mirrors/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-23 15:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(org): hide limited organizations from restricted users (#39047)

Browse Source 
Do not expose limited organization memberships to restricted viewers.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-08-23 08:11:04 +02:00
committed by GitHub
parent d8f0e7e679
commit bedd2afb47
3 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
models/organization/org_list.go
View File

@@ -89,6 +89,9 @@ func DoerViewOtherVisibility(doer, other *user_model.User) structs.VisibleType {
if doer.IsAdmin || doer.ID == other.ID {
return structs.VisibleTypePrivate
}
if doer.IsRestricted {
return structs.VisibleTypePublic
}
return structs.VisibleTypeLimited
}

12
models/organization/org_list_test.go
View File

@@ -77,8 +77,14 @@ func testLoadOrgListTeams(t *testing.T) {
}
func testDoerViewOtherVisibility(t *testing.T) {
viewer := &user_model.User{ID: 1}
other := &user_model.User{ID: 2}
restrictedViewer := &user_model.User{ID: 3, IsRestricted: true}
assert.Equal(t, structs.VisibleTypePublic, organization.DoerViewOtherVisibility(nil, nil))
assert.Equal(t, structs.VisibleTypeLimited, organization.DoerViewOtherVisibility(&user_model.User{ID: 1}, &user_model.User{ID: 2}))
assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 1}, &user_model.User{ID: 1}))
assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 1, IsAdmin: true}, &user_model.User{ID: 2}))
assert.Equal(t, structs.VisibleTypeLimited, organization.DoerViewOtherVisibility(viewer, other))
assert.Equal(t, structs.VisibleTypePublic, organization.DoerViewOtherVisibility(restrictedViewer, other))
assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(viewer, viewer))
assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(restrictedViewer, restrictedViewer))
assert.Equal(t, structs.VisibleTypePrivate, organization.DoerViewOtherVisibility(&user_model.User{ID: 4, IsAdmin: true, IsRestricted: true}, other))
}

3
tests/integration/api_user_orgs_test.go
View File

@@ -77,6 +77,9 @@ func TestUserOrgs(t *testing.T) {
orgs = getUserOrgs(t, unrelatedUsername, privateMemberUsername)
assert.Empty(t, orgs)
orgs = getUserOrgs(t, "user29", adminUsername)
assert.Empty(t, orgs)
// not authenticated call should not be allowed
testUserOrgsUnauthenticated(t, privateMemberUsername)
}