From 5eafe2b17eb9a1cf1068e7a3ed7a57a2730f04b0 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 10:46:04 +0000
Subject: [PATCH 01/10] Only show repositories the user has access to, on the
 organization home

---
 models/org.go        | 37 +++++++++++++++++++++++++++++++++++++
 routers/user/home.go | 11 +++++------
 2 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/models/org.go b/models/org.go
index b8836c349f..c9d8f11964 100644
--- a/models/org.go
+++ b/models/org.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"strconv"
 
 	"github.com/go-xorm/xorm"
 )
@@ -1028,3 +1029,39 @@ func removeOrgRepo(e Engine, orgID, repoID int64) error {
 func RemoveOrgRepo(orgID, repoID int64) error {
 	return removeOrgRepo(x, orgID, repoID)
 }
+
+func (org *User) getUserRepositories(userID int64) (err error) {
+	teams := make([]*Team, 0, 10)
+	if err := x.Cols("`team`.id").
+				Where("`team_user`.org_id=?", org.Id).
+				And("`team_user`.uid=?", userID).
+				Join("INNER", "`team_user`", "`team_user`.team_id=`team`.id").
+				Find(&teams); err != nil {
+		return fmt.Errorf("get team: %v", err)
+	}
+
+	var teamIDs []string
+	for _, team := range teams {
+		s := strconv.FormatInt(team.ID, 32)
+		teamIDs = append(teamIDs, s)
+	}
+
+	// The "in" clause it not vulnerable to SQL injection because we
+	// convert it from int64 a few lines above. Sadly, xorm does not support
+	// "in" clauses as a function, so we have to build our own (for now).
+	if err := x.Cols("`repository`.*").
+				Where("`team_repo`.team_id in (" + strings.Join(teamIDs, ",") + ")").
+				Join("INNER", "`team_repo`", "`team_repo`.repo_id=`repository`.id").
+				GroupBy("`repository`.id").
+				Find(&org.Repos); err != nil {
+		return fmt.Errorf("get repositories: %v", err)
+	}
+
+	return
+}
+
+// GetUserRepositories gets all repositories of an organization,
+// that the user with the given userID has access to.
+func (org *User) GetUserRepositories(userID int64) (err error) {
+	return org.getUserRepositories(userID)
+}
diff --git a/routers/user/home.go b/routers/user/home.go
index b5df5e3679..b198e801d2 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -314,20 +314,19 @@ func showOrgProfile(ctx *middleware.Context) {
 	org := ctx.Org.Organization
 	ctx.Data["Title"] = org.FullName
 
-	repos, err := models.GetRepositories(org.Id, ctx.IsSigned && (ctx.User.IsAdmin || org.IsOrgMember(ctx.User.Id)))
-	if err != nil {
-		ctx.Handle(500, "GetRepositories", err)
+	if err := org.GetUserRepositories(ctx.User.Id); err != nil {
+		ctx.Handle(500, "GetUserRepositories", err)
 		return
 	}
-	ctx.Data["Repos"] = repos
+	ctx.Data["Repos"] = org.Repos
 
-	if err = org.GetMembers(); err != nil {
+	if err := org.GetMembers(); err != nil {
 		ctx.Handle(500, "GetMembers", err)
 		return
 	}
 	ctx.Data["Members"] = org.Members
 
-	if err = org.GetTeams(); err != nil {
+	if err := org.GetTeams(); err != nil {
 		ctx.Handle(500, "GetTeams", err)
 		return
 	}

From e35791b2b2888979ba53b8a9a58e1cb132026914 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 13:28:42 +0000
Subject: [PATCH 02/10] Only show teams the user has access to

