Admin cannot delete repository via API if he is not the owner of the organization #2598

New Issue

GiteaMirror · 2025-11-02T04:41:38-06:00

GiteaMirror commented

2025-11-02 04:41:38 -06:00

Originally created by @ccaspers on GitHub (Dec 1, 2018).

Gitea version (or commit ref): d487a76
Git version:
Operating system:
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No (cannot become admin there)
- Not relevant
Log gist:

Description

When logged in as an admin, I can delete arbitray repositories using the web interface. The same is not true when using the API. When trying to delete a repository by requesting DELETE https://gitea.example.com/api/v1/repos/{owner}/{repo}, the response's status code is 403 with the body {"message":"Given user is not owner of organization.","url":"https://godoc.org/github.com/go-gitea/go-sdk/gitea"}

Originally created by @ccaspers on GitHub (Dec 1, 2018). - Gitea version (or commit ref): d487a76 - Git version: - Operating system: - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No (cannot become admin there) - [ ] Not relevant - Log gist: ## Description When logged in as an admin, I can delete arbitray repositories using the web interface. The same is not true when using the API. When trying to delete a repository by requesting `DELETE https://gitea.example.com/api/v1/repos/{owner}/{repo}`, the response's status code is 403 with the body `{"message":"Given user is not owner of organization.","url":"https://godoc.org/github.com/go-gitea/go-sdk/gitea"}`

GiteaMirror added the type/bug modifies/api labels 2025-11-02 04:41:38 -06:00

GiteaMirror closed this issue

2025-11-02 04:41:38 -06:00

GiteaMirror commented

2025-11-02 04:41:39 -06:00

@lunny commented on GitHub (Dec 2, 2018):

But in fact you should delete a repo as admin via /api/v1/admin/repos/delete?

@lunny commented on GitHub (Dec 2, 2018): But in fact you should delete a repo as admin via `/api/v1/admin/repos/delete`?

GiteaMirror commented

2025-11-02 04:41:39 -06:00

@ccaspers commented on GitHub (Dec 2, 2018):

@lunny if this is possible, documentation is missing on gitea's swagger ui. The route you mention is not listed here https://try.gitea.io/api/swagger

@ccaspers commented on GitHub (Dec 2, 2018): @lunny if this is possible, documentation is missing on gitea's swagger ui. The route you mention is not listed here https://try.gitea.io/api/swagger

GiteaMirror referenced this issue

2025-11-02 12:11:58 -06:00

[PR #2598] [MERGED] backport from v1.2 branch: add secrets for github release (#2588) #16495

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2598