[API] dont reqToken on GetReactions (fix #9543)

[6543]

fix #9543

[codecov-io]

Codecov Report

Merging #9548 into master will increase coverage by 0.01%.
The diff coverage is 60%.

@@            Coverage Diff             @@
##           master    #9548      +/-   ##
==========================================
+ Coverage   42.15%   42.16%   +0.01%     
==========================================
  Files         577      577              
  Lines       75982    75982              
==========================================
+ Hits        32027    32039      +12     
+ Misses      39979    39969      -10     
+ Partials     3976     3974       -2

Impacted Files	Coverage Δ
routers/api/v1/repo/issue_reaction.go	75.27% <0%> (ø)	⬆️
routers/api/v1/api.go	73.92% <100%> (ø)	⬆️
models/pull.go	46.54% <0%> (+0.48%)	⬆️
services/pull/check.go	55.63% <0%> (+2.11%)	⬆️
services/pull/temp_repo.go	34.18% <0%> (+2.56%)	⬆️
modules/process/manager.go	78.31% <0%> (+3.61%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b3c5b4b...33bf7dc. Read the comment docs.

[zeripath]

I think you need to take a look at:

gitea/routers/api/v1/repo/issue_reaction.go

Line 58 in d59536c

if !ctx.Repo.CanRead(models.UnitTypeIssues) && !ctx.User.IsAdmin {

Looking at:

gitea/routers/api/v1/api.go

Line 712 in d59536c

}, mustEnableIssuesOrPulls)

I don't think you need the check in issue_reaction.go - and if you're anonymous then I suspect that ctx.User.IsAdmin might cause a nil pointer.

[6543]

@zeripath done

[6543]

@lafriks does this https://github.com/go-gitea/gitea/pull/9548/files#diff-029cb1fefb1ae53a0ef72d3fd38a7f7dR16 resolfe your permission issue ?

-> I created a new file to make it reusable ...

[6543]

@zeripath !ctx.Repo.CanRead(models.UnitTypeIssues) && !ctx.User.IsAdmin works without login -> if issue is public, it works if not 404 is returned

[lunny]

I think we should keep !ctx.Repo.CanRead(models.UnitTypeIssues) and remove !ctx.User.IsAdmin, because the previous has included the next. And ctx.User may be nil.

[6543]

@lunny is this what you mean? fdf7965

[6543]

ready to merge 🚀