Skip to content

Commit 28971c7

Browse files
6543ijaureguialzo
andauthored
Check user instead of organization when creating a repo from a template via API (#16346) (#17195)
* Check user instead of organization * Enforce that only admins can copy a repo to another user Co-authored-by: Ion Jaureguialzo Sarasola <ion@jaureguialzo.com>
1 parent eb5e6f0 commit 28971c7

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

routers/api/v1/repo/repo.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -374,16 +374,21 @@ func Generate(ctx *context.APIContext) {
374374
ctxUser := ctx.User
375375
var err error
376376
if form.Owner != ctxUser.Name {
377-
ctxUser, err = models.GetOrgByName(form.Owner)
377+
ctxUser, err = models.GetUserByName(form.Owner)
378378
if err != nil {
379-
if models.IsErrOrgNotExist(err) {
379+
if models.IsErrUserNotExist(err) {
380380
ctx.JSON(http.StatusNotFound, map[string]interface{}{
381-
"error": "request owner `" + form.Name + "` is not exist",
381+
"error": "request owner `" + form.Owner + "` does not exist",
382382
})
383383
return
384384
}
385385

386-
ctx.Error(http.StatusInternalServerError, "GetOrgByName", err)
386+
ctx.Error(http.StatusInternalServerError, "GetUserByName", err)
387+
return
388+
}
389+
390+
if !ctx.User.IsAdmin && !ctxUser.IsOrganization() {
391+
ctx.Error(http.StatusForbidden, "", "Only admin can generate repository for other user.")
387392
return
388393
}
389394

0 commit comments

Comments
 (0)