From 1592e578ed3ac7190baed6165b093002b931520c Mon Sep 17 00:00:00 2001 From: unknwon Date: Thu, 1 Aug 2019 18:26:05 -0700 Subject: routes/api: add missing permission checks for routes Permission check not enforced for deploy keys, collaborators, and hooks. Reported by @ManassehZhou #5764 --- routes/api/v1/api.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'routes/api/v1/api.go') diff --git a/routes/api/v1/api.go b/routes/api/v1/api.go index d73f57f3..54f7e7ef 100644 --- a/routes/api/v1/api.go +++ b/routes/api/v1/api.go @@ -236,12 +236,12 @@ func RegisterRoutes(m *macaron.Macaron) { Post(bind(api.CreateHookOption{}), repo.CreateHook) m.Combo("/:id").Patch(bind(api.EditHookOption{}), repo.EditHook). Delete(repo.DeleteHook) - }) + }, reqAdmin()) m.Group("/collaborators", func() { m.Get("", repo.ListCollaborators) m.Combo("/:collaborator").Get(repo.IsCollaborator).Put(bind(api.AddCollaboratorOption{}), repo.AddCollaborator). Delete(repo.DeleteCollaborator) - }) + }, reqAdmin()) m.Get("/raw/*", context.RepoRef(), repo.GetRawFile) m.Get("/archive/*", repo.GetArchive) m.Get("/forks", repo.ListForks) @@ -260,7 +260,7 @@ func RegisterRoutes(m *macaron.Macaron) { Post(bind(api.CreateKeyOption{}), repo.CreateDeployKey) m.Combo("/:id").Get(repo.GetDeployKey). Delete(repo.DeleteDeploykey) - }) + }, reqAdmin()) m.Group("/issues", func() { m.Combo("").Get(repo.ListIssues).Post(bind(api.CreateIssueOption{}), repo.CreateIssue) m.Group("/comments", func() { -- cgit v1.2.3