From 0e8ec37e61a44f662c862d14f67a85fae7649bb5 Mon Sep 17 00:00:00 2001 From: oppiliappan Date: Fri, 25 Jul 2025 09:26:01 +0100 Subject: [PATCH] appview: fix pull close/reopen permissions Signed-off-by: oppiliappan --- appview/pulls/pulls.go | 6 ++++-- appview/pulls/router.go | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go index 337de1eb..3606b704 100644 --- a/appview/pulls/pulls.go +++ b/appview/pulls/pulls.go @@ -2026,9 +2026,10 @@ func (s *Pulls) ClosePull(w http.ResponseWriter, r *http.Request) { // auth filter: only owner or collaborators can close roles := f.RolesInRepo(user) + isOwner := roles.IsOwner() isCollaborator := roles.IsCollaborator() isPullAuthor := user.Did == pull.OwnerDid - isCloseAllowed := isCollaborator || isPullAuthor + isCloseAllowed := isOwner || isCollaborator || isPullAuthor if !isCloseAllowed { log.Println("failed to close pull") s.pages.Notice(w, "pull-close", "You are unauthorized to close this pull.") @@ -2094,9 +2095,10 @@ func (s *Pulls) ReopenPull(w http.ResponseWriter, r *http.Request) { // auth filter: only owner or collaborators can close roles := f.RolesInRepo(user) + isOwner := roles.IsOwner() isCollaborator := roles.IsCollaborator() isPullAuthor := user.Did == pull.OwnerDid - isCloseAllowed := isCollaborator || isPullAuthor + isCloseAllowed := isOwner || isCollaborator || isPullAuthor if !isCloseAllowed { log.Println("failed to close pull") s.pages.Notice(w, "pull-close", "You are unauthorized to close this pull.") diff --git a/appview/pulls/router.go b/appview/pulls/router.go index a15ad700..2e287354 100644 --- a/appview/pulls/router.go +++ b/appview/pulls/router.go @@ -44,6 +44,8 @@ func (s *Pulls) Router(mw *middleware.Middleware) http.Handler { r.Get("/", s.ResubmitPull) r.Post("/", s.ResubmitPull) }) + // permissions here require us to know pull author + // it is handled within the route r.Post("/close", s.ClosePull) r.Post("/reopen", s.ReopenPull) // collaborators only -- 2.51.2