Skip to content

Commit a98a836

Browse files
wxiaoguangwxiaoguang
authored
Support public code/issue access for private repositories (#33127)
Close #8649, close #639 (will add "anonymous access" in following PRs)
1 parent ecd463c commit a98a836

File tree

9 files changed

+218
-213
lines changed

9 files changed

+218
-213
lines changed

‎models/perm/access/repo_permission.go

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -175,10 +175,14 @@ func (p *Permission) LogString() string {
175175
return fmt.Sprintf(format, args...)
176176
}
177177

178-
func applyEveryoneRepoPermission(user *user_model.User, perm *Permission) {
178+
func finalProcessRepoUnitPermission(user *user_model.User, perm *Permission) {
179179
if user == nil || user.ID <= 0 {
180+
// for anonymous access, it could be:
181+
// AccessMode is None or Read, units has repo units, unitModes is nil
180182
return
181183
}
184+
185+
// apply everyone access permissions
182186
for _, u := range perm.units {
183187
if u.EveryoneAccessMode >= perm_model.AccessModeRead && u.EveryoneAccessMode > perm.everyoneAccessMode[u.Type] {
184188
if perm.everyoneAccessMode == nil {
@@ -187,17 +191,40 @@ func applyEveryoneRepoPermission(user *user_model.User, perm *Permission) {
187191
perm.everyoneAccessMode[u.Type] = u.EveryoneAccessMode
188192
}
189193
}
194+
195+
if perm.unitsMode == nil {
196+
// if unitsMode is not set, then it means that the default p.AccessMode applies to all units
197+
return
198+
}
199+
200+
// remove no permission units
201+
origPermUnits := perm.units
202+
perm.units = make([]*repo_model.RepoUnit, 0, len(perm.units))
203+
for _, u := range origPermUnits {
204+
shouldKeep := false
205+
for t := range perm.unitsMode {
206+
if shouldKeep = u.Type == t; shouldKeep {
207+
break
208+
}
209+
}
210+
for t := range perm.everyoneAccessMode {
211+
if shouldKeep = shouldKeep || u.Type == t; shouldKeep {
212+
break
213+
}
214+
}
215+
if shouldKeep {
216+
perm.units = append(perm.units, u)
217+
}
218+
}
190219
}
191220

192221
// GetUserRepoPermission returns the user permissions to the repository
193222
func GetUserRepoPermission(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (perm Permission, err error) {
194223
defer func() {
195224
if err == nil {
196-
applyEveryoneRepoPermission(user, &perm)
197-
}
198-
if log.IsTrace() {
199-
log.Trace("Permission Loaded for user %-v in repo %-v, permissions: %-+v", user, repo, perm)
225+
finalProcessRepoUnitPermission(user, &perm)
200226
}
227+
log.Trace("Permission Loaded for user %-v in repo %-v, permissions: %-+v", user, repo, perm)
201228
}()
202229

203230
if err = repo.LoadUnits(ctx); err != nil {
@@ -294,16 +321,6 @@ func GetUserRepoPermission(ctx context.Context, repo *repo_model.Repository, use
294321
}
295322
}
296323

297-
// remove no permission units
298-
perm.units = make([]*repo_model.RepoUnit, 0, len(repo.Units))
299-
for t := range perm.unitsMode {
300-
for _, u := range repo.Units {
301-
if u.Type == t {
302-
perm.units = append(perm.units, u)
303-
}
304-
}
305-
}
306-
307324
return perm, err
308325
}
309326

‎models/perm/access/repo_permission_test.go

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
5050
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
5151
},
5252
}
53-
applyEveryoneRepoPermission(nil, &perm)
53+
finalProcessRepoUnitPermission(nil, &perm)
5454
assert.False(t, perm.CanRead(unit.TypeWiki))
5555

5656
perm = Permission{
@@ -59,7 +59,7 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
5959
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
6060
},
6161
}
62-
applyEveryoneRepoPermission(&user_model.User{ID: 0}, &perm)
62+
finalProcessRepoUnitPermission(&user_model.User{ID: 0}, &perm)
6363
assert.False(t, perm.CanRead(unit.TypeWiki))
6464

6565
perm = Permission{
@@ -68,7 +68,7 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
6868
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
6969
},
7070
}
71-
applyEveryoneRepoPermission(&user_model.User{ID: 1}, &perm)
71+
finalProcessRepoUnitPermission(&user_model.User{ID: 1}, &perm)
7272
assert.True(t, perm.CanRead(unit.TypeWiki))
7373

7474
perm = Permission{
@@ -77,20 +77,22 @@ func TestApplyEveryoneRepoPermission(t *testing.T) {
7777
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
7878
},
7979
}
80-
applyEveryoneRepoPermission(&user_model.User{ID: 1}, &perm)
80+
finalProcessRepoUnitPermission(&user_model.User{ID: 1}, &perm)
8181
// it should work the same as "EveryoneAccessMode: none" because the default AccessMode should be applied to units
8282
assert.True(t, perm.CanWrite(unit.TypeWiki))
8383