---
 cmd/web.go                    |  5 ++-
 models/org.go                 | 39 +++++++++++++++------
 modules/middleware/context.go |  1 +
 modules/middleware/org.go     | 66 +++++++++++++++++++++++++----------
 routers/org/teams.go          |  5 +--
 routers/user/home.go          |  9 ++---
 6 files changed, 84 insertions(+), 41 deletions(-)

diff --git a/cmd/web.go b/cmd/web.go
index cf47d5c531..3949595465 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -350,11 +350,14 @@ func runWeb(ctx *cli.Context) {
 			m.Get("/members/action/:action", org.MembersAction)
 
 			m.Get("/teams", org.Teams)
+		}, middleware.OrgAssignment(true))
+
+		m.Group("/:org", func() {
 			m.Get("/teams/:team", org.TeamMembers)
 			m.Get("/teams/:team/repositories", org.TeamRepositories)
 			m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction)
 			m.Route("/teams/:team/action/repo/:action", "GET,POST", org.TeamsRepoAction)
-		}, middleware.OrgAssignment(true))
+		}, middleware.OrgAssignment(true, false, true))
 
 		m.Group("/:org", func() {
 			m.Get("/teams/new", org.NewTeam)
diff --git a/models/org.go b/models/org.go
index c9d8f11964..839d26742d 100644
--- a/models/org.go
+++ b/models/org.go
@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"strconv"
 
 	"github.com/go-xorm/xorm"
 )
@@ -1037,31 +1036,49 @@ func (org *User) getUserRepositories(userID int64) (err error) {
 				And("`team_user`.uid=?", userID).
 				Join("INNER", "`team_user`", "`team_user`.team_id=`team`.id").
 				Find(&teams); err != nil {
-		return fmt.Errorf("get team: %v", err)
+		return fmt.Errorf("getUserRepositories: get teams: %v", err)
 	}
 
-	var teamIDs []string
+	var teamIDs []int64
 	for _, team := range teams {
-		s := strconv.FormatInt(team.ID, 32)
-		teamIDs = append(teamIDs, s)
+		teamIDs = append(teamIDs, team.ID)
 	}
 
-	// The "in" clause it not vulnerable to SQL injection because we
-	// convert it from int64 a few lines above. Sadly, xorm does not support
-	// "in" clauses as a function, so we have to build our own (for now).
 	if err := x.Cols("`repository`.*").
-				Where("`team_repo`.team_id in (" + strings.Join(teamIDs, ",") + ")").
+				In("`team_repo`.team_id", teamIDs).
 				Join("INNER", "`team_repo`", "`team_repo`.repo_id=`repository`.id").
 				GroupBy("`repository`.id").
 				Find(&org.Repos); err != nil {
-		return fmt.Errorf("get repositories: %v", err)
+		return fmt.Errorf("getUserRepositories: get repositories: %v", err)
 	}
 
+	org.NumRepos = len(org.Repos)
+
 	return
 }
 
 // GetUserRepositories gets all repositories of an organization,
 // that the user with the given userID has access to.
-func (org *User) GetUserRepositories(userID int64) (err error) {
+func (org *User) GetUserRepositories(userID int64) error {
 	return org.getUserRepositories(userID)
 }
+
+func (org *User) getUserTeams(userID int64) (err error) {
+	if err := x.Cols("`team`.*").
+				Where("`team_user`.org_id=?", org.Id).
+				And("`team_user`.uid=?", userID).
+				Join("INNER", "`team_user`", "`team_user`.team_id=`team`.id").
+				Find(&org.Teams); err != nil {
+		return fmt.Errorf("getUserTeams: %v", err)
+	}
+
+	org.NumTeams = len(org.Teams)
+
+	return
+}
+
+// GetTeams returns all teams that belong to organization,
+// and that the user has joined.
+func (org *User) GetUserTeams(userID int64) error {
+	return org.getUserTeams(userID)
+}
diff --git a/modules/middleware/context.go b/modules/middleware/context.go
index d58967b891..59e95aada9 100644
--- a/modules/middleware/context.go
+++ b/modules/middleware/context.go
@@ -65,6 +65,7 @@ type Context struct {
 	Org struct {
 		IsOwner      bool
 		IsMember     bool
+		IsTeamMember bool // Is member of team.
 		IsAdminTeam  bool // In owner team or team that has admin permission level.
 		Organization *models.User
 		OrgLink      string
diff --git a/modules/middleware/org.go b/modules/middleware/org.go
index 37ba4deb1f..34ec90dc6e 100644
--- a/modules/middleware/org.go
+++ b/modules/middleware/org.go
@@ -5,6 +5,8 @@
 package middleware
 
 import (
+	"strings"
+
 	"gopkg.in/macaron.v1"
 
