{{if .IsOrganizationProject}}
{{svg "octicon-project-symlink" 18 "mr-3"}}
{{else if .IsIndividualProject}}
@@ -289,7 +289,7 @@
{{.locale.Tr "repo.issues.new.closed_projects"}}
+
{{if .IsOrganizationProject}}
{{svg "octicon-project-symlink" 18 "mr-3"}}
{{else if .IsIndividualProject}}
From 87d98fc87955cc5f898f07de64a6ea8882f3813c Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Thu, 16 Feb 2023 18:06:39 +0900
Subject: [PATCH 20/69] add TODO
---
models/issues/issue_project.go | 2 +-
routers/web/repo/issue.go | 7 ++++++-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/models/issues/issue_project.go b/models/issues/issue_project.go
index ed3dbca413bd..dd97c72f3e23 100644
--- a/models/issues/issue_project.go
+++ b/models/issues/issue_project.go
@@ -63,6 +63,7 @@ func (issue *Issue) projectBoardID(ctx context.Context) int64 {
func LoadIssuesFromBoard(ctx context.Context, b *project_model.Board) (IssueList, error) {
issueList := make([]*Issue, 0, 10)
+ // FIXME: add a opts arg to check org/team/user permission
if b.ID != 0 {
issues, err := Issues(ctx, &IssuesOptions{
ProjectBoardID: b.ID,
@@ -142,7 +143,6 @@ func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.U
return fmt.Errorf("issue's repository is not the same as project's repository")
}
case project_model.TypeOrganization:
- // TODO: org team permission check
if newProject.OwnerID != issue.Repo.OwnerID {
return fmt.Errorf("issue's repository's owner is not the same as project's repository's owner")
}
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index b40032cbef3b..8b5f3d811efe 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -872,6 +872,7 @@ func NewIssue(ctx *context.Context) {
}
}
+ // TODO: add org/user project support
projectID := ctx.FormInt64("project")
if projectID > 0 && isProjectsEnabled {
project, err := project_model.GetProjectByID(ctx, projectID)
@@ -1030,6 +1031,7 @@ func ValidateRepoMetas(ctx *context.Context, form forms.CreateIssueForm, isPull
}
projectLink := ""
+ projectId := int64(0)
if form.ProjectID > 0 {
p, err := project_model.GetProjectByID(ctx, form.ProjectID)
if err != nil {
@@ -1041,9 +1043,12 @@ func ValidateRepoMetas(ctx *context.Context, form forms.CreateIssueForm, isPull
return nil, nil, 0, 0, ""
}
+ // TODO: check project accessibility, if it is not accessable, return 0
+
ctx.Data["Project"] = p
ctx.Data["project_id"] = form.ProjectID
+ projectId = form.ProjectID
projectLink = p.Link()
}
@@ -1081,7 +1086,7 @@ func ValidateRepoMetas(ctx *context.Context, form forms.CreateIssueForm, isPull
assigneeIDs = append(assigneeIDs, form.AssigneeID)
}
- return labelIDs, assigneeIDs, milestoneID, form.ProjectID, projectLink
+ return labelIDs, assigneeIDs, milestoneID, projectId, projectLink
}
// NewIssuePost response for creating new issue
From ebb6e83dffb8bedee2ce268c06f6c6d5b36fb914 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Fri, 17 Feb 2023 13:10:44 +0900
Subject: [PATCH 21/69] fix retrieve projects in an issue
---
models/organization/org.go | 25 ++++++
models/project/project.go | 35 ++++++++
modules/context/org.go | 30 +------
routers/web/repo/issue.go | 177 ++++++++++++++++++++++++-------------
4 files changed, 177 insertions(+), 90 deletions(-)
diff --git a/models/organization/org.go b/models/organization/org.go
index f05027be729d..f98b9378204f 100644
--- a/models/organization/org.go
+++ b/models/organization/org.go
@@ -239,6 +239,31 @@ func (org *Organization) CustomAvatarRelativePath() string {
return org.Avatar
}
+func (org *Organization) UnitPermission(ctx context.Context, doerID int64, unitType unit.Type) perm.AccessMode {
+ if doerID > 0 {
+ teams, err := GetUserOrgTeams(ctx, org.ID, doerID)
+ if err != nil {
+ log.Error("GetUserOrgTeams: %v", err)
+ return perm.AccessModeNone
+ }
+
+ if err := teams.LoadUnits(ctx); err != nil {
+ log.Error("LoadUnits: %v", err)
+ return perm.AccessModeNone
+ }
+
+ if len(teams) > 0 {
+ return teams.UnitMaxAccess(unitType)
+ }
+ }
+
+ if org.Visibility == structs.VisibleTypePublic {
+ return perm.AccessModeRead
+ }
+
+ return perm.AccessModeNone
+}
+
// CreateOrganization creates record of a new organization.
