[1.17.0] Disallowed permission behaviour on package registry #9304

New Issue

GiteaMirror · 2025-11-02T08:34:44-06:00

GiteaMirror commented

2025-11-02 08:34:44 -06:00

Originally created by @LukasKlepper on GitHub (Aug 1, 2022).

Description

I tested the new 1.17.0 today. As it seems the permissions for package repositories are not working correctly. I was able to delete a package on my organization without any permission.

Steps to reproduce:

Upload a new nuget(?) package to a organization.
Create a Team on that organization without permission to manage packages. (no access, see screenshow below)
Add a new non-admin user and add him to the team.
Login into Gitea with the new created user and move into the organization.
Select Packages.
Show the settings menu for the uploaded nuget(?) package. (that shouldn't be possible.)
Delete the nuget package. (that definitly shouldn't be possible.)

I've double checked and the package is really gone, so the user deleted it.
I think its important as currently users are able to delete packages, which they shouldn't have permissions to.

Maybe there are also other problems with permissions on package registries?

Gitea Version

docker-1.17.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Git Version

2.36.2

Operating System

Docker@Linux

How are you running Gitea?

Running Gitea on a linux machine in a docker container behind a reverse proxy. I think that shouldn't depend to the described permission problems above.

Database

PostgreSQL

Originally created by @LukasKlepper on GitHub (Aug 1, 2022). ### Description I tested the new 1.17.0 today. As it seems the permissions for package repositories are not working correctly. I was able to delete a package on my organization without any permission. Steps to reproduce: - Upload a new nuget(?) package to a organization. - Create a Team on that organization without permission to manage packages. (no access, see screenshow below) - Add a new non-admin user and add him to the team. - Login into Gitea with the new created user and move into the organization. - Select Packages. - Show the settings menu for the uploaded nuget(?) package. (that shouldn't be possible.) - Delete the nuget package. (that definitly shouldn't be possible.) I've double checked and the package is really gone, so the user deleted it. I think its important as currently users are able to delete packages, which they shouldn't have permissions to. Maybe there are also other problems with permissions on package registries? ### Gitea Version docker-1.17.0 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots ![grafik](https://user-images.githubusercontent.com/69464569/182123517-1dbbac58-762b-4025-ba51-0971b15c1a34.png) ### Git Version 2.36.2 ### Operating System Docker@Linux ### How are you running Gitea? Running Gitea on a linux machine in a docker container behind a reverse proxy. I think that shouldn't depend to the described permission problems above. ### Database PostgreSQL

GiteaMirror added the topic/packages issue/needs-feedback labels 2025-11-02 08:34:44 -06:00

GiteaMirror closed this issue

2025-11-02 08:34:44 -06:00

GiteaMirror commented

2025-11-02 08:34:45 -06:00

@KN4CK3R commented on GitHub (Aug 8, 2022):

Can't reproduce it. May be related to #20517 but that should not be possible even before that change. A user in a not-Owner-team has only read access if the user is not an admin.

@KN4CK3R commented on GitHub (Aug 8, 2022): Can't reproduce it. May be related to #20517 but that should not be possible even before that change. A user in a not-`Owner`-team has only read access if the user is not an admin.

GiteaMirror commented

2025-11-02 08:34:45 -06:00

@wxiaoguang commented on GitHub (Oct 10, 2022):

@LukasKlepper is it still a problem? If no problem, the issue could be closed.

If there is still a problem, could you provide a reproducible setup (eg: docker compose, detailed operation commands) to help to reproduce?

@wxiaoguang commented on GitHub (Oct 10, 2022): @LukasKlepper is it still a problem? If no problem, the issue could be closed. If there is still a problem, could you provide a reproducible setup (eg: docker compose, detailed operation commands) to help to reproduce?

GiteaMirror commented

2025-11-02 08:34:45 -06:00

@LukasKlepper commented on GitHub (Oct 10, 2022):

Hi @wxiaoguang

I will test it in the latest version & document my setup & steps to reproduce if the error still exists.

@LukasKlepper commented on GitHub (Oct 10, 2022): Hi @wxiaoguang I will test it in the latest version & document my setup & steps to reproduce if the error still exists.

GiteaMirror commented

2025-11-02 08:34:45 -06:00

@wxiaoguang commented on GitHub (Oct 26, 2022):

Hello, this issue has been inactive for more than 2 weeks. Feel free to re-open with a reproducible setup if there is still a problem.

@wxiaoguang commented on GitHub (Oct 26, 2022): Hello, this issue has been inactive for more than 2 weeks. Feel free to re-open with a reproducible setup if there is still a problem.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9304