Skip to content

Commit 667f68e

Browse files
yp05327yp05327
committed
add org team permission check
1 parent fb5031b commit 667f68e

File tree

10 files changed

+82
-30
lines changed

10 files changed

+82
-30
lines changed

‎models/organization/org.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,32 @@ func (org *Organization) CustomAvatarRelativePath() string {
239239
return org.Avatar
240240
}
241241

242+
// UnitPermission returns unit permission
243+
func (org *Organization) UnitPermission(ctx context.Context, doer *user_model.User, unitType unit.Type) perm.AccessMode {
244+
if doer != nil {
245+
teams, err := GetUserOrgTeams(ctx, org.ID, doer.ID)
246+
if err != nil {
247+
log.Error("GetUserOrgTeams: %v", err)
248+
return perm.AccessModeNone
249+
}
250+
251+
if err := teams.LoadUnits(ctx); err != nil {
252+
log.Error("LoadUnits: %v", err)
253+
return perm.AccessModeNone
254+
}
255+
256+
if len(teams) > 0 {
257+
return teams.UnitMaxAccess(unitType)
258+
}
259+
}
260+
261+
if org.Visibility.IsPublic() {
262+
return perm.AccessModeRead
263+
}
264+
265+
return perm.AccessModeNone
266+
}
267+
242268
// CreateOrganization creates record of a new organization.
243269
func CreateOrganization(org *Organization, owner *user_model.User) (err error) {
244270
if !owner.CanCreateOrganization() {

‎models/user/user.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,11 @@ func (u *User) IsOrganization() bool {
393393
return u.Type == UserTypeOrganization
394394
}
395395

396+
// IsIndividual returns true if user is actually a individual user.
397+
func (u *User) IsIndividual() bool {
398+
return u.Type == UserTypeIndividual
399+
}
400+
396401
// DisplayName returns full name if it's not empty,
397402
// returns username otherwise.
398403
func (u *User) DisplayName() string {

‎modules/context/org.go

Lines changed: 8 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111
"code.gitea.io/gitea/models/perm"
1212
"code.gitea.io/gitea/models/unit"
1313
user_model "code.gitea.io/gitea/models/user"
14-
"code.gitea.io/gitea/modules/log"
1514
"code.gitea.io/gitea/modules/setting"
1615
"code.gitea.io/gitea/modules/structs"
1716
)
@@ -31,29 +30,11 @@ type Organization struct {
3130
}
3231

3332
func (org *Organization) CanWriteUnit(ctx *Context, unitType unit.Type) bool {
34-
if ctx.Doer == nil {
35-
return false
36-
}
37-
return org.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeWrite
33+
return org.Organization.UnitPermission(ctx, ctx.Doer, unitType) >= perm.AccessModeWrite
3834
}
3935

40-
func (org *Organization) UnitPermission(ctx *Context, doerID int64, unitType unit.Type) perm.AccessMode {
41-
if doerID > 0 {
42-
teams, err := organization.GetUserOrgTeams(ctx, org.Organization.ID, doerID)
43-
if err != nil {
44-
log.Error("GetUserOrgTeams: %v", err)
45-
return perm.AccessModeNone
46-
}
47-
if len(teams) > 0 {
48-
return teams.UnitMaxAccess(unitType)
49-
}
50-
}
51-
52-
if org.Organization.Visibility == structs.VisibleTypePublic {
53-
return perm.AccessModeRead
54-
}
55-
56-
return perm.AccessModeNone
36+
func (org *Organization) CanReadUnit(ctx *Context, unitType unit.Type) bool {
37+
return org.Organization.UnitPermission(ctx, ctx.Doer, unitType) >= perm.AccessModeRead
5738
}
5839

5940
func GetOrganizationByParams(ctx *Context) {
@@ -170,6 +151,7 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
170151
}
171152
ctx.Data["IsOrganizationOwner"] = ctx.Org.IsOwner
172153
ctx.Data["IsOrganizationMember"] = ctx.Org.IsMember
154+
ctx.Data["IsProjectEnabled"] = true
173155
ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
174156
ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
175157
ctx.Data["IsPublicMember"] = func(uid int64) bool {
@@ -245,6 +227,10 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
245227
return
246228
}
247229
}
230+
231+
ctx.Data["CanReadProjects"] = ctx.Org.CanReadUnit(ctx, unit.TypeProjects)
232+
ctx.Data["CanReadPackages"] = ctx.Org.CanReadUnit(ctx, unit.TypePackages)
233+
ctx.Data["CanReadCode"] = ctx.Org.CanReadUnit(ctx, unit.TypeCode)
248234
}
249235

250236
// OrgAssignment returns a middleware to handle organization assignment

‎routers/web/org/home.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ func Home(ctx *context.Context) {
156156
pager.SetDefaultParams(ctx)
157157
pager.AddParam(ctx, "language", "Language")
158158
ctx.Data["Page"] = pager
159-
159+
ctx.Data["ContextUser"] = ctx.ContextUser
160+
160161
ctx.HTML(http.StatusOK, tplOrgHome)
161162
}

‎routers/web/shared/user/header.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ import (
99
)
1010