func CreateOrganization(org *Organization, owner *user_model.User) (err error) {
if !owner.CanCreateOrganization() {
diff --git a/models/project/project.go b/models/project/project.go
index 1715bcd6471a..c1e2a77785f6 100644
--- a/models/project/project.go
+++ b/models/project/project.go
@@ -8,7 +8,10 @@ import (
"fmt"
"code.gitea.io/gitea/models/db"
+ org_model "code.gitea.io/gitea/models/organization"
+ "code.gitea.io/gitea/models/perm"
repo_model "code.gitea.io/gitea/models/repo"
+ "code.gitea.io/gitea/models/unit"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/setting"
@@ -210,6 +213,38 @@ func (p *Project) IsIndividualProject() bool {
return p.Type == TypeIndividual
}
+func (p *Project) IsRepositoryProject() bool {
+ return p.Type == TypeRepository
+}
+
+// CanRetrievedByDoer return whether project can retrieved by a doer in a repo
+func (p *Project) CanRetrievedByDoer(ctx context.Context, repo *repo_model.Repository, doerID int64) (bool, error) {
+ if err := repo.GetOwner(ctx); err != nil {
+ return false, fmt.Errorf("GetOwner: %w", err)
+ }
+
+ if p.RepoID > 0 {
+ // repo's project
+ if p.RepoID != repo.ID {
+ return false, nil
+ }
+ } else {
+ // individual/org's project
+ if p.OwnerID != repo.OwnerID {
+ return false, nil
+ }
+
+ if repo.Owner.IsOrganization() {
+ // check doer read permission
+ if (*org_model.Organization)(repo.Owner).UnitPermission(ctx, doerID, unit.TypeProjects) < perm.AccessModeRead {
+ return false, nil
+ }
+ }
+ }
+
+ return true, nil
+}
+
// GetProjectTypeByUser retrieves the type of a project by user's type
func GetProjectTypeByUser(user *user_model.User) (Type, error) {
switch user.Type {
diff --git a/modules/context/org.go b/modules/context/org.go
index cdcff9c1b7aa..9fbf099f0e6e 100644
--- a/modules/context/org.go
+++ b/modules/context/org.go
@@ -11,7 +11,6 @@ import (
"code.gitea.io/gitea/models/perm"
"code.gitea.io/gitea/models/unit"
user_model "code.gitea.io/gitea/models/user"
- "code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/structs"
)
@@ -34,39 +33,14 @@ func (org *Organization) CanWriteUnit(ctx *Context, unitType unit.Type) bool {
if ctx.Doer == nil {
return false
}
- return org.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeWrite
+ return org.Organization.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeWrite
}
func (org *Organization) CanAccessUnit(ctx *Context, unitType unit.Type) bool {
if ctx.Doer == nil {
return false
}
- return org.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeRead
-}
-
-func (org *Organization) UnitPermission(ctx *Context, doerID int64, unitType unit.Type) perm.AccessMode {
- if doerID > 0 {
- teams, err := organization.GetUserOrgTeams(ctx, org.Organization.ID, doerID)
- if err != nil {
- log.Error("GetUserOrgTeams: %v", err)
- return perm.AccessModeNone
- }
-
- if err := teams.LoadUnits(ctx); err != nil {
- log.Error("LoadUnits: %v", err)
- return perm.AccessModeNone
- }
-
- if len(teams) > 0 {
- return teams.UnitMaxAccess(unitType)
- }
- }
-
- if org.Organization.Visibility == structs.VisibleTypePublic {
- return perm.AccessModeRead
- }
-
- return perm.AccessModeNone
+ return org.Organization.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeRead
}
func GetOrganizationByParams(ctx *Context) {
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index 8b5f3d811efe..f2d643f0b114 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -468,39 +468,63 @@ func RetrieveRepoMilestonesAndAssignees(ctx *context.Context, repo *repo_model.R
}
func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
+ var projects project_model.List
var err error
- projects, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
- RepoID: repo.ID,
- Page: -1,
- IsClosed: util.OptionalBoolFalse,
- Type: project_model.TypeRepository,
- })
- if err != nil {
- ctx.ServerError("GetProjects", err)
+
+ if err := repo.GetOwner(ctx); err != nil {
+ ctx.ServerError("GetOwner", err)
return
}
- projectsOrg, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
- OwnerID: repo.OwnerID,
- Page: -1,
- IsClosed: util.OptionalBoolFalse,
- Type: project_model.TypeOrganization,
- })
- if err != nil {
- ctx.ServerError("GetProjects", err)
- return
+
+ // retrieve this repo's projects
+ if ctx.Repo.CanRead(unit.TypeProjects) {
+ projects, _, err = project_model.FindProjects(ctx, project_model.SearchOptions{
+ RepoID: repo.ID,
+ Page: -1,
+ IsClosed: util.OptionalBoolFalse,
+ Type: project_model.TypeRepository,
+ })
+ if err != nil {
+ ctx.ServerError("GetProjects", err)
+ return
+ }
}
- projects = append(projects, projectsOrg...)
