mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-24 16:16:35 -05:00
Backport #28023 by @6543 there was no check in place if a user could see a other user, if you append e.g. `.rss`
This commit is contained in:
parent
d4122712f7
commit
eef4148935
1 changed files with 5 additions and 0 deletions
|
@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) {
|
|||
reloadParam := func(suffix string) (success bool) {
|
||||
ctx.SetParams("username", strings.TrimSuffix(username, suffix))
|
||||
context_service.UserAssignmentWeb()(ctx)
|
||||
// check view permissions
|
||||
if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
|
||||
ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name))
|
||||
return false
|
||||
}
|
||||
return !ctx.Written()
|
||||
}
|
||||
switch {
|
||||
|
|
Loading…
Reference in a new issue