oss/forgejo
oss/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-09-15 18:56:59 +00:00
Code Wiki Activity

Prevent anonymous container access if RequireSignInView is enabled (#28877) (#28882)

Browse source 
Backport #28877 by @KN4CK3R

Fixes #28875

If `RequireSignInView` is enabled, the ghost user has no access rights.

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
(cherry picked from commit b7c944b9e4)
This commit is contained in:
Giteabot 2024-01-22 01:44:38 +08:00 • committed by Earl Warren
parent 80dfa56d2f
commit e2620642bd
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
3 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
routers/api/packages/container/container.go
View file

@ -114,11 +114,15 @@ func apiErrorDefined(ctx *context.Context, err *namedError) {
})
}
// ReqContainerAccess is a middleware which checks the current user valid (real user or ghost for anonymous access)
func apiUnauthorizedError(ctx *context.Context) {
ctx.Resp.Header().Add("WWW-Authenticate", `Bearer realm="`+setting.AppURL+`v2/token",service="container_registry",scope="*"`)
apiErrorDefined(ctx, errUnauthorized)
}
// ReqContainerAccess is a middleware which checks the current user valid (real user or ghost if anonymous access is enabled)
func ReqContainerAccess(ctx *context.Context) {
if ctx.Doer == nil {
ctx.Resp.Header().Add("WWW-Authenticate", `Bearer realm="`+setting.AppURL+`v2/token",service="container_registry",scope="*"`)
apiErrorDefined(ctx, errUnauthorized)
if ctx.Doer == nil || (setting.Service.RequireSignInView && ctx.Doer.IsGhost()) {
apiUnauthorizedError(ctx)
}
}
@ -138,10 +142,15 @@ func DetermineSupport(ctx *context.Context) {
}
// Authenticate creates a token for the current user
// If the current user is anonymous, the ghost user is used
// If the current user is anonymous, the ghost user is used unless RequireSignInView is enabled.
func Authenticate(ctx *context.Context) {
u := ctx.Doer
if u == nil {
if setting.Service.RequireSignInView {
apiUnauthorizedError(ctx)
return
}
u = user_model.NewGhostUser()
}