 	"github.com/gogits/gogs/models"
@@ -13,9 +15,10 @@ import (
 
 func HandleOrgAssignment(ctx *Context, args ...bool) {
 	var (
-		requireMember    bool
-		requireOwner     bool
-		requireAdminTeam bool
+		requireMember     bool
+		requireOwner      bool
+		requireTeamMember bool
+		requireAdminTeam  bool
 	)
 	if len(args) >= 1 {
 		requireMember = args[0]
@@ -24,7 +27,10 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 		requireOwner = args[1]
 	}
 	if len(args) >= 3 {
-		requireAdminTeam = args[2]
+		requireTeamMember = args[2]
+	}
+	if len(args) >= 4 {
+		requireAdminTeam = args[3]
 	}
 
 	orgName := ctx.Params(":org")
@@ -52,11 +58,13 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 	if ctx.IsSigned && ctx.User.IsAdmin {
 		ctx.Org.IsOwner = true
 		ctx.Org.IsMember = true
+		ctx.Org.IsTeamMember = true
 		ctx.Org.IsAdminTeam = true
 	} else if ctx.IsSigned {
 		ctx.Org.IsOwner = org.IsOwnedBy(ctx.User.Id)
 		if ctx.Org.IsOwner {
 			ctx.Org.IsMember = true
+			ctx.Org.IsTeamMember = true
 			ctx.Org.IsAdminTeam = true
 		} else {
 			if org.IsOrgMember(ctx.User.Id) {
@@ -79,25 +87,45 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 	ctx.Data["OrgLink"] = ctx.Org.OrgLink
 
 	// Team.
-	teamName := ctx.Params(":team")
-	if len(teamName) > 0 {
-		ctx.Org.Team, err = org.GetTeam(teamName)
-		if err != nil {
-			if err == models.ErrTeamNotExist {
-				ctx.Handle(404, "GetTeam", err)
-			} else {
-				ctx.Handle(500, "GetTeam", err)
-			}
+	if ctx.Org.IsMember {
+		if err := org.GetUserTeams(ctx.User.Id); err != nil {
+			ctx.Handle(500, "GetUserTeams", err)
 			return
 		}
-		ctx.Data["Team"] = ctx.Org.Team
+	}
+
+	teamName := ctx.Params(":team")
+	if len(teamName) > 0 {
+		teamExists := false
+		for _, team := range org.Teams {
+			if strings.ToLower(team.Name) == strings.ToLower(teamName) {
+				teamExists = true
+				ctx.Org.Team = team
+				ctx.Org.IsTeamMember = true
+				ctx.Data["Team"] = ctx.Org.Team
+				break
+			}
+		}
+
+		if !teamExists {
+			ctx.Handle(404, "OrgAssignment", err)
+			return
+		}
+
+		ctx.Data["IsTeamMember"] = ctx.Org.IsTeamMember
+		if requireTeamMember && !ctx.Org.IsTeamMember {
+			ctx.Handle(404, "OrgAssignment", err)
+			return
+		}
+
 		ctx.Org.IsAdminTeam = ctx.Org.Team.IsOwnerTeam() || ctx.Org.Team.Authorize >= models.ACCESS_MODE_ADMIN
+		ctx.Data["IsAdminTeam"] = ctx.Org.IsAdminTeam
+		if requireAdminTeam && !ctx.Org.IsAdminTeam {
+			ctx.Handle(404, "OrgAssignment", err)
+			return
+		}
 	}
-	ctx.Data["IsAdminTeam"] = ctx.Org.IsAdminTeam
-	if requireAdminTeam && !ctx.Org.IsAdminTeam {
-		ctx.Handle(404, "OrgAssignment", err)
-		return
-	}
+
 }
 
