin")
return
@ -744,6 +755,26 @@ func mustEnableIssuesOrPulls(ctx *context.APIContext) {
}
}
func mustEnableLocalIssuesIfIsIssue(ctx *context.APIContext) {
if ctx.Repo.Repository.UnitEnabled(ctx, unit.TypeIssues) {
return
}
issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.ParamsInt64(":index"))
if err != nil {
if issues_model.IsErrIssueNotExist(err) {
ctx.NotFound()
} else {
ctx.Error(http.StatusInternalServerError, "GetIssueByIndex", err)
}
return
}
if !issue.IsPull {
ctx.NotFound()
return
}
}
func mustEnableWiki(ctx *context.APIContext) {
if !(ctx.Repo.CanRead(unit.TypeWiki)) {
ctx.NotFound()
@ -1426,7 +1457,7 @@ func Routes() *web.Route {
m.Group("/comments", func() {
m.Combo("").Get(repo.ListIssueComments).
Post(reqToken(), mustNotBeArchived, bind(api.CreateIssueCommentOption{}), repo.CreateIssueComment)
m.Combo("/{id}", reqToken()).Patch(bind(api.EditIssueCommentOption{}), repo.EditIssueCommentDeprecated).
m.Combo("/{id}", reqToken(), commentAssignment(":id")).Patch(bind(api.EditIssueCommentOption{}), repo.EditIssueCommentDeprecated).
Delete(repo.DeleteIssueCommentDeprecated)
})
m.Get("/timeline", repo.ListIssueCommentsAndTimeline)
@ -1483,7 +1514,7 @@ func Routes() *web.Route {
Delete(reqToken(), reqAdmin(), repo.UnpinIssue)
m.Patch("/{position}", reqToken(), reqAdmin(), repo.MoveIssuePin)
})
})
}, mustEnableLocalIssuesIfIsIssue)
}, mustEnableIssuesOrPulls)
m.Group("/labels", func() {
m.Combo("").Get(repo.ListLabels).