Fix permission bugs in team API #647
Conversation
| ) | ||
|
|
||
| // ListTeams list all the teams of an organization | ||
| func ListTeams(ctx *context.APIContext) { | ||
| org := ctx.Org.Organization | ||
| if !org.IsOrgMember(ctx.User.ID) { |
There was a problem hiding this comment.
This depends public or private status of org members. If public, then everyone could visit the members.
There was a problem hiding this comment.
I don't understand what you are saying; this is an endpoint for viewing an organization's teams, not for viewing the members of those teams.
Regardless, the corresponding endpoint in the Github API (GET /orgs/:orgname/teams) is only accessible to organization members, so I believe that is what we want to do here
|
|
||
| // GetTeamMembers api for get a team's members | ||
| func GetTeamMembers(ctx *context.APIContext) { | ||
| if !models.IsOrganizationMember(ctx.Org.Team.OrgID, ctx.User.ID) { |
There was a problem hiding this comment.
The corresponding Github endpoint (GET /teams/:id) is only accessible to organization members (even if there are public members of the team), so I believe that is what we want to do here.
|
LGTM |
tboerger
added
the
lgtm/need 1
|
LGTM |
tboerger
added
lgtm/done
|
conflicted. |
|
LGTM |
|
Fixed |
ethantkoenig
force-pushed
the
api/org_fixes
branch
from
3211e6e to
8aa3d1d
Compare
|
Hello, Actually, in v1.1.2, there is no API endpoint to replace them. If you didn't remove anything in the Maybe I should open a issue about that ? Have a nice day |
|
@theznx The |
|
@ethantkoenig Oh! Sorry for the inconvenience. |
Some endpoints unnecessarily required the authenticated user to be an admin (basically everything removed from
api/v1/admin/org_team.go).Other endpoints didn't check that the authenticated user was an organization member.