1111
func RenderUserHeader(ctx *context.Context) {
12+
ctx.Data["IsProjectEnabled"] = true
13+
ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
1214
ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
1315
ctx.Data["ContextUser"] = ctx.ContextUser
1416
}

‎routers/web/user/code.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ func CodeSearch(ctx *context.Context) {
2424
return
2525
}
2626

27+
ctx.Data["IsProjectEnabled"] = true
2728
ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
2829
ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
2930
ctx.Data["Title"] = ctx.Tr("explore.code")

‎routers/web/user/profile.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,7 @@ func Profile(ctx *context.Context) {
288288
pager.AddParam(ctx, "language", "Language")
289289
}
290290
ctx.Data["Page"] = pager
291+
ctx.Data["IsProjectEnabled"] = true
291292
ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
292293
ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
293294

‎routers/web/web.go

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -869,8 +869,21 @@ func RegisterRoutes(m *web.Route) {
869869
}
870870

871871
m.Group("/projects", func() {
872-
m.Get("", org.Projects)
873-
m.Get("/{id}", org.ViewProject)
872+
m.Group("", func() {
873+
m.Get("", org.Projects)
874+
m.Get("/{id}", org.ViewProject)
875+
}, func(ctx *context.Context) {
876+
if ctx.ContextUser == nil {
877+
ctx.NotFound("Project", nil)
878+
return
879+
}
880+
if ctx.ContextUser.IsOrganization() {
881+
if !ctx.Org.CanReadUnit(ctx, unit.TypeProjects) {
882+
ctx.NotFound("Project", nil)
883+
return
884+
}
885+
}
886+
})
874887
m.Group("", func() { //nolint:dupl
875888
m.Get("/new", org.NewProject)
876889
m.Post("/new", web.Bind(forms.CreateProjectForm{}), org.NewProjectPost)
@@ -907,7 +920,20 @@ func RegisterRoutes(m *web.Route) {
907920
})
908921
}, repo.MustEnableProjects)
909922

910-
m.Get("/code", user.CodeSearch)
923+
m.Group("", func() {
924+
m.Get("/code", user.CodeSearch)
925+
}, func(ctx *context.Context) {
926+
if ctx.ContextUser == nil {
927+
ctx.NotFound("Code", nil)
928+
return
929+
}
930+
if ctx.ContextUser.IsOrganization() {
931+
if !ctx.Org.CanReadUnit(ctx, unit.TypeCode) {
932+
ctx.NotFound("Code", nil)
933+
return
934+
}
935+
}
936+
})
911937
}, context_service.UserAssignmentWeb())
912938

913939
// ***** Release Attachment Download without Signin

‎templates/org/menu.tmpl

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@
33
<a class="{{if .PageIsViewRepositories}}active {{end}}item" href="{{$.Org.HomeLink}}">
44
{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
55
</a>
6+
{{if and .IsProjectEnabled (and .ContextUser.IsOrganization .CanReadProjects)}}
67
<a class="{{if .PageIsViewProjects}}active {{end}}item" href="{{$.Org.HomeLink}}/-/projects">
78
{{svg "octicon-project"}} {{.locale.Tr "user.projects"}}
89
</a>
9-
{{if .IsPackageEnabled}}
10+
{{end}}
11+
{{if and .IsPackageEnabled (and .ContextUser.IsOrganization .CanReadPackages)}}
1012
<a class="item" href="{{$.Org.HomeLink}}/-/packages">
1113
{{svg "octicon-package"}} {{.locale.Tr "packages.title"}}
1214
</a>
1315
{{end}}
14-
{{if .IsRepoIndexerEnabled}}
16+
{{if and .IsRepoIndexerEnabled (and .ContextUser.IsOrganization .CanReadCode)}}
1517
<a class="item" href="{{$.Org.HomeLink}}/-/code">
1618
{{svg "octicon-code"}}&nbsp;{{$.locale.Tr "org.code"}}
1719
</a>

‎templates/user/overview/header.tmpl

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,17 @@
2222
<a class="item" href="{{.ContextUser.HomeLink}}">
2323
{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
2424
</a>
25+
{{if and .IsProjectEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadProjects))}}
2526
<a href="{{.ContextUser.HomeLink}}/-/projects" class="{{if .PageIsViewProjects}}active {{end}}item">
2627
{{svg "octicon-project"}} {{.locale.Tr "user.projects"}}
2728
</a>
28-
{{if .IsPackageEnabled}}
29+
{{end}}
30+
{{if and .IsPackageEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadPackages))}}
2931
<a href="{{.ContextUser.HomeLink}}/-/packages" class="{{if .IsPackagesPage}}active {{end}}item">
3032
{{svg "octicon-package"}} {{.locale.Tr "packages.title"}}
3133
</a>
3234
{{end}}
33-
{{if .IsRepoIndexerEnabled}}
35+
{{if and .IsRepoIndexerEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadCode))}}
3436
<a href="{{.ContextUser.HomeLink}}/-/code" class="{{if .IsCodePage}}active {{end}}item">
3537
{{svg "octicon-code"}} {{.locale.Tr "user.code"}}
3638
</a>

0 commit comments

Comments
 (0)