peezy-tech/jojo
2
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-05-12 22:10:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: hide user profile anonymous options on public repo APIs

Browse source
This commit is contained in:
Mathieu Fenniak 2025-12-18 09:47:40 -07:00
parent babc109b26
commit d99b6d7864
No known key found for this signature in database
3 changed files with 50 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

33
tests/integration/api_repo_test.go
View file

@ -289,6 +289,39 @@ func TestAPIViewRepo(t *testing.T) {
assert.EqualValues(t, 1, repo.Stars)
}
// Validate that private information on the user profile isn't exposed by way of being an owner of a public repository.
func TestAPIViewRepoOwnerSettings(t *testing.T) {
defer tests.PrepareTestEnv(t)()
var repo api.Repository
req := NewRequest(t, "GET", "/api/v1/repos/user2/repo1")
resp := MakeRequest(t, req, http.StatusOK)
DecodeJSON(t, resp, &repo)
assert.EqualValues(t, 1, repo.ID)
assert.Equal(t, "user2@noreply.example.org", repo.Owner.Email) // unauthed, always private
assert.Empty(t, repo.Owner.Pronouns) // user2.keep_pronouns_private = true
session := loginUser(t, "user2")
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
req = NewRequest(t, "GET", "/api/v1/repos/user2/repo1").AddTokenAuth(token)
resp = MakeRequest(t, req, http.StatusOK)
DecodeJSON(t, resp, &repo)
assert.Equal(t, "user2@noreply.example.org", repo.Owner.Email) // user2.keep_email_private = true
assert.Equal(t, "he/him", repo.Owner.Pronouns) // user2.keep_pronouns_private = true
req = NewRequest(t, "GET", "/api/v1/repos/user12/repo10")
resp = MakeRequest(t, req, http.StatusOK)
DecodeJSON(t, resp, &repo)
assert.EqualValues(t, 10, repo.ID)
assert.Equal(t, "user12@noreply.example.org", repo.Owner.Email) // unauthed, always private
req = NewRequest(t, "GET", "/api/v1/repos/user12/repo10").AddTokenAuth(token)
resp = MakeRequest(t, req, http.StatusOK)
DecodeJSON(t, resp, &repo)
assert.Equal(t, "user12@example.com", repo.Owner.Email) // user2.keep_email_private = false
}
func TestAPIOrgRepos(t *testing.T) {
defer tests.PrepareTestEnv(t)()
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})