Gusted 6162fb0a19

Check for permission when fetching user controlled issues (#20133) (#20196) ...

* Check if project has the same repository id with issue when assign project to issue

* Check if issue's repository id match project's repository id

* Add more permission checking

* Remove invalid argument

* Fix errors

* Add generic check

* Remove duplicated check

* Return error + add check for new issues

* Apply suggestions from code review

Co-authored-by: Gusted <williamzijl7@hotmail.com>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
Co-authored-by: 6543 <6543@obermui.de>

2022-07-01 17:39:10 +02:00

..

admin

Move user/org deletion to services (#17673)

2021-11-19 01:42:27 +08:00

appstate

Sync gitea app path for git hooks and authorized keys when starting (#17335)

2021-10-21 17:22:43 +08:00

asymkey

Fix the bug: deploy key with write access can not push (#19010) (#19182)

2022-03-23 13:44:41 +00:00

auth

Attempt to fix the webauthn migration again - part 3 (#18770) (#18771)

2022-02-16 21:15:49 +00:00

avatars

slight optimization for default avatar (#18187)

2022-01-05 07:00:32 +01:00

db

Refactor auth package (#17962)

2022-01-02 21:12:35 +08:00

fixtures

GetFeeds must always discard actions with dangling repo_id (#19598) (#19629)

2022-05-08 15:05:40 +02:00

issues

Show fullname on issue edits and gpg/ssh signing info (#18828)

2022-02-20 21:47:17 +00:00

migrations

Fix blame page select range error and some typos (#19503)

2022-04-26 20:19:52 +01:00

perm

Team permission allow different unit has different permission (#17811)

2022-01-05 11:37:00 +08:00

repo

Touch mirrors on even on fail to update (#19217) (#19233)

2022-03-27 23:08:28 +02:00

unit

Let return correct perm (#18675) (#18689)

2022-02-09 20:19:48 +00:00

unittest

GetFeeds must always discard actions with dangling repo_id (#19598) (#19629)

2022-05-08 15:05:40 +02:00

user

Respect DefaultUserIsRestricted system default when creating new user (#19310 ) (#19560)

2022-04-30 15:00:14 +02:00

webhook

Only send webhook events to active system webhooks and only deliver to active hooks (#19234) (#19248)

2022-03-29 14:12:56 +02:00

access_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

access.go

Team permission allow different unit has different permission (#17811)

2022-01-05 11:37:00 +08:00

action_list.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

action_test.go

GetFeeds must always discard actions with dangling repo_id (#19598) (#19629)

2022-05-08 15:05:40 +02:00

action.go

GetFeeds must always discard actions with dangling repo_id (#19598) (#19629)

2022-05-08 15:05:40 +02:00

branches_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

branches.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

commit_status_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

commit_status.go

Add missing X-Total-Count and fix some related bugs (#17968)

2021-12-15 13:39:34 +08:00

commit.go

Collaborator trust model should trust collaborators (#18539) (#18557)

2022-02-03 11:20:37 -05:00

consistency_test.go

[doctor] Add check/fix for bogus action rows (#19656) (#19669)

2022-05-10 16:05:34 +03:00

consistency.go

Fix count bug (#19850)

2022-06-01 23:18:04 +01:00

engine_test.go

Refactor install page (db type) (#17919)

2021-12-07 13:44:08 +08:00

error.go

ignore DNS error when doing migration allow/block check (#19567)

2022-05-02 08:11:45 +03:00

fixture_generation.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

fixture_test.go

Decouple unit test code from business code (#17623)

2021-11-12 22:36:47 +08:00

helper_directory.go

refactor: move from io/ioutil to io and os package (#17109)

2021-09-22 13:38:34 +08:00

helper_environment.go

Fix the bug: deploy key with write access can not push (#19010) (#19182)

2022-03-23 13:44:41 +00:00

helper.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_assignees_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

issue_assignees.go

Fix bug (#19757)

2022-05-20 00:03:52 +02:00

issue_comment_list.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_comment_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_comment.go

Fix PR comments UI (#18323)

2022-01-19 01:28:38 +08:00

issue_dependency_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

issue_dependency.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_label_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_label.go

User specific repoID or xorm builder conditions for issue search (#19475) (#19476)

2022-04-25 15:28:47 +02:00

issue_list_test.go

Decouple unit test, remove intermediate unittestbridge package (#17662)

2021-11-16 16:53:21 +08:00

issue_list.go

Use conditions but not repo ids as query condition (#16839)

2021-12-29 21:02:12 +08:00

issue_lock.go

Fix CheckRepoStats and reuse it during migration (#18264)

2022-01-17 19:31:58 +01:00

issue_milestone_test.go

Fix CheckRepoStats and reuse it during migration (#18264)

2022-01-17 19:31:58 +01:00

issue_milestone.go

Check for permission when fetching user controlled issues (#20133) (#20196)

2022-07-01 17:39:10 +02:00

issue_reaction_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_reaction.go

Add missing X-Total-Count and fix some related bugs (#17968)

