Docker/forgejo
Docker/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-08-02 16:35:19 +02:00
Code Issues Releases Activity

fix: pass doer's ID for CRUD instance signing (#8304)

Browse source 
- When doing CRUD actions, the commiter and author are reconstructed and
do not contain the doer's ID. Make sure to pass this ID along so it can
be used to verify the rules of instance signing for CRUD actions.
- Regression of forgejo/forgejo#7693. It seems that previously this
didn't work correctly as it would not care about a empty ID.
- Resolves forgejo/forgejo#8278

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8304
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This commit is contained in:
Gusted 2025-06-27 15:43:31 +02:00 • committed by Earl Warren
parent 3fb6e17105
commit c085d6c9ac
2 changed files with 85 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

51
services/repository/files/file.go
View file

@ -104,36 +104,35 @@ func GetAuthorAndCommitterUsers(author, committer *IdentityOptions, doer *user_m
// then we use bogus User objects for them to store their FullName and Email.
// If only one of the two are provided, we set both of them to it.
// If neither are provided, both are the doer.
if committer != nil && committer.Email != "" {
if doer != nil && strings.EqualFold(doer.Email, committer.Email) {
committerUser = doer // the committer is the doer, so will use their user object
if committer.Name != "" {
committerUser.FullName = committer.Name
getUser := func(identity *IdentityOptions) *user_model.User {
if identity == nil || identity.Email == "" {
return nil
}
if doer != nil && strings.EqualFold(doer.Email, identity.Email) {
user := doer // the committer is the doer, so will use their user object
if identity.Name != "" {
user.FullName = identity.Name
}
// Use the provided email and not revert to placeholder mail.
committerUser.KeepEmailPrivate = false
} else {
committerUser = &user_model.User{
FullName: committer.Name,
Email: committer.Email,
}
}
}
if author != nil && author.Email != "" {
if doer != nil && strings.EqualFold(doer.Email, author.Email) {
authorUser = doer // the author is the doer, so will use their user object
if authorUser.Name != "" {
authorUser.FullName = author.Name
}
// Use the provided email and not revert to placeholder mail.
authorUser.KeepEmailPrivate = false
} else {
authorUser = &user_model.User{
FullName: author.Name,
Email: author.Email,
}
user.KeepEmailPrivate = false
return user
}
var id int64
if doer != nil {
id = doer.ID
}
return &user_model.User{
ID: id, // Needed to ensure the doer is checked to pass rules for instance signing of CRUD actions.
FullName: identity.Name,
Email: identity.Email,
}
}
committerUser = getUser(committer)
authorUser = getUser(author)
if authorUser == nil {
if committerUser != nil {
authorUser = committerUser // No valid author was given so use the committer