c2158b2a1f
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/7143 - The security patch of forgejo/forgejo#6843 fixed the issue where project boards loaded all issues without considering if the doer actually had permission to view that issue. Within that patch the call to `Issues` was modified to include this permission checking. - The query being generated was not entirely correct. Issues in public repositories weren't considered correctly (partly the fault of not setting `AllPublic` unconditionally) in the cause an authenticated user loaded the project. - This is now fixed by setting `AllPublic` unconditionally and subsequently fixing the `Issue` function to ensure that the combination of setting `AllPublic` and `User` generates the correct query, by combining the permission check and issues in public repositories as one `AND` query. - Added unit testing. - Added integration testing. - Resolves Codeberg/Community#1809 - Regression of https://codeberg.org/forgejo/forgejo/pulls/6843 Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7144 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org> Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
23 lines
288 B
YAML
23 lines
288 B
YAML
-
|
|
id: 1001
|
|
issue_id: 6
|
|
project_id: 1001
|
|
project_board_id: 1001
|
|
|
|
-
|
|
id: 1002
|
|
issue_id: 7
|
|
project_id: 1002
|
|
project_board_id: 1002
|
|
|
|
-
|
|
id: 1003
|
|
issue_id: 16
|
|
project_id: 1001
|
|
project_board_id: 1001
|
|
|
|
-
|
|
id: 1004
|
|
issue_id: 1
|
|
project_id: 1002
|
|
project_board_id: 1002
|