- projectsUser, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
- OwnerID: ctx.Doer.ID,
- Page: -1,
- IsClosed: util.OptionalBoolFalse,
- Type: project_model.TypeIndividual,
- })
- if err != nil {
- ctx.ServerError("GetProjects", err)
- return
+ // repo's owner can retrieve his individual projects
+ if ctx.Doer.ID == repo.OwnerID {
+ projectsRepoOwner, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
+ OwnerID: repo.OwnerID,
+ Page: -1,
+ IsClosed: util.OptionalBoolFalse,
+ Type: project_model.TypeIndividual,
+ })
+ if err != nil {
+ ctx.ServerError("GetProjects", err)
+ return
+ }
+ projects = append(projects, projectsRepoOwner...)
+ }
+ // org repo's projects
+ if ctx.ContextUser.IsOrganization() {
+ projectsOrg, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
+ OwnerID: repo.OwnerID,
+ Page: -1,
+ IsClosed: util.OptionalBoolFalse,
+ Type: project_model.TypeOrganization,
+ })
+ if err != nil {
+ ctx.ServerError("GetProjects", err)
+ return
+ }
+ for _, p := range projectsOrg {
+ if canRetrievedByDoer, err := p.CanRetrievedByDoer(ctx, repo, ctx.Doer.ID); err != nil {
+ ctx.ServerError("CanRetrievedByDoer", err)
+ return
+ } else if canRetrievedByDoer {
+ projects = append(projects, p)
+ }
+ }
}
- ctx.Data["OpenProjects"] = append(projects, projectsUser...)
+ ctx.Data["OpenProjects"] = projects
projects, _, err = project_model.FindProjects(ctx, project_model.SearchOptions{
RepoID: repo.ID,
@@ -512,29 +536,41 @@ func retrieveProjects(ctx *context.Context, repo *repo_model.Repository) {
ctx.ServerError("GetProjects", err)
return
}
- projectsOrg, _, err = project_model.FindProjects(ctx, project_model.SearchOptions{
- OwnerID: repo.OwnerID,
- Page: -1,
- IsClosed: util.OptionalBoolTrue,
- Type: project_model.TypeOrganization,
- })
- if err != nil {
- ctx.ServerError("GetProjects", err)
- return
+ // repo's owner can retrieve his individual projects
+ if ctx.Doer.ID == repo.OwnerID {
+ projectsRepoOwner, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
+ OwnerID: repo.OwnerID,
+ Page: -1,
+ IsClosed: util.OptionalBoolTrue,
+ Type: project_model.TypeIndividual,
+ })
+ if err != nil {
+ ctx.ServerError("GetProjects", err)
+ return
+ }
+ projects = append(projects, projectsRepoOwner...)
}
- projects = append(projects, projectsOrg...)
- projectsUser, _, err = project_model.FindProjects(ctx, project_model.SearchOptions{
- OwnerID: ctx.Doer.ID,
- Page: -1,
- IsClosed: util.OptionalBoolTrue,
- Type: project_model.TypeIndividual,
- })
- if err != nil {
- ctx.ServerError("GetProjects", err)
- return
+ if ctx.ContextUser.IsOrganization() {
+ projectsOrg, _, err := project_model.FindProjects(ctx, project_model.SearchOptions{
+ OwnerID: repo.OwnerID,
+ Page: -1,
+ IsClosed: util.OptionalBoolTrue,
+ Type: project_model.TypeOrganization,
+ })
+ if err != nil {
+ ctx.ServerError("GetProjects", err)
+ return
+ }
+ for _, p := range projectsOrg {
+ if canRetrievedByDoer, err := p.CanRetrievedByDoer(ctx, repo, ctx.Doer.ID); err != nil {
+ ctx.ServerError("CanRetrievedByDoer", err)
+ return
+ } else if canRetrievedByDoer {
+ projects = append(projects, p)
+ }
+ }
}
-
- ctx.Data["ClosedProjects"] = append(projects, projectsUser...)
