Fix vulnerability reported in #3962

1 files changed, 7 insertions, 2 deletions

diff --git a/models/release.go b/models/release.go
index c79ff222..bac0e0f3 100644
--- a/models/release.go
+++ b/models/release.go
@@ -178,13 +178,18 @@ func UpdateRelease(gitRepo *git.Repository, rel *Release) (err error) {
 	return err
 }
 
-// DeleteReleaseByID deletes a release and corresponding Git tag by given ID.
-func DeleteReleaseByID(id int64) error {
+// DeleteReleaseByRepoID deletes a release and corresponding Git tag by given ID.
+func DeleteReleaseByRepoID(repoID, id int64) error {
 	rel, err := GetReleaseByID(id)
 	if err != nil {
 		return fmt.Errorf("GetReleaseByID: %v", err)
 	}
 
+	// Mark sure the delete operation againsts same repository.
+	if repoID != rel.RepoID {
+		return nil
+	}
+
 	repo, err := GetRepositoryByID(rel.RepoID)
 	if err != nil {
 		return fmt.Errorf("GetRepositoryByID: %v", err)