Hide limited users if viewed by anonymous ghost (#25214) (#25220)

GiteaBot · KN4CK3R · web-flow · commit f64f5495af50 · 2023-06-13T13:53:26.000+08:00
Backport #25214 by @KN4CK3R The ghost user leads to inclusion of limited users/orgs in `BuildCanSeeUserCondition`. Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
diff --git a/models/packages/container/search.go b/models/packages/container/search.go
@@ -262,6 +262,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st
 		cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)})
 	}
 
+	if actor.IsGhost() {
+		actor = nil
+	}
+
 	cond = cond.And(user_model.BuildCanSeeUserCondition(actor))
 
 	sess := db.GetEngine(ctx).

Original file line number	Diff line number	Diff line change
`@@ -262,6 +262,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st`
`262`	`262`	`cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)})`
`263`	`263`	`}`
`264`	`264`
	`265`	`+ if actor.IsGhost() {`
	`266`	`+ actor = nil`
	`267`	`+ }`
	`268`	`+`
`265`	`269`	`cond = cond.And(user_model.BuildCanSeeUserCondition(actor))`
`266`	`270`
`267`	`271`	`sess := db.GetEngine(ctx).`