fix(sec): modify api route for variables

Gusted · earl-warren · commit caeb95cb1015 · 2025-02-08T07:21:14.000Z
diff --git a/routers/api/v1/org/action.go b/routers/api/v1/org/action.go
@@ -475,7 +475,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Org.Organization.ID, 0, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {
diff --git a/routers/api/v1/repo/action.go b/routers/api/v1/repo/action.go
@@ -414,7 +414,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, 0, ctx.Repo.Repository.ID, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {
diff --git a/routers/api/v1/user/action.go b/routers/api/v1/user/action.go
@@ -228,7 +228,7 @@ func UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Doer.ID, 0, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {

Original file line number	Diff line number	Diff line change
`@@ -475,7 +475,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {`
`475`	`475`	`if opt.Name == "" {`
`476`	`476`	`opt.Name = ctx.Params("variablename")`
`477`	`477`	`}`
`478`		`- if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {`
	`478`	`+ if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Org.Organization.ID, 0, opt.Name, opt.Value); err != nil {`
`479`	`479`	`if errors.Is(err, util.ErrInvalidArgument) {`
`480`	`480`	`ctx.Error(http.StatusBadRequest, "UpdateVariable", err)`
`481`	`481`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -414,7 +414,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {`
`414`	`414`	`if opt.Name == "" {`
`415`	`415`	`opt.Name = ctx.Params("variablename")`
`416`	`416`	`}`
`417`		`- if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {`
	`417`	`+ if _, err := actions_service.UpdateVariable(ctx, v.ID, 0, ctx.Repo.Repository.ID, opt.Name, opt.Value); err != nil {`
`418`	`418`	`if errors.Is(err, util.ErrInvalidArgument) {`
`419`	`419`	`ctx.Error(http.StatusBadRequest, "UpdateVariable", err)`
`420`	`420`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -228,7 +228,7 @@ func UpdateVariable(ctx *context.APIContext) {`
`228`	`228`	`if opt.Name == "" {`
`229`	`229`	`opt.Name = ctx.Params("variablename")`
`230`	`230`	`}`
`231`		`- if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {`
	`231`	`+ if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Doer.ID, 0, opt.Name, opt.Value); err != nil {`
`232`	`232`	`if errors.Is(err, util.ErrInvalidArgument) {`
`233`	`233`	`ctx.Error(http.StatusBadRequest, "UpdateVariable", err)`
`234`	`234`	`} else {`