+ ctx.Data["ClosedProjects"] = projects
}
// repoReviewerSelection items to bee shown
@@ -872,17 +908,23 @@ func NewIssue(ctx *context.Context) {
}
}
- // TODO: add org/user project support
projectID := ctx.FormInt64("project")
- if projectID > 0 && isProjectsEnabled {
+ if projectID > 0 {
project, err := project_model.GetProjectByID(ctx, projectID)
if err != nil {
log.Error("GetProjectByID: %d: %v", projectID, err)
- } else if project.RepoID != ctx.Repo.Repository.ID {
- log.Error("GetProjectByID: %d: %v", projectID, fmt.Errorf("project[%d] not found", project.ID))
} else {
- ctx.Data["project_id"] = projectID
- ctx.Data["Project"] = project
+ canRetrievedByDoer, err := project.CanRetrievedByDoer(ctx, ctx.Repo.Repository, ctx.Doer.ID)
+ if err != nil {
+ log.Error("CanRetrievedByDoer: %d: %v", projectID, err)
+ } else if !canRetrievedByDoer {
+ log.Error("CanRetrievedByDoer: %d: %v", projectID, fmt.Errorf("project[%d] not found", project.ID))
+ } else if project.IsRepositoryProject() && !isProjectsEnabled {
+ log.Error("CanRetrievedByDoer: %d: %v", projectID, fmt.Errorf("projects is not enabled in repo[%d]", ctx.Repo.Repository.ID))
+ } else {
+ ctx.Data["project_id"] = projectID
+ ctx.Data["Project"] = project
+ }
}
if len(ctx.Req.URL.Query().Get("project")) > 0 {
@@ -954,6 +996,7 @@ func NewIssueChooseTemplate(ctx *context.Context) {
}
ctx.Data["milestone"] = ctx.FormInt64("milestone")
+ // TODO: invaild projectid check?
ctx.Data["project"] = ctx.FormInt64("project")
ctx.HTML(http.StatusOK, tplIssueChoose)
@@ -1043,13 +1086,21 @@ func ValidateRepoMetas(ctx *context.Context, form forms.CreateIssueForm, isPull
return nil, nil, 0, 0, ""
}
- // TODO: check project accessibility, if it is not accessable, return 0
-
- ctx.Data["Project"] = p
- ctx.Data["project_id"] = form.ProjectID
+ // if projects unit of this repo is disabled in the repo, it will redirect to a 404 page
+ // if user have no access permission to the project, it will alse redirect to a 404 page
+ // so we need to return empty projectLink here
+ if canRetrievedByDoer, err := p.CanRetrievedByDoer(ctx, ctx.Repo.Repository, ctx.Doer.ID); err != nil {
+ ctx.ServerError("CanRetrievedByDoer", err)
+ return nil, nil, 0, 0, ""
+ } else if canRetrievedByDoer {
+ if !(p.IsRepositoryProject() && !ctx.Repo.CanRead(unit.TypeProjects)) {
+ ctx.Data["Project"] = p
+ ctx.Data["project_id"] = form.ProjectID
- projectId = form.ProjectID
- projectLink = p.Link()
+ projectId = form.ProjectID
+ projectLink = p.Link()
+ }
+ }
}
// Check assignees
@@ -1163,7 +1214,7 @@ func NewIssuePost(ctx *context.Context) {
}
log.Trace("Issue created: %d/%d", repo.ID, issue.ID)
- if ctx.FormString("redirect_after_creation") == "project" {
+ if ctx.FormString("redirect_after_creation") == "project" && projectLink != "" {
ctx.Redirect(projectLink)
} else {
ctx.Redirect(issue.Link())
@@ -2388,6 +2439,7 @@ func SearchIssues(ctx *context.Context) {
includedMilestones = strings.Split(milestones, ",")
}
+ // TODO:invaild projectid check?
projectID := ctx.FormInt64("project")
// this api is also used in UI,
@@ -2550,6 +2602,7 @@ func ListIssues(ctx *context.Context) {
}
}
+ // TODO: invaild projectid check?
projectID := ctx.FormInt64("project")
listOptions := db.ListOptions{
From 762cfa63a8f52743f6742d9ab07c91025d79df82 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Fri, 17 Feb 2023 13:46:46 +0900
Subject: [PATCH 22/69] fix 'new project' button in repo projects page
---
routers/web/repo/projects.go | 2 +-
templates/repo/projects/list.tmpl | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index e188501f3307..f51a8512038b 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -113,7 +113,7 @@ func Projects(ctx *context.Context) {
pager.AddParam(ctx, "state", "State")
ctx.Data["Page"] = pager
- ctx.Data["CanWriteProjects"] = true
+ ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(unit.TypeProjects)
ctx.Data["IsShowClosed"] = isShowClosed
ctx.Data["IsProjectsPage"] = true
ctx.Data["SortType"] = sortType
diff --git a/templates/repo/projects/list.tmpl b/templates/repo/projects/list.tmpl
index 7432298a3b78..5e8e00c6957c 100644
--- a/templates/repo/projects/list.tmpl
+++ b/templates/repo/projects/list.tmpl
@@ -53,7 +53,7 @@
{{JsPrettyNumber .NumClosedIssues}} {{$.locale.Tr "repo.issues.closed_title"}}
- {{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
+ {{if and $.CanWriteProjects (not $.Repository.IsArchived)}}