Skip to content

Commit 94cb84d

Browse files
wxiaoguangwxiaoguang
committed
fix
1 parent f586577 commit 94cb84d

File tree

6 files changed

+34
-154
lines changed

6 files changed

+34
-154
lines changed

‎models/issues/issue_project.go‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ package issues
55

66
import (
77
"context"
8-
"fmt"
98

109
"code.gitea.io/gitea/models/db"
1110
project_model "code.gitea.io/gitea/models/project"
@@ -107,8 +106,15 @@ func IssueAssignOrRemoveProject(ctx context.Context, issue *Issue, doer *user_mo
107106
if err != nil {
108107
return err
109108
}
110-
if newProject.RepoID != issue.RepoID && newProject.OwnerID != issue.Repo.OwnerID {
111-
return fmt.Errorf("issue's repository is not the same as project's repository")
109+
if newColumnID == 0 {
110+
newDefaultColumn, err := newProject.GetDefaultBoard(ctx)
111+
if err != nil {
112+
return err
113+
}
114+
newColumnID = newDefaultColumn.ID
115+
}
116+
if !newProject.CanBeAccessedByOwnerRepo(issue.Repo.OwnerID, issue.Repo.ID) {
117+
return util.NewPermissionDeniedErrorf("issue %d can't be accessed by project %d", issue.ID, newProject.ID)
112118
}
113119
}
114120

@@ -128,9 +134,12 @@ func IssueAssignOrRemoveProject(ctx context.Context, issue *Issue, doer *user_mo
128134
return err
129135
}
130136
}
131-
if newProjectID == 0 || newColumnID == 0 {
137+
if newProjectID == 0 {
132138
return nil
133139
}
140+
if newColumnID == 0 {
141+
panic("newColumnID must not be zero") // shouldn't happen
142+
}
134143

135144
res := struct {
136145
MaxSorting int64

‎models/project/project.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,13 @@ func (p *Project) IsRepositoryProject() bool {
161161
return p.Type == TypeRepository
162162
}
163163

164+
func (p *Project) CanBeAccessedByOwnerRepo(ownerID, repoID int64) bool {
165+
if p.Type == TypeOrganization {
166+
return p.OwnerID == ownerID && p.RepoID == 0
167+
}
168+
return p.OwnerID == ownerID && p.RepoID == repoID
169+
}
170+
164171
func init() {
165172
db.RegisterModel(new(Project))
166173
}

‎routers/web/org/projects.go‎

Lines changed: 0 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"errors"
88
"fmt"
99
"net/http"
10-
"strconv"
1110
"strings"
1211

1312
"code.gitea.io/gitea/models/db"
@@ -390,96 +389,6 @@ func ViewProject(ctx *context.Context) {
390389
ctx.HTML(http.StatusOK, tplProjectsView)
391390
}
392391

393-
func getActionIssues(ctx *context.Context) issues_model.IssueList {
394-
commaSeparatedIssueIDs := ctx.FormString("issue_ids")
395-
if len(commaSeparatedIssueIDs) == 0 {
396-
return nil
397-
}
398-
issueIDs := make([]int64, 0, 10)
399-
for _, stringIssueID := range strings.Split(commaSeparatedIssueIDs, ",") {
400-
issueID, err := strconv.ParseInt(stringIssueID, 10, 64)
401-
if err != nil {
402-
ctx.ServerError("ParseInt", err)
403-
return nil
404-
}
405-
issueIDs = append(issueIDs, issueID)
406-
}
407-
issues, err := issues_model.GetIssuesByIDs(ctx, issueIDs)
408-
if err != nil {
409-
ctx.ServerError("GetIssuesByIDs", err)
410-
return nil
411-
}
412-
// Check access rights for all issues
413-
issueUnitEnabled := ctx.Repo.CanRead(unit.TypeIssues)
414-
prUnitEnabled := ctx.Repo.CanRead(unit.TypePullRequests)
415-
for _, issue := range issues {
416-
if issue.RepoID != ctx.Repo.Repository.ID {
417-
ctx.NotFound("some issue's RepoID is incorrect", errors.New("some issue's RepoID is incorrect"))
418-
return nil
419-
}
420-
if issue.IsPull && !prUnitEnabled || !issue.IsPull && !issueUnitEnabled {
421-
ctx.NotFound("IssueOrPullRequestUnitNotAllowed", nil)
422-
return nil
423-
}
424-
if err = issue.LoadAttributes(ctx); err != nil {
425-
ctx.ServerError("LoadAttributes", err)
426-
return nil
427-
}
428-
}
429-
return issues
430-
}
431-
432-
// UpdateIssueProject change an issue's project
433-
func UpdateIssueProject(ctx *context.Context) {
434-
issues := getActionIssues(ctx)
435-
if ctx.Written() {
436-
return
437-
}
438-
439-
if err := issues.LoadProjects(ctx); err != nil {
440-
ctx.ServerError("LoadProjects", err)
441-
return
442-
}
443-
444-
projectID := ctx.FormInt64("id")
445-
var dstColumnID int64
446-
if projectID > 0 {
447-
dstProject, err := project_model.GetProjectByID(ctx, projectID)
448-
if err != nil {
449-
ctx.ServerError("GetProjectByID", err)
450-
return
451-
}
452-
if dstProject.OwnerID != ctx.ContextUser.ID {
453-
ctx.JSON(http.StatusUnprocessableEntity, map[string]string{
454-
"message": fmt.Sprintf("Project[%d] is not in Owner[%d] as expected", dstProject.ID, ctx.ContextUser.ID),
455-
})
456-
return
457-
}
458-
459-
dstDefaultColumn, err := dstProject.GetDefaultBoard(ctx)
460-
if err != nil {
461-
ctx.ServerError("GetDefaultBoard", err)
462-
return
463-
}
464-
dstColumnID = dstDefaultColumn.ID
465-
}
466-
467-
for _, issue := range issues {
468-
if issue.Project != nil {
469-
if issue.Project.ID == projectID {
470-
continue
471-
}
472-
}
473-
474-
if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, ctx.Doer, projectID, dstColumnID); err != nil {
475-
ctx.ServerError("ChangeProjectAssign", err)
476-
return
477-
}
478-
}
479-
480-
ctx.JSONOK()
481-
}
482-
483392
// DeleteProjectBoard allows for the deletion of a project board
484393
func DeleteProjectBoard(ctx *context.Context) {
485394
if ctx.Doer == nil {

