Admin cannot access all teams via API #1668

New Issue

GiteaMirror · 2025-11-02T04:08:58-06:00

GiteaMirror commented

2025-11-02 04:08:58 -06:00

Originally created by @mxmehl on GitHub (Apr 1, 2018).

Gitea version (or commit ref): 1.4.0
Git version: 2.1.4
Operating system: Debian 8
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I am admin on my Gitea installation and created an API key for me. Although having the highest access permission, I cannot access the API orgs/{org}/teams if I'm not member of this organisation (example: "other-org"):

$ curl -s -X GET "https://git.example.org/api/v1/orgs/other-org/teams" -H  "accept: application/json" -H "Authorization: token ce106f4de28xxxx"
{"message":"Must be an organization member","url":"https://godoc.org/github.com/go-gitea/go-sdk/gitea"

In the web interface I can see all information about the organization and the teams. Accessing the exact same information via API for organisations I'm member of works perfectly fine.

This behaviour is unexpected because the Admin should be able to access the same information via API as via web interface.

Originally created by @mxmehl on GitHub (Apr 1, 2018). - Gitea version (or commit ref): 1.4.0 - Git version: 2.1.4 - Operating system: Debian 8 - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description I am admin on my Gitea installation and created an API key for me. Although having the highest access permission, I cannot access the API `orgs/{org}/teams` if I'm not member of this organisation (example: "other-org"): ``` $ curl -s -X GET "https://git.example.org/api/v1/orgs/other-org/teams" -H "accept: application/json" -H "Authorization: token ce106f4de28xxxx" {"message":"Must be an organization member","url":"https://godoc.org/github.com/go-gitea/go-sdk/gitea" ``` In the web interface I can see all information about the organization and the teams. Accessing the exact same information via API for organisations I'm member of works perfectly fine. This behaviour is unexpected because the Admin should be able to access the same information via API as via web interface.

GiteaMirror added the type/proposal modifies/api labels 2025-11-02 04:08:58 -06:00

GiteaMirror closed this issue

2025-11-02 04:08:58 -06:00

GiteaMirror commented

2025-11-02 04:08:58 -06:00

@yp05327 commented on GitHub (Oct 1, 2024):

I think this has been fixed by #6483.
reqOrgMembership will check whether user is site admin first.

@yp05327 commented on GitHub (Oct 1, 2024): I think this has been fixed by #6483. `reqOrgMembership` will check whether user is site admin first.

GiteaMirror referenced this issue

2025-11-02 11:59:31 -06:00

[PR #1668] [MERGED] Exposes in API the Repo entity's Size and IsBare property #15982

GiteaMirror referenced this issue