 func OrgAssignment(args ...bool) macaron.Handler {
diff --git a/routers/org/teams.go b/routers/org/teams.go
index b2128baab6..63618b9858 100644
--- a/routers/org/teams.go
+++ b/routers/org/teams.go
@@ -28,10 +28,7 @@ func Teams(ctx *middleware.Context) {
 	ctx.Data["Title"] = org.FullName
 	ctx.Data["PageIsOrgTeams"] = true
 
-	if err := org.GetTeams(); err != nil {
-		ctx.Handle(500, "GetTeams", err)
-		return
-	}
+	// org.Teams is already loaded by middleware
 	for _, t := range org.Teams {
 		if err := t.GetMembers(); err != nil {
 			ctx.Handle(500, "GetMembers", err)
diff --git a/routers/user/home.go b/routers/user/home.go
index b198e801d2..fabe7b1f31 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -312,9 +312,10 @@ func showOrgProfile(ctx *middleware.Context) {
 	}
 
 	org := ctx.Org.Organization
+	userId := ctx.User.Id
 	ctx.Data["Title"] = org.FullName
 
-	if err := org.GetUserRepositories(ctx.User.Id); err != nil {
+	if err := org.GetUserRepositories(userId); err != nil {
 		ctx.Handle(500, "GetUserRepositories", err)
 		return
 	}
@@ -326,11 +327,7 @@ func showOrgProfile(ctx *middleware.Context) {
 	}
 	ctx.Data["Members"] = org.Members
 
-	if err := org.GetTeams(); err != nil {
-		ctx.Handle(500, "GetTeams", err)
-		return
-	}
-	ctx.Data["Teams"] = org.Teams
+	ctx.Data["Teams"] = org.Teams // already loaded by middleware
 
 	ctx.HTML(200, ORG_HOME)
 }

From 8c4588c4c9844bb9f5e39df5fcaadca7fd6170cd Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 15:18:28 +0000
Subject: [PATCH 03/10] Refactor .IsAdminTeam to .IsTeamAdmin and
 requireAdminTeam to requireTeamAdmin

---
 modules/middleware/context.go |  2 +-
 modules/middleware/org.go     | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/modules/middleware/context.go b/modules/middleware/context.go
index 59e95aada9..cd11c08b15 100644
--- a/modules/middleware/context.go
+++ b/modules/middleware/context.go
@@ -66,7 +66,7 @@ type Context struct {
 		IsOwner      bool
 		IsMember     bool
 		IsTeamMember bool // Is member of team.
-		IsAdminTeam  bool // In owner team or team that has admin permission level.
+		IsTeamAdmin  bool // In owner team or team that has admin permission level.
 		Organization *models.User
 		OrgLink      string
 
diff --git a/modules/middleware/org.go b/modules/middleware/org.go
index 34ec90dc6e..99c4cf9d5c 100644
--- a/modules/middleware/org.go
+++ b/modules/middleware/org.go
@@ -18,7 +18,7 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 		requireMember     bool
 		requireOwner      bool
 		requireTeamMember bool
-		requireAdminTeam  bool
+		requireTeamAdmin  bool
 	)
 	if len(args) >= 1 {
 		requireMember = args[0]
@@ -30,7 +30,7 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 		requireTeamMember = args[2]
 	}
 	if len(args) >= 4 {
-		requireAdminTeam = args[3]
+		requireTeamAdmin = args[3]
 	}
 
 	orgName := ctx.Params(":org")
@@ -59,13 +59,13 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 		ctx.Org.IsOwner = true
 		ctx.Org.IsMember = true
 		ctx.Org.IsTeamMember = true
-		ctx.Org.IsAdminTeam = true
+		ctx.Org.IsTeamAdmin = true
 	} else if ctx.IsSigned {
 		ctx.Org.IsOwner = org.IsOwnedBy(ctx.User.Id)
 		if ctx.Org.IsOwner {
 			ctx.Org.IsMember = true
 			ctx.Org.IsTeamMember = true
-			ctx.Org.IsAdminTeam = true
+			ctx.Org.IsTeamAdmin = true
 		} else {
 			if org.IsOrgMember(ctx.User.Id) {
 				ctx.Org.IsMember = true
@@ -118,9 +118,9 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 			return
 		}
 
