fix(api): owner ID should be zero when created repo secret #31715
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Change `owner.ID` to `0` in the `CreateOrUpdateSecret` function call Signed-off-by: Bo-Yi Wu <[email protected]>
GiteaBot
added
the
lgtm/need 2
pull-request-size
bot
added
the
size/XS
github-actions
bot
added
modifies/api
- Remove unused variable `owner` from `CreateOrUpdateSecret` function Signed-off-by: Bo-Yi Wu <[email protected]>
- Remove unused `owner` variable in `DeleteSecret` function - Change `DeleteSecretByName` function call to use `0` instead of `owner.ID` Signed-off-by: Bo-Yi Wu <[email protected]>
wolfogre
requested changes
Jul 28, 2024
There was a problem hiding this comment.
Sorry, I don't get it, why?
And how to handle deleting org?
gitea/models/organization/org.go
Line 404 in 0fe9f93
GiteaBot
added
lgtm/blocked
Yes, |
wolfogre
approved these changes
Jul 29, 2024
GiteaBot
added
lgtm/need 1
lunny
approved these changes
Jul 29, 2024
GiteaBot
added
lgtm/done
wolfogre
added
the
reviewed/wait-merge
GiteaBot
removed
the
reviewed/wait-merge
zjjhot
added a commit
to zjjhot/gitea
that referenced
this pull request
Jul 30, 2024
* giteaofficial/main: Set owner id to zero when GetRegistrationToken for repo (go-gitea#31725) fix(api): owner ID should be zero when created repo secret (go-gitea#31715) Fix API endpoint for registration-token (go-gitea#31722) Fix loadRepository error when access user dashboard (go-gitea#31719) Add permission check when creating PR (go-gitea#31033)
wolfogre
added a commit
that referenced
this pull request
Aug 1, 2024
Fix #31707. