Skip to content

Commit c1110b8

Browse files
zeripath6543techknowlogick
authored
Ensure correct SSH permissions check for private and restricted users (#17370)
Repositories owned by private users and organisations and pulls by restricted users need to have permissions checked. Previously Serv would simply assumed that if the user could log in and the repository was not private then it would be visible. Fix #17364 Signed-off-by: Andrew Thornton <[email protected]> Co-authored-by: 6543 <[email protected]> Co-authored-by: techknowlogick <[email protected]>
1 parent c5a408d commit c1110b8

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

routers/private/serv.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,12 @@ func ServCommand(ctx *context.PrivateContext) {
279279
}
280280

281281
// Permissions checking:
282-
if repoExist && (mode > models.AccessModeRead || repo.IsPrivate || setting.Service.RequireSignInView) {
282+
if repoExist &&
283+
(mode > models.AccessModeRead ||
284+
repo.IsPrivate ||
285+
owner.Visibility.IsPrivate() ||
286+
user.IsRestricted ||
287+
setting.Service.RequireSignInView) {
283288
if key.Type == models.KeyTypeDeploy {
284289
if deployKey.Mode < mode {
285290
ctx.JSON(http.StatusUnauthorized, private.ErrServCommand{
@@ -289,7 +294,7 @@ func ServCommand(ctx *context.PrivateContext) {
289294
return
290295
}
291296
} else {
292-
// Because of special ref "refs/for" .. , need delay write permission check
297+
// Because of the special ref "refs/for" we will need to delay write permission check
293298
if git.SupportProcReceive && unitType == models.UnitTypeCode {
294299
mode = models.AccessModeRead
295300
}

0 commit comments

Comments
 (0)