github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-05-06 02:02:32 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Correct comments another users in PR #6461

New Issue
Open
opened 2025-11-02 06:56:46 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-02 06:56:46 -06:00
Owner
Copy Link

Originally created by @melmus on GitHub (Dec 4, 2020).

  • Gitea version (or commit ref):
    1.14.0+dev-225-g5bd05331c
    1.14.0+dev-315-gbb50ab286
  • Git version:
    2.26.2
  • Operating system:
    Ubuntu 18.04.5 LTS
    Gitea running in docker
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
  • Log gist:

Description

In pull request I can correct comments from another users.

Screenshots

Peek 2020-10-06 17-14

Originally created by @melmus on GitHub (Dec 4, 2020). <!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue --> <!-- 1. Please speak English, this is the language all maintainers can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/gitea) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): 1.14.0+dev-225-g5bd05331c 1.14.0+dev-315-gbb50ab286 - Git version: 2.26.2 - Operating system: Ubuntu 18.04.5 LTS Gitea running in docker <!-- Please include information on whether you built gitea yourself, used one of our downloads or are using some other package --> <!-- Please also tell us how you are running gitea, e.g. if it is being run from docker, a command-line, systemd etc. ---> <!-- If you are using a package or systemd tell us what distribution you are using --> - Database (use `[x]`): - [X] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - Log gist: <!-- It really is important to provide pertinent logs --> <!-- Please read https://docs.gitea.io/en-us/logging-configuration/#debugging-problems --> <!-- In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini --> ## Description In pull request I can correct comments from another users. ## Screenshots ![Peek 2020-10-06 17-14](https://user-images.githubusercontent.com/15018126/101194240-c5eedc00-366e-11eb-8702-a5d3e5996c31.gif) <!-- **If this issue involves the Web Interface, please include a screenshot** -->
GiteaMirror added the type/enhancement label 2025-11-02 06:56:46 -06:00
GiteaMirror commented 2025-11-02 06:56:47 -06:00
Author
Owner
Copy Link

@lafriks commented on GitHub (Dec 4, 2020):

If you have administrative rights for this repository (owner or in org team with admin level) you are allowed to do that

@lafriks commented on GitHub (Dec 4, 2020): If you have administrative rights for this repository (owner or in org team with admin level) you are allowed to do that
GiteaMirror commented 2025-11-02 06:56:47 -06:00
Author
Owner
Copy Link

@vnkmpf commented on GitHub (Jan 5, 2021):

I noticed the same problem - any user can edit or delete anybody else's comment.
The repo has no organization, owner is one user (admin) where other users are collaborators with write access (when tested with read-only access, they were not able to edit or delete).
The users also don't have admin role in user accounts.

And it happens to me in 1.13.1 and also happened in 1.13.0.

@vnkmpf commented on GitHub (Jan 5, 2021): I noticed the same problem - any user can edit or delete anybody else's comment. The repo has no organization, owner is one user (admin) where other users are collaborators with write access (when tested with read-only access, they were not able to edit or delete). The users also don't have admin role in user accounts. And it happens to me in 1.13.1 and also happened in 1.13.0.
GiteaMirror commented 2025-11-02 06:56:47 -06:00
Author
Owner
Copy Link

@vnkmpf commented on GitHub (Feb 16, 2021):

@lafriks I checked the code, and to me it looks like admin level was true before refactoring. PR #5314 changed this
I observe that anybody with writing rights can edit and delete anybody else's comments.

It's probably not only on back-end, changes were made in displaying context menu in PR comment (https://github.com/go-gitea/gitea/pull/10872/files#diff-d998e758fb6c1244cd2d75550a1ecbd64065e0e8bf155d89e95bd7aec72ad55fR13)

Is this expected behavior?
I would personally expect, that people who can change / delete comments are:

  • owners,
  • admins,
  • authors of the comment.
@vnkmpf commented on GitHub (Feb 16, 2021): @lafriks I checked the code, and to me it looks like admin level was true before refactoring. PR #5314 [changed this](https://github.com/go-gitea/gitea/pull/5314/files#diff-48c8791f86b36b38bb6d8c33cbf71ecda001cf5985ad99c66b99541afbe21169R1166) I observe that anybody with writing rights can edit and delete anybody else's comments. It's probably not only on back-end, changes were made in displaying context menu in PR comment (https://github.com/go-gitea/gitea/pull/10872/files#diff-d998e758fb6c1244cd2d75550a1ecbd64065e0e8bf155d89e95bd7aec72ad55fR13) Is this expected behavior? I would personally expect, that people who can change / delete comments are: - owners, - admins, - authors of the comment.
GiteaMirror commented 2025-11-02 06:56:48 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Feb 16, 2021):

I noticed the same problem - any user can edit or delete anybody else's comment.
The repo has no organization, owner is one user (admin) where other users are collaborators with write access (when tested with read-only access, they were not able to edit or delete).

Write access in the case of issues - means editing other users comments and issues.

@zeripath commented on GitHub (Feb 16, 2021): > I noticed the same problem - any user can edit or delete anybody else's comment. > The repo has no organization, owner is one user (admin) where other users are collaborators with write access (when tested with read-only access, they were not able to edit or delete). Write access in the case of issues - means editing other users comments and issues.
GiteaMirror commented 2025-11-02 06:56:48 -06:00
Author
Owner
Copy Link

@vnkmpf commented on GitHub (Feb 16, 2021):

So is it not possible to give people access to write (push) to a repository without also giving them access to edit/delete other users' review comments?

@vnkmpf commented on GitHub (Feb 16, 2021): So is it not possible to give people access to write (push) to a repository without also giving them access to edit/delete other users' review comments?
GiteaMirror commented 2025-11-02 06:56:48 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Feb 16, 2021):

Hmm... I guess this is yet another example of how collaborators are just too coarse permission system. I seriously think we should just have teams here.

@zeripath commented on GitHub (Feb 16, 2021): Hmm... I guess this is yet another example of how collaborators are just too coarse permission system. I seriously think we should just have teams here.
GiteaMirror commented 2025-11-02 06:56:48 -06:00
Author
Owner
Copy Link

@sgabenov commented on GitHub (Dec 25, 2023):

If you have administrative rights for this repository (owner or in org team with admin level) you are allowed to do that

I don't think admin should have rights to correct messages. Only to delete.
This lay lead to a problem, when you can write something on behalf of another user.

@sgabenov commented on GitHub (Dec 25, 2023): > If you have administrative rights for this repository (owner or in org team with admin level) you are allowed to do that I don't think admin should have rights to correct messages. Only to delete. This lay lead to a problem, when you can write something on behalf of another user.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#6461
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?