fedi/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-01 00:21:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix users cannot visit issue attachment bug (#25019) (#25027)

Browse source 
Backport #25019 by @lunny

Caused by #24362

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
(cherry picked from commit 73ae6b21d1)
This commit is contained in:
Giteabot 2023-06-01 13:22:26 -04:00 committed by Earl Warren
parent c5245fabe4
commit 05a3e8572c
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
2 changed files with 3 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
routers/web/repo/attachment.go
View file

@ -110,11 +110,6 @@ func GetAttachment(ctx *context.Context) {
return
}
} else { // If we have the repository we check access
context.CheckRepoScopedToken(ctx, repository)
if ctx.Written() {
return
}
perm, err := access_model.GetUserRepoPermission(ctx, repository, ctx.Doer)
if err != nil {
ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err.Error())

3
tests/integration/attachment_test.go
View file

@ -89,6 +89,9 @@ func TestCreateIssueAttachment(t *testing.T) {
// Validate that attachment is available
req = NewRequest(t, "GET", "/attachments/"+uuid)
session.MakeRequest(t, req, http.StatusOK)
// anonymous visit should be allowed because user2/repo1 is a public repository
MakeRequest(t, req, http.StatusOK)
}
func TestGetAttachment(t *testing.T) {