Hide limited users if viewed by anonymous ghost (#25214) (#25220)

Backport #25214 by @KN4CK3R The ghost user leads to inclusion of limited users/orgs in `BuildCanSeeUserCondition`. Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
go-gitea · Jun 13, 2023 · f64f549 · f64f549
1 parent 3e9fc36
commit f64f549
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/models/packages/container/search.go b/models/packages/container/search.go
@@ -262,6 +262,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st
 		cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)})
 	}
 
+	if actor.IsGhost() {
+		actor = nil
+	}
+
 	cond = cond.And(user_model.BuildCanSeeUserCondition(actor))
 
 	sess := db.GetEngine(ctx).