Pull Requests can be listed without having the corresponding permission #2128

New Issue

GiteaMirror · 2025-11-02T04:24:54-06:00

GiteaMirror commented

2025-11-02 04:24:54 -06:00

Originally created by @L-P on GitHub (Aug 1, 2018).

Gitea version (or commit ref): 1.4.3 (docker)
Git version: 2.15.2
Operating system: Alpine 3.7 (docker)
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No (try is down)
- Not relevant
Log gist:

Description

I created an "extern" team on an organization with read-only access to code
only, and assigned a single repository to it. (see the attached screenshot)

When going to /pulls with an account assigned to this extern team (and this
team only) I can list all pull requests, including the title, author, date
number of comments and open/closed status.
When trying to access the details of a single PR I get the expected 404.

Being able to list the pull requests when I specifically disabled the right to
access them is an information leak and a security issue.

Screenshots

Originally created by @L-P on GitHub (Aug 1, 2018). - Gitea version (or commit ref): 1.4.3 (docker) - Git version: 2.15.2 - Operating system: Alpine 3.7 (docker) - Database (use `[x]`): - [ ] PostgreSQL - [X] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [X] No (try is down) - [ ] Not relevant - Log gist: ## Description I created an "extern" team on an organization with read-only access to code only, and assigned a single repository to it. (see the attached screenshot) When going to `/pulls` with an account assigned to this extern team (and this team only) I can list all pull requests, including the title, author, date number of comments and open/closed status. When trying to access the details of a single PR I get the expected 404. Being able to list the pull requests when I specifically disabled the right to access them is an information leak and a security issue. ## Screenshots ![Permissions screen](https://user-images.githubusercontent.com/947312/43513592-746d4756-957e-11e8-80b7-45dfbc0d1836.png)

GiteaMirror added the topic/security label 2025-11-02 04:24:54 -06:00

GiteaMirror closed this issue

2025-11-02 04:24:54 -06:00

GiteaMirror commented

2025-11-02 04:24:55 -06:00

@lunny commented on GitHub (Oct 29, 2018):

Cannot reproduce this on 7694c99ab3

@lunny commented on GitHub (Oct 29, 2018): Cannot reproduce this on 7694c99ab343af5aaaf690232377bc439911e1a3

GiteaMirror commented

2025-11-02 04:24:55 -06:00

@lunny commented on GitHub (Dec 8, 2018):

This should be fixed if exist by #5314