lianguan/gitea
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent git operations for inactive users (#13527) (#13537)

Browse Source 
* prevent git operations for inactive users

* Some fixes

* Deny push to the repositories which's owner is inactive

* deny operations also when user is ProhibitLogin

Co-authored-by: zeripath <art27@cantab.net>

Co-authored-by: zeripath <art27@cantab.net>
This commit is contained in:
Lunny Xiao 2020-11-13 10:51:32 +08:00 committed by GitHub
parent 480efbdb96
commit da0460dea0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
routers/private/serv.go
View File

@ -61,6 +61,12 @@ func ServNoCommand(ctx *macaron.Context) {
})
return
}
if !user.IsActive || user.ProhibitLogin {
ctx.JSON(http.StatusForbidden, map[string]interface{}{
"err": "Your account is disabled.",
})
return
}
results.Owner = user
}
ctx.JSON(http.StatusOK, &results)
@ -98,9 +104,28 @@ func ServCommand(ctx *macaron.Context) {
results.RepoName = repoName[:len(repoName)-5]
}
owner, err := models.GetUserByName(results.OwnerName)
if err != nil {
log.Error("Unable to get repository owner: %s/%s Error: %v", results.OwnerName, results.RepoName, err)
ctx.JSON(http.StatusInternalServerError, map[string]interface{}{
"results": results,
"type": "InternalServerError",
"err": fmt.Sprintf("Unable to get repository owner: %s/%s %v", results.OwnerName, results.RepoName, err),
})
return
}
if !owner.IsActive {
ctx.JSON(http.StatusForbidden, map[string]interface{}{
"results": results,
"type": "ForbiddenError",
"err": "Repository cannot be accessed, you could retry it later",
})
return
}
// Now get the Repository and set the results section
repoExist := true
repo, err := models.GetRepositoryByOwnerAndName(results.OwnerName, results.RepoName)
repo, err := models.GetRepositoryByName(owner.ID, results.RepoName)
if err != nil {
if models.IsErrRepoNotExist(err) {
repoExist = false
@ -127,6 +152,7 @@ func ServCommand(ctx *macaron.Context) {
}
if repoExist {
repo.Owner = owner
repo.OwnerName = ownerName
results.RepoID = repo.ID
@ -238,6 +264,14 @@ func ServCommand(ctx *macaron.Context) {
})
return
}
if !user.IsActive || user.ProhibitLogin {
ctx.JSON(http.StatusForbidden, map[string]interface{}{
"err": "Your account is disabled.",
})
return
}
results.UserName = user.Name
}

9
routers/repo/http.go
View File

@ -104,6 +104,10 @@ func HTTP(ctx *context.Context) {
ctx.NotFoundOrServerError("GetUserByName", models.IsErrUserNotExist, err)
return
}
if !owner.IsActive {
ctx.HandleText(http.StatusForbidden, "Repository cannot be accessed. You cannot push or open issues/pull-requests.")
return
}
repoExist := true
repo, err := models.GetRepositoryByName(owner.ID, reponame)
@ -243,6 +247,11 @@ func HTTP(ctx *context.Context) {
}
}
if !authUser.IsActive || authUser.ProhibitLogin {
ctx.HandleText(http.StatusForbidden, "Your account is disabled.")
return
}
if repoExist {
perm, err := models.GetUserRepoPermission(repo, authUser)
if err != nil {