-		ctx.Org.IsAdminTeam = ctx.Org.Team.IsOwnerTeam() || ctx.Org.Team.Authorize >= models.ACCESS_MODE_ADMIN
-		ctx.Data["IsAdminTeam"] = ctx.Org.IsAdminTeam
-		if requireAdminTeam && !ctx.Org.IsAdminTeam {
+		ctx.Org.IsTeamAdmin = ctx.Org.Team.IsOwnerTeam() || ctx.Org.Team.Authorize >= models.ACCESS_MODE_ADMIN
+		ctx.Data["IsTeamAdmin"] = ctx.Org.IsTeamAdmin
+		if requireTeamAdmin && !ctx.Org.IsTeamAdmin {
 			ctx.Handle(404, "OrgAssignment", err)
 			return
 		}

From 9cf95e4e37419fd2856ec941922b5a0c74d155e1 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 16:13:31 +0000
Subject: [PATCH 04/10] Organization owners see all repositories & teams

---
 modules/middleware/org.go | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/middleware/org.go b/modules/middleware/org.go
index 99c4cf9d5c..eb71020e69 100644
--- a/modules/middleware/org.go
+++ b/modules/middleware/org.go
@@ -88,9 +88,16 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 
 	// Team.
 	if ctx.Org.IsMember {
-		if err := org.GetUserTeams(ctx.User.Id); err != nil {
-			ctx.Handle(500, "GetUserTeams", err)
-			return
+		if ctx.Org.IsOwner {
+			if err := org.GetTeams(); err != nil {
+				ctx.Handle(500, "GetUserTeams", err)
+				return
+			}
+		} else {
+			if err := org.GetUserTeams(ctx.User.Id); err != nil {
+				ctx.Handle(500, "GetUserTeams", err)
+				return
+			}
 		}
 	}
 
@@ -98,6 +105,7 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 	if len(teamName) > 0 {
 		teamExists := false
 		for _, team := range org.Teams {
+
 			if strings.ToLower(team.Name) == strings.ToLower(teamName) {
 				teamExists = true
 				ctx.Org.Team = team
@@ -125,7 +133,6 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 			return
 		}
 	}
-
 }
 
 func OrgAssignment(args ...bool) macaron.Handler {

From bba1847a8eb08dfc5a3302a23ee210b21e0e71d3 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 18:13:39 +0000
Subject: [PATCH 05/10] Everyone can see public repos

---
 models/org.go        | 17 ++++++++++++++---
 routers/user/home.go | 18 +++++++++++++-----
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/models/org.go b/models/org.go
index 839d26742d..8edb63bbdc 100644
--- a/models/org.go
+++ b/models/org.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"strconv"
 
 	"github.com/go-xorm/xorm"
 )
@@ -1039,14 +1040,24 @@ func (org *User) getUserRepositories(userID int64) (err error) {
 		return fmt.Errorf("getUserRepositories: get teams: %v", err)
 	}
 
-	var teamIDs []int64
+	var teamIDs []string
 	for _, team := range teams {
-		teamIDs = append(teamIDs, team.ID)
+		teamIDs = append(teamIDs, strconv.FormatInt(team.ID, 10))
+	}
+	if len(teamIDs) == 0 {
+		// user has no team but "IN ()" is invalid SQL
+		teamIDs = append(teamIDs, "0")  // there is no repo with id=0
 	}
 
