finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

#3057 retrieve webhook with repo_id

Browse source 
This prevents user retrieve arbitrary webhook by changing URL to
access webhook from other unauthorized repositories.
This commit is contained in:
Unknwon 2016-07-08 13:57:09 +08:00
parent e30c701386
commit d62ab49978
6 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
routers/api/v1/repo/hook.go
View file

@ -98,7 +98,7 @@ func CreateHook(ctx *context.APIContext, form api.CreateHookOption) {
// https://github.com/gogits/go-gogs-client/wiki/Repositories#edit-a-hook
func EditHook(ctx *context.APIContext, form api.EditHookOption) {
w, err := models.GetWebhookByID(ctx.ParamsInt64(":id"))
w, err := models.GetWebhookByID(ctx.Repo.Repository.ID, ctx.ParamsInt64(":id"))
if err != nil {
if models.IsErrWebhookNotExist(err) {
ctx.Status(404)

2
routers/repo/webhook.go
View file

@ -220,7 +220,7 @@ func checkWebhook(ctx *context.Context) (*OrgRepoCtx, *models.Webhook) {
}
ctx.Data["BaseLink"] = orCtx.Link
w, err := models.GetWebhookByID(ctx.ParamsInt64(":id"))
w, err := models.GetWebhookByID(ctx.Repo.Repository.ID, ctx.ParamsInt64(":id"))
if err != nil {
if models.IsErrWebhookNotExist(err) {
ctx.Handle(404, "GetWebhookByID", nil)