Skip to content

Commit

Permalink
Check user instead of organization when creating a repo from a templa…
Browse files Browse the repository at this point in the history
…te via API (#16346)

* Check user instead of organization

* Enforce that only admins can copy a repo to another user
  • Loading branch information
ijaureguialzo authored Jul 15, 2021
1 parent ff69dff commit 251d7f5
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions routers/api/v1/repo/repo.go
Original file line number Diff line number Diff line change
Expand Up @@ -374,16 +374,21 @@ func Generate(ctx *context.APIContext) {
ctxUser := ctx.User
var err error
if form.Owner != ctxUser.Name {
ctxUser, err = models.GetOrgByName(form.Owner)
ctxUser, err = models.GetUserByName(form.Owner)
if err != nil {
if models.IsErrOrgNotExist(err) {
if models.IsErrUserNotExist(err) {
ctx.JSON(http.StatusNotFound, map[string]interface{}{
"error": "request owner `" + form.Name + "` is not exist",
"error": "request owner `" + form.Owner + "` does not exist",
})
return
}

ctx.Error(http.StatusInternalServerError, "GetOrgByName", err)
ctx.Error(http.StatusInternalServerError, "GetUserByName", err)
return
}

if !ctx.User.IsAdmin && !ctxUser.IsOrganization() {
ctx.Error(http.StatusForbidden, "", "Only admin can generate repository for other user.")
return
}

Expand Down

0 comments on commit 251d7f5

Please sign in to comment.