From bcc4c62b6c64513e960b96cc36d728ac28e03a21 Mon Sep 17 00:00:00 2001 From: Zettat123 Date: Sun, 2 Apr 2023 22:43:11 +0800 Subject: [PATCH] Check `IsActionsToken` for LFS authentication (#23841) Close #23824 Actions cannot fetch LFS objects from private repos because we don't check if the user is the `ActionUser`. --- services/lfs/server.go | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/services/lfs/server.go b/services/lfs/server.go index 217d45124e..6c4832c584 100644 --- a/services/lfs/server.go +++ b/services/lfs/server.go @@ -17,6 +17,7 @@ import ( "strconv" "strings" + actions_model "code.gitea.io/gitea/models/actions" git_model "code.gitea.io/gitea/models/git" "code.gitea.io/gitea/models/perm" access_model "code.gitea.io/gitea/models/perm/access" @@ -495,10 +496,27 @@ func authenticate(ctx *context.Context, repository *repo_model.Repository, autho accessMode = perm.AccessModeWrite } + if ctx.Data["IsActionsToken"] == true { + taskID := ctx.Data["ActionsTaskID"].(int64) + task, err := actions_model.GetTaskByID(ctx, taskID) + if err != nil { + log.Error("Unable to GetTaskByID for task[%d] Error: %v", taskID, err) + return false + } + if task.RepoID != repository.ID { + return false + } + + if task.IsForkPullRequest { + return accessMode <= perm.AccessModeRead + } + return accessMode <= perm.AccessModeWrite + } + // ctx.IsSigned is unnecessary here, this will be checked in perm.CanAccess perm, err := access_model.GetUserRepoPermission(ctx, repository, ctx.Doer) if err != nil { - log.Error("Unable to GetUserRepoPermission for user %-v in repo %-v Error: %v", ctx.Doer, repository) + log.Error("Unable to GetUserRepoPermission for user %-v in repo %-v Error: %v", ctx.Doer, repository, err) return false }