From ec48618d40c12cc14e902062f6393ebeb9b0e365 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Mon, 17 Aug 2020 02:32:33 -0400 Subject: [PATCH] Fix bug preventing transfer to private organization (#12497) (#12501) * Fix bug preventing transfer to private organization The code assessing whether a private organization was visible to a user before allowing transfer was incorrect due to testing membership the wrong way round This PR fixes this issue and renames the function performing the test to be clearer. Further looking at the API for transfer repository - no testing was performed to ensure that the acting user could actually see the new owning organization. Signed-off-by: Andrew Thornton * change IsUserPartOfOrg everywhere Co-authored-by: zeripath --- models/org.go | 2 +- models/user.go | 8 ++++---- routers/api/v1/repo/transfer.go | 11 ++++++++++- routers/repo/setting.go | 2 +- templates/user/profile.tmpl | 2 +- 5 files changed, 17 insertions(+), 8 deletions(-) diff --git a/models/org.go b/models/org.go index 58afc5cb59..4a108a80ba 100644 --- a/models/org.go +++ b/models/org.go @@ -435,7 +435,7 @@ func hasOrgVisible(e Engine, org *User, user *User) bool { return true } - if (org.Visibility == structs.VisibleTypePrivate || user.IsRestricted) && !org.isUserPartOfOrg(e, user.ID) { + if (org.Visibility == structs.VisibleTypePrivate || user.IsRestricted) && !org.hasMemberWithUserID(e, user.ID) { return false } return true diff --git a/models/user.go b/models/user.go index 680c302313..dcf908de76 100644 --- a/models/user.go +++ b/models/user.go @@ -609,12 +609,12 @@ func (u *User) IsUserOrgOwner(orgID int64) bool { return isOwner } -// IsUserPartOfOrg returns true if user with userID is part of the u organisation. -func (u *User) IsUserPartOfOrg(userID int64) bool { - return u.isUserPartOfOrg(x, userID) +// HasMemberWithUserID returns true if user with userID is part of the u organisation. +func (u *User) HasMemberWithUserID(userID int64) bool { + return u.hasMemberWithUserID(x, userID) } -func (u *User) isUserPartOfOrg(e Engine, userID int64) bool { +func (u *User) hasMemberWithUserID(e Engine, userID int64) bool { isMember, err := isOrganizationMember(e, u.ID, userID) if err != nil { log.Error("IsOrganizationMember: %v", err) diff --git a/routers/api/v1/repo/transfer.go b/routers/api/v1/repo/transfer.go index 847028d106..b1271b7721 100644 --- a/routers/api/v1/repo/transfer.go +++ b/routers/api/v1/repo/transfer.go @@ -12,6 +12,7 @@ import ( "code.gitea.io/gitea/modules/context" "code.gitea.io/gitea/modules/convert" "code.gitea.io/gitea/modules/log" + "code.gitea.io/gitea/modules/structs" api "code.gitea.io/gitea/modules/structs" repo_service "code.gitea.io/gitea/services/repository" ) @@ -53,13 +54,21 @@ func Transfer(ctx *context.APIContext, opts api.TransferRepoOption) { newOwner, err := models.GetUserByName(opts.NewOwner) if err != nil { if models.IsErrUserNotExist(err) { - ctx.Error(http.StatusNotFound, "GetUserByName", err) + ctx.Error(http.StatusNotFound, "", "The new owner does not exist or cannot be found") return } ctx.InternalServerError(err) return } + if newOwner.Type == models.UserTypeOrganization { + if !ctx.User.IsAdmin && newOwner.Visibility == structs.VisibleTypePrivate && !newOwner.HasMemberWithUserID(ctx.User.ID) { + // The user shouldn't know about this organization + ctx.Error(http.StatusNotFound, "", "The new owner does not exist or cannot be found") + return + } + } + var teams []*models.Team if opts.TeamIDs != nil { if !newOwner.IsOrganization() { diff --git a/routers/repo/setting.go b/routers/repo/setting.go index 8622fd4698..02a5652867 100644 --- a/routers/repo/setting.go +++ b/routers/repo/setting.go @@ -381,7 +381,7 @@ func SettingsPost(ctx *context.Context, form auth.RepoSettingForm) { } if newOwner.Type == models.UserTypeOrganization { - if !ctx.User.IsAdmin && newOwner.Visibility == structs.VisibleTypePrivate && !ctx.User.IsUserPartOfOrg(newOwner.ID) { + if !ctx.User.IsAdmin && newOwner.Visibility == structs.VisibleTypePrivate && !newOwner.HasMemberWithUserID(ctx.User.ID) { // The user shouldn't know about this organization ctx.RenderWithErr(ctx.Tr("form.enterred_invalid_owner_name"), tplSettingsOptions, nil) return diff --git a/templates/user/profile.tmpl b/templates/user/profile.tmpl index f3cac7befb..d46504d97c 100644 --- a/templates/user/profile.tmpl +++ b/templates/user/profile.tmpl @@ -53,7 +53,7 @@
    • {{range .Orgs}} - {{if (or .Visibility.IsPublic (and ($.SignedUser) (or .Visibility.IsLimited (and (.IsUserPartOfOrg $.SignedUserID) .Visibility.IsPrivate) ($.IsAdmin))))}} + {{if (or .Visibility.IsPublic (and ($.SignedUser) (or .Visibility.IsLimited (and (.HasMemberWithUserID $.SignedUserID) .Visibility.IsPrivate) ($.IsAdmin))))}}