‎routers/web/repo/projects.go‎

Lines changed: 7 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"code.gitea.io/gitea/modules/markup/markdown"
2222
"code.gitea.io/gitea/modules/optional"
2323
"code.gitea.io/gitea/modules/setting"
24+
"code.gitea.io/gitea/modules/util"
2425
"code.gitea.io/gitea/modules/web"
2526
"code.gitea.io/gitea/services/context"
2627
"code.gitea.io/gitea/services/forms"
@@ -389,36 +390,15 @@ func UpdateIssueProject(ctx *context.Context) {
389390
}
390391

391392
projectID := ctx.FormInt64("id")
392-
var dstColumnID int64
393-
if projectID > 0 {
394-
dstProject, err := project_model.GetProjectByID(ctx, projectID)
395-
if err != nil {
396-
ctx.ServerError("GetProjectByID", err)
397-
return
398-
}
399-
for _, issue := range issues {
400-
if dstProject.RepoID != ctx.Repo.Repository.ID && dstProject.OwnerID != issue.Repo.OwnerID {
401-
ctx.Error(http.StatusBadRequest, "project doesn't belong to the repository")
402-
return
403-
}
404-
}
405-
dstDefaultColumn, err := dstProject.GetDefaultBoard(ctx)
406-
if err != nil {
407-
ctx.ServerError("GetDefaultBoard", err)
408-
return
409-
}
410-
dstColumnID = dstDefaultColumn.ID
411-
}
412-
413393
for _, issue := range issues {
414-
if issue.Project != nil {
415-
if issue.Project.ID == projectID {
394+
if issue.Project != nil && issue.Project.ID == projectID {
395+
continue
396+
}
397+
if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, ctx.Doer, projectID, 0); err != nil {
398+
if errors.Is(err, util.ErrPermissionDenied) {
416399
continue
417400
}
418-
}
419-
420-
if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, ctx.Doer, projectID, dstColumnID); err != nil {
421-
ctx.ServerError("ChangeProjectAssign", err)
401+
ctx.ServerError("IssueAssignOrRemoveProject", err)
422402
return
423403
}
424404
}

‎routers/web/repo/pull.go‎

Lines changed: 6 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
git_model "code.gitea.io/gitea/models/git"
2121
issues_model "code.gitea.io/gitea/models/issues"
2222
access_model "code.gitea.io/gitea/models/perm/access"
23-
project_model "code.gitea.io/gitea/models/project"
2423
pull_model "code.gitea.io/gitea/models/pull"
2524
repo_model "code.gitea.io/gitea/models/repo"
2625
"code.gitea.io/gitea/models/unit"
@@ -1330,28 +1329,12 @@ func CompareAndPullRequestPost(ctx *context.Context) {
13301329
return
13311330
}
13321331

1333-
if projectID > 0 {
1334-
if !ctx.Repo.CanWrite(unit.TypeProjects) {
1335-
ctx.Error(http.StatusBadRequest, "user hasn't the permission to write to projects")
1336-
return
1337-
}
1338-
dstProject, err := project_model.GetProjectByID(ctx, projectID)
1339-
if err != nil {
1340-
ctx.ServerError("GetProjectByID", err)
1341-
return
1342-
}
1343-
if dstProject.RepoID != ctx.Repo.Repository.ID && dstProject.OwnerID != repo.OwnerID {
1344-
ctx.Error(http.StatusBadRequest, "project doesn't belong to the repository")
1345-
return
1346-
}
1347-
dstDefaultColumn, err := dstProject.GetDefaultBoard(ctx)
1348-
if err != nil {
1349-
ctx.ServerError("GetDefaultBoard", err)
1350-
return
1351-
}
1352-
if err := issues_model.IssueAssignOrRemoveProject(ctx, pullIssue, ctx.Doer, projectID, dstDefaultColumn.ID); err != nil {
1353-
ctx.ServerError("ChangeProjectAssign", err)
1354-
return
1332+
if projectID > 0 && ctx.Repo.CanWrite(unit.TypeProjects) {
1333+
if err := issues_model.IssueAssignOrRemoveProject(ctx, pullIssue, ctx.Doer, projectID, 0); err != nil {
1334+
if !errors.Is(err, util.ErrPermissionDenied) {
1335+
ctx.ServerError("IssueAssignOrRemoveProject", err)
1336+
return
1337+
}
13551338
}
13561339
}
13571340

‎services/issue/issue.go‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,7 @@ func NewIssue(ctx context.Context, repo *repo_model.Repository, issue *issues_mo
4242
}
4343
}
4444
if projectID > 0 {
45-
project, err := project_model.GetProjectByID(ctx, projectID)
46-
if err != nil {
47-
return err
48-
}
49-
defaultBoard, err := project.GetDefaultBoard(ctx)
50-
if err != nil {
51-
return err
52-
}
53-
if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, issue.Poster, projectID, defaultBoard.ID); err != nil {
45+
if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, issue.Poster, projectID, 0); err != nil {
5446
return err
5547
}
5648
}

0 commit comments

Comments
 (0)