This commit is contained in:
@@ -6,36 +6,36 @@ package packages
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
auth_model "code.gitea.io/gitea/models/auth"
|
||||
"code.gitea.io/gitea/models/perm"
|
||||
"code.gitea.io/gitea/modules/log"
|
||||
"code.gitea.io/gitea/modules/setting"
|
||||
"code.gitea.io/gitea/modules/web"
|
||||
"code.gitea.io/gitea/routers/api/packages/alpine"
|
||||
"code.gitea.io/gitea/routers/api/packages/arch"
|
||||
"code.gitea.io/gitea/routers/api/packages/cargo"
|
||||
"code.gitea.io/gitea/routers/api/packages/chef"
|
||||
"code.gitea.io/gitea/routers/api/packages/composer"
|
||||
"code.gitea.io/gitea/routers/api/packages/conan"
|
||||
"code.gitea.io/gitea/routers/api/packages/conda"
|
||||
"code.gitea.io/gitea/routers/api/packages/container"
|
||||
"code.gitea.io/gitea/routers/api/packages/cran"
|
||||
"code.gitea.io/gitea/routers/api/packages/debian"
|
||||
"code.gitea.io/gitea/routers/api/packages/generic"
|
||||
"code.gitea.io/gitea/routers/api/packages/goproxy"
|
||||
"code.gitea.io/gitea/routers/api/packages/helm"
|
||||
"code.gitea.io/gitea/routers/api/packages/maven"
|
||||
"code.gitea.io/gitea/routers/api/packages/npm"
|
||||
"code.gitea.io/gitea/routers/api/packages/nuget"
|
||||
"code.gitea.io/gitea/routers/api/packages/pub"
|
||||
"code.gitea.io/gitea/routers/api/packages/pypi"
|
||||
"code.gitea.io/gitea/routers/api/packages/rpm"
|
||||
"code.gitea.io/gitea/routers/api/packages/rubygems"
|
||||
"code.gitea.io/gitea/routers/api/packages/swift"
|
||||
"code.gitea.io/gitea/routers/api/packages/terraform"
|
||||
"code.gitea.io/gitea/routers/api/packages/vagrant"
|
||||
"code.gitea.io/gitea/services/auth"
|
||||
"code.gitea.io/gitea/services/context"
|
||||
auth_model "gitea.dev/models/auth"
|
||||
"gitea.dev/models/perm"
|
||||
"gitea.dev/modules/log"
|
||||
"gitea.dev/modules/setting"
|
||||
"gitea.dev/modules/web"
|
||||
"gitea.dev/routers/api/packages/alpine"
|
||||
"gitea.dev/routers/api/packages/arch"
|
||||
"gitea.dev/routers/api/packages/cargo"
|
||||
"gitea.dev/routers/api/packages/chef"
|
||||
"gitea.dev/routers/api/packages/composer"
|
||||
"gitea.dev/routers/api/packages/conan"
|
||||
"gitea.dev/routers/api/packages/conda"
|
||||
"gitea.dev/routers/api/packages/container"
|
||||
"gitea.dev/routers/api/packages/cran"
|
||||
"gitea.dev/routers/api/packages/debian"
|
||||
"gitea.dev/routers/api/packages/generic"
|
||||
"gitea.dev/routers/api/packages/goproxy"
|
||||
"gitea.dev/routers/api/packages/helm"
|
||||
"gitea.dev/routers/api/packages/maven"
|
||||
"gitea.dev/routers/api/packages/npm"
|
||||
"gitea.dev/routers/api/packages/nuget"
|
||||
"gitea.dev/routers/api/packages/pub"
|
||||
"gitea.dev/routers/api/packages/pypi"
|
||||
"gitea.dev/routers/api/packages/rpm"
|
||||
"gitea.dev/routers/api/packages/rubygems"
|
||||
"gitea.dev/routers/api/packages/swift"
|
||||
"gitea.dev/routers/api/packages/terraform"
|
||||
"gitea.dev/routers/api/packages/vagrant"
|
||||
"gitea.dev/services/auth"
|
||||
"gitea.dev/services/context"
|
||||
)
|
||||
|
||||
func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
|
||||
@@ -73,7 +73,9 @@ func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
|
||||
}
|
||||
|
||||
if publicOnly {
|
||||
if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {
|
||||
// a public-only token must not reach limited-visibility owners either,
|
||||
// matching how orgs/users are enforced elsewhere in this file
|
||||
if ctx.Package != nil && !ctx.Package.Owner.Visibility.IsPublic() {
|
||||
ctx.HTTPError(http.StatusForbidden, "reqToken", "token scope is limited to public packages")
|
||||
return
|
||||
}
|
||||
@@ -133,7 +135,7 @@ func CommonRoutes() *web.Router {
|
||||
r.Group("/{branch}/{repository}", func() {
|
||||
r.Put("", reqPackageAccess(perm.AccessModeWrite), alpine.UploadPackageFile)
|
||||
r.Group("/{architecture}", func() {
|
||||
r.Get("/APKINDEX.tar.gz", alpine.GetRepositoryFile)
|
||||
r.Methods("HEAD,GET", "/APKINDEX.tar.gz", alpine.GetRepositoryFile)
|
||||
r.Group("/{filename}", func() {
|
||||
r.Get("", alpine.DownloadPackageFile)
|
||||
r.Delete("", reqPackageAccess(perm.AccessModeWrite), alpine.DeletePackageFile)
|
||||
|
||||
Reference in New Issue
Block a user