+	// Due to a bug in xorm using IN() together with OR() is impossible.
+	// As a workaround, we have to build the IN statement on our own, until this is fixed.
+	// https://github.com/go-xorm/xorm/issues/342
+
 	if err := x.Cols("`repository`.*").
-				In("`team_repo`.team_id", teamIDs).
 				Join("INNER", "`team_repo`", "`team_repo`.repo_id=`repository`.id").
+				Where("`repository`.owner_id=?", org.Id).
+				And("`repository`.is_private=?", false).
+				Or("`team_repo`.team_id=(?)", strings.Join(teamIDs, ",")).
 				GroupBy("`repository`.id").
 				Find(&org.Repos); err != nil {
 		return fmt.Errorf("getUserRepositories: get repositories: %v", err)
diff --git a/routers/user/home.go b/routers/user/home.go
index fabe7b1f31..6e2135dca2 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -312,14 +312,22 @@ func showOrgProfile(ctx *middleware.Context) {
 	}
 
 	org := ctx.Org.Organization
-	userId := ctx.User.Id
 	ctx.Data["Title"] = org.FullName
 
-	if err := org.GetUserRepositories(userId); err != nil {
-		ctx.Handle(500, "GetUserRepositories", err)
-		return
+	if ctx.IsSigned {
+		if err := org.GetUserRepositories(ctx.User.Id); err != nil {
+			ctx.Handle(500, "GetUserRepositories", err)
+			return
+		}
+		ctx.Data["Repos"] = org.Repos
+	} else {
+		if repos, err := models.GetRepositories(org.Id, false); err != nil {
+			ctx.Handle(500, "GetRepositories", err)
+			return
+		} else {
+			ctx.Data["Repos"] = repos
+		}
 	}
-	ctx.Data["Repos"] = org.Repos
 
 	if err := org.GetMembers(); err != nil {
 		ctx.Handle(500, "GetMembers", err)

From fdad23444563cb4318b1715b4b1bc17d5354d01f Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 19:08:20 +0000
Subject: [PATCH 06/10] Remove unnecessary comments

---
 routers/org/teams.go | 1 -
 routers/user/home.go | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/routers/org/teams.go b/routers/org/teams.go
index 63618b9858..e4a6afcf45 100644
--- a/routers/org/teams.go
+++ b/routers/org/teams.go
@@ -28,7 +28,6 @@ func Teams(ctx *middleware.Context) {
 	ctx.Data["Title"] = org.FullName
 	ctx.Data["PageIsOrgTeams"] = true
 
-	// org.Teams is already loaded by middleware
 	for _, t := range org.Teams {
 		if err := t.GetMembers(); err != nil {
 			ctx.Handle(500, "GetMembers", err)
diff --git a/routers/user/home.go b/routers/user/home.go
index 6e2135dca2..c49b923285 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -335,7 +335,7 @@ func showOrgProfile(ctx *middleware.Context) {
 	}
 	ctx.Data["Members"] = org.Members
 
-	ctx.Data["Teams"] = org.Teams // already loaded by middleware
+	ctx.Data["Teams"] = org.Teams
 
 	ctx.HTML(200, ORG_HOME)
 }

From 90780a0d90d19eb7e022603dfd2bf24148818d19 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 19:16:40 +0000
Subject: [PATCH 07/10] Use invalid value (-1) instead of 0 to prevent bug if
 auto increment starts with 0

---
 models/org.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/models/org.go b/models/org.go
index 8edb63bbdc..9254709a26 100644
--- a/models/org.go
+++ b/models/org.go
@@ -1046,7 +1046,7 @@ func (org *User) getUserRepositories(userID int64) (err error) {
 	}
 	if len(teamIDs) == 0 {
 		// user has no team but "IN ()" is invalid SQL
-		teamIDs = append(teamIDs, "0")  // there is no repo with id=0
+		teamIDs = append(teamIDs, "-1")  // there is no repo with id=-1
 	}
 
 	// Due to a bug in xorm using IN() together with OR() is impossible.

