mirror of
https://github.com/VibedByKaKi/forgejo-11-secure.git
synced 2026-10-14 14:28:07 +02:00
b61f9383df
Keep v11.0.16 current with security fixes that are already in a published upstream release, through v16.0.5 (2026-09-17). BACKPORTS.md records what landed, what was skipped, and the latest tag checked. Publish forgejo-<version>-linux-amd64 from version tags. Co-authored-by: KaKi87 <KaKi87@pm.me>
39 lines
1.4 KiB
Go
39 lines
1.4 KiB
Go
// Copyright 2026 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package access
|
|
|
|
import (
|
|
"context"
|
|
|
|
repo_model "forgejo.org/models/repo"
|
|
)
|
|
|
|
// PublicOnlyContextKey marks an API request whose token is limited to public resources.
|
|
// v11 does not have the authorization-reducer framework added in later Forgejo releases.
|
|
// This flag carries the public-only restriction into permission checks that would
|
|
// otherwise use the user's full access, which is the part of the v15.0.7 / v16.0.3
|
|
// pull-request update fix that applies on v11.
|
|
type publicOnlyContextKey struct{}
|
|
|
|
// PublicOnlyContextKey is the context key set for public-only API tokens.
|
|
var PublicOnlyContextKey publicOnlyContextKey
|
|
|
|
// IsPublicOnly reports whether ctx was marked as a public-only API token request.
|
|
func IsPublicOnly(ctx context.Context) bool {
|
|
v, _ := ctx.Value(PublicOnlyContextKey).(bool)
|
|
return v
|
|
}
|
|
|
|
// RepoVisibleToPublicOnly reports whether a public-only token may use this repository.
|
|
// Matches the later PublicReposAuthorizationReducer: the owner must be public and the
|
|
// repository itself must not be private.
|
|
func RepoVisibleToPublicOnly(ctx context.Context, repo *repo_model.Repository) (bool, error) {
|
|
if repo == nil {
|
|
return false, nil
|
|
}
|
|
if err := repo.LoadOwner(ctx); err != nil {
|
|
return false, err
|
|
}
|
|
return !repo.IsPrivate && repo.Owner.Visibility.IsPublic(), nil
|
|
}
|