2021-12-15 13:39:34 +08:00

issue_stopwatch_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

issue_stopwatch.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_test.go

User specific repoID or xorm builder conditions for issue search (#19475) (#19476)

2022-04-25 15:28:47 +02:00

issue_tracked_time_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

issue_tracked_time.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_user_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_user.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_watch_test.go

A better go code formatter, and now make fmt can run in Windows (#17684)

2021-11-17 20:34:35 +08:00

issue_watch.go

Add missing X-Total-Count and fix some related bugs (#17968)

2021-12-15 13:39:34 +08:00

issue_xref_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue_xref.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

issue.go

Fix issue overview for teams (#19652) (#19653)

2022-05-16 17:48:16 +08:00

lfs_lock.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

lfs.go

Improve SyncMirrors logging (#19045) (#19050)

2022-03-10 16:06:35 +01:00

main_test.go

Move keys to models/asymkey (#17917)

2021-12-10 16:14:24 +08:00

migrate_test.go

remove redundant call to UpdateRepoStats during migration (#18591) (#18794)

2022-02-17 17:57:05 +00:00

migrate.go

remove redundant call to UpdateRepoStats during migration (#18591) (#18794)

2022-02-17 17:57:05 +00:00

notification_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

notification.go

Ignore missing comment for user notifications (#18954) (#19043)

2022-03-10 01:48:27 -05:00

org_team_test.go

Add GetUserTeams (#18499) (#18531)

2022-02-02 08:40:04 +00:00

org_team.go

Performance improvement for add team user when org has more than 1000 repositories (#19227) (#19289)

2022-04-01 11:36:12 +03:00

org_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

org.go

Team permission allow different unit has different permission (#17811)

2022-01-05 11:37:00 +08:00

project_board.go

Support sorting for project board issuses (#17152)

2021-12-08 14:57:18 +08:00

project_issue.go

Check for permission when fetching user controlled issues (#20133) (#20196)

2022-07-01 17:39:10 +02:00

project_test.go

Decouple unit test code from business code (#17623)

2021-11-12 22:36:47 +08:00

project.go

Remove NewSession method from db.Engine interface (#17577)

2021-11-21 23:41:00 +08:00

protected_tag_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

protected_tag.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

pull_list.go

Don't delete branch if other PRs with this branch are open (#18164)

2022-01-03 20:45:58 +01:00

pull_test.go

Move checks for pulls before merge into own function (#19271) (#19277)

2022-03-31 16:57:13 +02:00

pull.go

Make WIP prefixes case insensitive, e.g. allow Draft as a WIP prefix (#19780) (#19811)

2022-05-26 18:55:26 +03:00

release.go

Some repository refactors (#17950)

2021-12-12 23:48:20 +08:00

repo_activity.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

repo_collaboration_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

repo_collaboration.go

Some repository refactors (#17950)

2021-12-12 23:48:20 +08:00

repo_generate_test.go

Fixed assert statements. (#16089)

2021-06-07 07:27:09 +02:00

repo_generate.go

Some repository refactors (#17950)

2021-12-12 23:48:20 +08:00

repo_list_test.go

Decouple unit test, remove intermediate unittestbridge package (#17662)

2021-11-16 16:53:21 +08:00

repo_list.go

Fix issue overview for teams (#19652) (#19653)

2022-05-16 17:48:16 +08:00

repo_permission_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

repo_permission.go

Team permission allow different unit has different permission (#17811)

2022-01-05 11:37:00 +08:00

repo_test.go

Fix potential assignee query for repo (#18994) (#18999)

2022-03-05 00:12:34 +08:00

repo_transfer_test.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

repo_transfer.go

Some repository refactors (#17950)

2021-12-12 23:48:20 +08:00

repo.go

Prevent NPE when checking repo units if the user is nil (#19625) (#19630)

2022-05-06 18:01:08 +08:00

review_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

review.go

Fix various typos (#18219)

2022-01-10 17:32:37 +08:00

statistic.go

Refactor auth package (#17962)

2022-01-02 21:12:35 +08:00

task.go

Move repository model into models/repo (#17933)

2021-12-10 09:27:50 +08:00

token_test.go

A better go code formatter, and now make fmt can run in Windows (#17684)

2021-11-17 20:34:35 +08:00

token.go

Refactor auth package (#17962)

2022-01-02 21:12:35 +08:00

upload.go

Remove NewSession method from db.Engine interface (#17577)

2021-11-21 23:41:00 +08:00

user_heatmap_test.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

user_heatmap.go

Move user related model into models/user (#17781)

2021-11-24 17:49:20 +08:00

user_test.go

Use conditions but not repo ids as query condition (#16839)

2021-12-29 21:02:12 +08:00

user.go

Delete user related oauth stuff on user deletion too (#19677) (#19680)

2022-05-12 13:32:48 +02:00

userlist_test.go

Move more model into models/user (#17826)

2021-11-28 22:11:58 +08:00

userlist.go

Move more model into models/user (#17826)

2021-11-28 22:11:58 +08:00