Error (HTTP 404) When Assigning Teams to Repos

[ghost]

Description

Since Gitea 1.17.0, normal users cannot assign organization teams to organization repositories. This task can currently only be done by administrators.

Instead of search results, the search box shows the error message "There was an issue querying the server" (see attached screenshot). The web developer console shows that the query to /org/<organization>/teams/-/search?q=test returns HTTP 404.

I would expect to at least see all groups that I'm assigned to.

Gitea Version

1.17.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

Self-hosted.

Database

No response

[ghost]

The cause appears to a change introduced in #19318. More specifically, authorization checks for /{org}/teams/-/search (defined here) are tighter than they used to be with the /api/v1/... endpoint.

In this line Context.OrgAssignment(...) is called with the parameters requireMember and requireOwner. I'm not sure whether the original intention was "require membership OR ownership" or "require membership AND ownership", but normal members are sorted out in this line.

[lunny]

What did you mean normal user? This interface should be visited only by orgniazation owner team members or repository's admin collobrators.

[ghost]

Sorry, I should have specified: With normal user I meant repository admin collaborators who are not organization owners.

[lunny]

Looks like it's a regression from #19318

[lunny]

The problem is should the admin permission collaborator of organization repositories can visit organization's users list. If this collaborator is not a member of this organization. I think it's difficult to say it could. But he can visit public users list.

[ghost]

I have found the same issue with the version 1.21.10 of gitea.

I have checked this checkbox at the organisation settings.

user1 is not a member of the team owner.

user1 cannot use autocomplete to assign a team

user1 is able to assign any teams to the repository, which exists inside the organisation. user1 needs only to write the whole name of the team.

Is that a bug or a feature?