forked from gitea/gitea
Backport #28023 by @6543 there was no check in place if a user could see a other user, if you append e.g. `.rss`
This commit is contained in:
parent
d4122712f7
commit
eef4148935
|
@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) {
|
||||||
reloadParam := func(suffix string) (success bool) {
|
reloadParam := func(suffix string) (success bool) {
|
||||||
ctx.SetParams("username", strings.TrimSuffix(username, suffix))
|
ctx.SetParams("username", strings.TrimSuffix(username, suffix))
|
||||||
context_service.UserAssignmentWeb()(ctx)
|
context_service.UserAssignmentWeb()(ctx)
|
||||||
|
// check view permissions
|
||||||
|
if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
|
||||||
|
ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name))
|
||||||
|
return false
|
||||||
|
}
|
||||||
return !ctx.Written()
|
return !ctx.Written()
|
||||||
}
|
}
|
||||||
switch {
|
switch {
|
||||||
|
|
Loading…
Reference in New Issue