owen/gitocean
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: comment attachment API is more restrictive than the web UI (#11623)

Browse Source 
The permission check for editing the attachments of a comment (adding or removing them) is changed to be the same as when editing the textual body of the comment.

The poster of a comment can always edit it via the web UI, which includes the ability to remove or add attachments. It does not require write permission on the issue or pull unit of the repository.

The API is consistent with the web UI in how it [verifies permissions for editing comments][0] when modifying the textual content. However, when adding or removing the attachments of a comment, it [also requires write permissions][1] on the issue or pull unit, which is inconsistent with the web UI and more restrictive.

[0]: https://codeberg.org/forgejo/forgejo/src/commit/a58105960684a456009b55d839d59a8da42e73cc/routers/api/v1/repo/issue_comment.go#L606
[1]: https://codeberg.org/forgejo/forgejo/src/commit/a58105960684a456009b55d839d59a8da42e73cc/routers/api/v1/repo/issue_comment_attachment.go#L359

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11623
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: limiting-factor <limiting-factor@posteo.com>
Co-committed-by: limiting-factor <limiting-factor@posteo.com>
This commit is contained in:
limiting-factor
2026-03-19 01:39:29 +01:00
committed by Gusted
parent 4ce44e24d6
commit 3c92b40915
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/repo/issue_comment_attachment.go
+2 -2
View File
@@ -356,8 +356,8 @@ func canUserWriteIssueCommentAttachment(ctx *context.APIContext) bool {
// ctx.Comment is assumed to be set in a safe way via a middleware
comment := ctx.Comment
canEditComment := ctx.IsSigned && (ctx.Doer.ID == comment.PosterID || ctx.IsUserRepoAdmin() || ctx.IsUserSiteAdmin()) && ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull)
if !canEditComment {
cannotEditComment := !ctx.IsSigned || (ctx.Doer.ID != comment.PosterID && !ctx.Repo.CanWriteIssuesOrPulls(comment.Issue.IsPull))
if cannotEditComment {
ctx.Error(http.StatusForbidden, "", "user should have permission to edit comment")
return false
}
tests/integration/api_comment_attachment_test.go
+4 -2
View File
@@ -96,12 +96,14 @@ func TestAPIListCommentAttachments(t *testing.T) {
func TestAPICreateCommentAttachment(t *testing.T) {
defer tests.PrepareTestEnv(t)()
comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 2})
comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 3})
issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: comment.IssueID})
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issue.RepoID})
repoOwner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
commentPoster := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: comment.PosterID})
session := loginUser(t, repoOwner.Name)
session := loginUser(t, commentPoster.Name)
require.NotEqual(t, commentPoster.Name, repoOwner.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
filename := "image.png"