Skip to content

Commit 782414b

Browse files
authored
Fix missing check (#28406) (#28413)
backport #28406
1 parent 59d88c4 commit 782414b

File tree

2 files changed

+24
-4
lines changed

2 files changed

+24
-4
lines changed

routers/web/repo/issue_content_history.go

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -189,15 +189,29 @@ func SoftDeleteContentHistory(ctx *context.Context) {
189189
var comment *issues_model.Comment
190190
var history *issues_model.ContentHistory
191191
var err error
192+
193+
if history, err = issues_model.GetIssueContentHistoryByID(ctx, historyID); err != nil {
194+
log.Error("can not get issue content history %v. err=%v", historyID, err)
195+
return
196+
}
197+
if history.IssueID != issue.ID {
198+
ctx.NotFound("CompareRepoID", issues_model.ErrCommentNotExist{})
199+
return
200+
}
192201
if commentID != 0 {
202+
if history.CommentID != commentID {
203+
ctx.NotFound("CompareCommentID", issues_model.ErrCommentNotExist{})
204+
return
205+
}
206+
193207
if comment, err = issues_model.GetCommentByID(ctx, commentID); err != nil {
194208
log.Error("can not get comment for issue content history %v. err=%v", historyID, err)
195209
return
196210
}
197-
}
198-
if history, err = issues_model.GetIssueContentHistoryByID(ctx, historyID); err != nil {
199-
log.Error("can not get issue content history %v. err=%v", historyID, err)
200-
return
211+
if comment.IssueID != issue.ID {
212+
ctx.NotFound("CompareIssueID", issues_model.ErrCommentNotExist{})
213+
return
214+
}
201215
}
202216

203217
canSoftDelete := canSoftDeleteContentHistory(ctx, issue, comment, history)

routers/web/repo/issue_pin.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,12 @@ func IssuePinMove(ctx *context.Context) {
9090
return
9191
}
9292

93+
if issue.RepoID != ctx.Repo.Repository.ID {
94+
ctx.Status(http.StatusNotFound)
95+
log.Error("Issue does not belong to this repository")
96+
return
97+
}
98+
9399
err = issue.MovePin(ctx, form.Position)
94100
if err != nil {
95101
ctx.Status(http.StatusInternalServerError)

0 commit comments

Comments
 (0)