From 02fa329a7c2190d947cd5e02ea90d2d4406653be Mon Sep 17 00:00:00 2001 From: Cirno the Strongest <1447794+CirnoT@users.noreply.github.com> Date: Fri, 29 May 2020 16:47:17 +0200 Subject: [PATCH] Fix missing authorization check on pull for public repos of private/limited org (#11656) Fixes #11651 --- routers/repo/http.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/routers/repo/http.go b/routers/repo/http.go index 650642a58..1eec03388 100644 --- a/routers/repo/http.go +++ b/routers/repo/http.go @@ -29,6 +29,7 @@ import ( "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/process" "code.gitea.io/gitea/modules/setting" + "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/modules/timeutil" repo_service "code.gitea.io/gitea/services/repository" ) @@ -135,6 +136,16 @@ func HTTP(ctx *context.Context) { environ []string ) + // don't allow anonymous pulls if organization is not public + if isPublicPull { + if err := repo.GetOwner(); err != nil { + ctx.ServerError("GetOwner", err) + return + } + + askAuth = askAuth || (repo.Owner.Visibility != structs.VisibleTypePublic) + } + // check access if askAuth { authUsername = ctx.Req.Header.Get(setting.ReverseProxyAuthUser)