From bead46363bbd0f0b8cc42535c231cb2132bc5161 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Sun, 31 Jan 2016 20:12:03 +0000
Subject: [PATCH 08/10] Evaulate org/team permissions when using the issue/PR
 view

---
 routers/user/home.go | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/routers/user/home.go b/routers/user/home.go
index c49b923285..fb3724714d 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -183,11 +183,18 @@ func Issues(ctx *middleware.Context) {
 	isShowClosed := ctx.Query("state") == "closed"
 
 	// Get repositories.
-	repos, err := models.GetRepositories(ctxUser.Id, true)
-	if err != nil {
-		ctx.Handle(500, "GetRepositories", err)
-		return
+	if ctxUser.IsOrganization() {
+		if err := ctxUser.GetUserRepositories(ctx.User.Id); err != nil {
+			ctx.Handle(500, "GetRepositories", err)
+			return
+		}
+	} else {
+		if err := ctxUser.GetRepositories(); err != nil {
+			ctx.Handle(500, "GetRepositories", err)
+			return
+		}
 	}
+	repos := ctxUser.Repos
 
 	allCount := 0
 	repoIDs := make([]int64, 0, len(repos))

From fb1708e1afefa86b11ef9464796896bcc8dbc7e8 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Thu, 4 Feb 2016 17:08:25 +0000
Subject: [PATCH 09/10] Remove unnecessary private functions

---
 models/org.go | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/models/org.go b/models/org.go
index 9254709a26..91a47e3166 100644
--- a/models/org.go
+++ b/models/org.go
@@ -1030,7 +1030,9 @@ func RemoveOrgRepo(orgID, repoID int64) error {
 	return removeOrgRepo(x, orgID, repoID)
 }
 
-func (org *User) getUserRepositories(userID int64) (err error) {
+// GetUserRepositories gets all repositories of an organization,
+// that the user with the given userID has access to.
+func (org *User) GetUserRepositories(userID int64) (err error) {
 	teams := make([]*Team, 0, 10)
 	if err := x.Cols("`team`.id").
 				Where("`team_user`.org_id=?", org.Id).
@@ -1068,13 +1070,9 @@ func (org *User) getUserRepositories(userID int64) (err error) {
 	return
 }
 
-// GetUserRepositories gets all repositories of an organization,
-// that the user with the given userID has access to.
-func (org *User) GetUserRepositories(userID int64) error {
-	return org.getUserRepositories(userID)
-}
-
-func (org *User) getUserTeams(userID int64) (err error) {
+// GetTeams returns all teams that belong to organization,
+// and that the user has joined.
+func (org *User) GetUserTeams(userID int64) (err error) {
 	if err := x.Cols("`team`.*").
 				Where("`team_user`.org_id=?", org.Id).
 				And("`team_user`.uid=?", userID).
@@ -1087,9 +1085,3 @@ func (org *User) getUserTeams(userID int64) (err error) {
 
 	return
 }
-
-// GetTeams returns all teams that belong to organization,
-// and that the user has joined.
-func (org *User) GetUserTeams(userID int64) error {
-	return org.getUserTeams(userID)
-}

From c3ff476ed67b69431e96fce8e5a16450976701f6 Mon Sep 17 00:00:00 2001
From: Florian Kaiser <florian.kaiser@fnkr.net>
Date: Thu, 4 Feb 2016 17:13:56 +0000
Subject: [PATCH 10/10] Remove unnecessary else-block

---
 routers/user/home.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/routers/user/home.go b/routers/user/home.go
index fb3724714d..61cda33be2 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -328,12 +328,12 @@ func showOrgProfile(ctx *middleware.Context) {
 		}
 		ctx.Data["Repos"] = org.Repos
 	} else {
-		if repos, err := models.GetRepositories(org.Id, false); err != nil {
+		repos, err := models.GetRepositories(org.Id, false)
+		if err != nil {
 			ctx.Handle(500, "GetRepositories", err)
 			return
-		} else {
-			ctx.Data["Repos"] = repos
 		}
+		ctx.Data["Repos"] = repos
 	}
 
 	if err := org.GetMembers(); err != nil {