Add Visible modes function from Organisation to Users too #16069

noerw · 2021-06-25T17:35:04Z

This must run after the ctx.Written() check below, otherwise we generate an internal server error.

Also there still is an information leak because the 404 response differs between a "true" 404, and this case.
Try the following .patch:

diff --git a/routers/api/v1/user/helper.go b/routers/api/v1/user/helper.go index fcdac257e..a3500e0ee 100644 --- a/routers/api/v1/user/helper.go +++ b/routers/api/v1/user/helper.go @@ -17,7 +17,7 @@ func GetUserByParamsName(ctx *context.APIContext, name string) *models.User { user, err := models.GetUserByName(username) if err != nil { if models.IsErrUserNotExist(err) { - if redirectUserID, err := models.LookupUserRedirect(username); err == nil { + if redirectUserID, err2 := models.LookupUserRedirect(username); err2 == nil { context.RedirectToUser(ctx.Context, username, redirectUserID) } else { ctx.NotFound("GetUserByName", err) diff --git a/routers/api/v1/user/user.go b/routers/api/v1/user/user.go index 44d392c47..1cf77bea4 100644 --- a/routers/api/v1/user/user.go +++ b/routers/api/v1/user/user.go @@ -103,11 +103,12 @@ func GetInfo(ctx *context.APIContext) { // "$ref": "#/responses/notFound" u := GetUserByParams(ctx) - if !u.IsVisibleToUser(ctx.User) { - ctx.JSON(http.StatusNotFound, nil) + if ctx.Written() { return } - if ctx.Written() { + if !u.IsVisibleToUser(ctx.User) { + // fake ErrUserNotExist error message to not leak information about existence + ctx.NotFound("GetUserByName", models.ErrUserNotExist{Name: ctx.Params(":username")}) return }

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add Visible modes function from Organisation to Users too #16069

Uh oh!

Diff view

Diff view

There are no files selected for viewing

noerw Jun 25, 2021 •

edited

Loading

Uh oh!

sergey-dryabzhinsky Jun 25, 2021

Uh oh!

-Original file line number
+Diff line change
@@ Expand Up / @@ -103,6 +103,10 @@ func GetInfo(ctx *context.APIContext) { @@
     	//     "$ref": "#/responses/notFound"
     	u := GetUserByParams(ctx)
+    	if !u.IsVisibleToUser(ctx.User) {
+    		ctx.JSON(http.StatusNotFound, nil)
+    		return
+    	}
     	if ctx.Written() {
     		return
     	}
@@ Expand Down @@

Uh oh!

Add Visible modes function from Organisation to Users too #16069

Uh oh!

Add Visible modes function from Organisation to Users too #16069

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

noerw Jun 25, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sergey-dryabzhinsky Jun 25, 2021

Choose a reason for hiding this comment

Uh oh!

noerw Jun 25, 2021 •

edited

Loading