Icycoide/RSCC-Forge
1
0
Fork 0
forked from kevadesu/forgejo
Code Pull requests Activity

Ensure that feeds are appropriately restricted (#10018)

Browse source 
* Always limit results by what is accessible to the user

* Change signature of AccessibleRepoIDsQuery

* Ensure that user with ID <= 0 is handled

* Update models/repo_list.go
This commit is contained in:
zeripath 2020-01-28 11:39:37 +00:00 • committed by GitHub
parent 797e6f8f4c
commit 206a031b38
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
models/action.go
View file

@ -312,8 +312,8 @@ func GetFeeds(opts GetFeedsOptions) ([]*Action, error) {
}
cond = cond.And(builder.In("repo_id", repoIDs))
} else if opts.Actor != nil {
cond = cond.And(builder.In("repo_id", opts.Actor.AccessibleRepoIDsQuery()))
} else {
cond = cond.And(builder.In("repo_id", AccessibleRepoIDsQuery(opts.Actor)))
}
cond = cond.And(builder.Eq{"user_id": opts.RequestedUser.ID})