The web route to update and delete variables of runners did not check if
the ID that was given belonged to the context it was requested in, this
made it possible to update and delete every existing runner variable of
a instance for any authenticated user.
The code has been reworked to always take into account the context of
the request (owner and repository ID).
(cherry picked from commit 5cb8fdfc8b9213cc368cd074aac93a1327ea20b0)
The commit has, in addition to the implementation of the API, a few
function refactor that are useful in backports.
---
close#27801
---------
Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit 62b073e6f31645e446c7e8d6b5a506f61b47924e)
Conflicts:
- modules/util/util.go
Trivial resolution, only picking the newly introduced function
- routers/api/v1/swagger/options.go
Trivial resolution. We don't have UserBadges, don't pick that part.
- templates/swagger/v1_json.tmpl
Regenerated.
(cherry picked from commit 16696a42f5)
This PR adds instance-level variables, and so closes#27726
