sascha
/
gitea
mirror of https://github.com/go-gitea/gitea.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix internal server error when updating labels without write permission (#32776) 

Fix #32775

if permission denined, `prepareForReplaceOrAdd` will return nothing, and
this case is not handled.
pull/32680/head
yp05327 2024-12-11 03:42:52 +07:00 committed by GitHub
parent 8f271c6036
commit 2ac6f2b129
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
routers/api/v1/repo/issue_label.go
Unescape Escape View File

@ -319,6 +319,11 @@ func prepareForReplaceOrAdd(ctx *context.APIContext, form api.IssueLabelsOption)
return nil, nil, err
}
if !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) {
ctx.Error(http.StatusForbidden, "CanWriteIssuesOrPulls", "write permission is required")
return nil, nil, fmt.Errorf("permission denied")
}
var (
labelIDs []int64
labelNames []string
@ -350,10 +355,5 @@ func prepareForReplaceOrAdd(ctx *context.APIContext, form api.IssueLabelsOption)
return nil, nil, err
}
if !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) {
ctx.Status(http.StatusForbidden)
return nil, nil, nil
}
return issue, labels, err
}