8484
perm = Permission{
8585
units: []*repo_model.RepoUnit{
86+
{Type: unit.TypeCode}, // will be removed
8687
{Type: unit.TypeWiki, EveryoneAccessMode: perm_model.AccessModeRead},
8788
},
8889
unitsMode: map[unit.Type]perm_model.AccessMode{
8990
unit.TypeWiki: perm_model.AccessModeWrite,
9091
},
9192
}
92-
applyEveryoneRepoPermission(&user_model.User{ID: 1}, &perm)
93+
finalProcessRepoUnitPermission(&user_model.User{ID: 1}, &perm)
9394
assert.True(t, perm.CanWrite(unit.TypeWiki))
95+
assert.Len(t, perm.units, 1)
9496
}
9597

9698
func TestUnitAccessMode(t *testing.T) {

‎options/locale/locale_en-US.ini

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2158,7 +2158,7 @@ settings.advanced_settings = Advanced Settings
21582158
settings.wiki_desc = Enable Repository Wiki
21592159
settings.use_internal_wiki = Use Built-In Wiki
21602160
settings.default_wiki_branch_name = Default Wiki Branch Name
2161-
settings.default_wiki_everyone_access = Default Access Permission for signed-in users:
2161+
settings.default_permission_everyone_access = Default access permission for all signed-in users:
21622162
settings.failed_to_change_default_wiki_branch = Failed to change the default wiki branch.
21632163
settings.use_external_wiki = Use External Wiki
21642164
settings.external_wiki_url = External Wiki URL

‎routers/web/repo/issue_poster.go

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,9 @@ type userSearchResponse struct {
2626
Results []*userSearchInfo `json:"results"`
2727
}
2828

29-
// IssuePosters get posters for current repo's issues/pull requests
30-
func IssuePosters(ctx *context.Context) {
31-
issuePosters(ctx, false)
32-
}
33-
34-
func PullPosters(ctx *context.Context) {
35-
issuePosters(ctx, true)
29+
func IssuePullPosters(ctx *context.Context) {
30+
isPullList := ctx.PathParam("type") == "pulls"
31+
issuePosters(ctx, isPullList)
3632
}
3733

3834
func issuePosters(ctx *context.Context, isPullList bool) {

‎routers/web/repo/setting/setting.go

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,15 @@ const (
4949
tplDeployKeys templates.TplName = "repo/settings/deploy_keys"
5050
)
5151

52+
func parseEveryoneAccessMode(permission string, allowed ...perm.AccessMode) perm.AccessMode {
53+
// if site admin forces repositories to be private, then do not allow any other access mode,
54+
// otherwise the "force private" setting would be bypassed
55+
if setting.Repository.ForcePrivate {
56+
return perm.AccessModeNone
57+
}
58+
return perm.ParseAccessMode(permission, allowed...)
59+
}
60+
5261
// SettingsCtxData is a middleware that sets all the general context data for the
5362
// settings template.
5463
func SettingsCtxData(ctx *context.Context) {
@@ -447,8 +456,9 @@ func SettingsPost(ctx *context.Context) {
447456

448457
if form.EnableCode && !unit_model.TypeCode.UnitGlobalDisabled() {
449458
units = append(units, repo_model.RepoUnit{
450-
RepoID: repo.ID,
451-
Type: unit_model.TypeCode,
459+
RepoID: repo.ID,
460+
Type: unit_model.TypeCode,
461+
EveryoneAccessMode: parseEveryoneAccessMode(form.DefaultCodeEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead),
452462
})
453463
} else if !unit_model.TypeCode.UnitGlobalDisabled() {
454464
deleteUnitTypes = append(deleteUnitTypes, unit_model.TypeCode)
@@ -474,7 +484,7 @@ func SettingsPost(ctx *context.Context) {
474484
RepoID: repo.ID,
475485
Type: unit_model.TypeWiki,
476486
Config: new(repo_model.UnitConfig),
477-
EveryoneAccessMode: perm.ParseAccessMode(form.DefaultWikiEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead, perm.AccessModeWrite),
487+
EveryoneAccessMode: parseEveryoneAccessMode(form.DefaultWikiEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead, perm.AccessModeWrite),
478488
})
479489
deleteUnitTypes = append(deleteUnitTypes, unit_model.TypeExternalWiki)
480490
} else {
@@ -524,6 +534,7 @@ func SettingsPost(ctx *context.Context) {
524534
AllowOnlyContributorsToTrackTime: form.AllowOnlyContributorsToTrackTime,
525535
EnableDependencies: form.EnableIssueDependencies,
526536
},
537+
EveryoneAccessMode: parseEveryoneAccessMode(form.DefaultIssuesEveryoneAccess, perm.AccessModeNone, perm.AccessModeRead),
527538
})
528539
deleteUnitTypes = append(deleteUnitTypes, unit_model.TypeExternalTracker)
529540
} else {

0 commit comments

Comments
 (0)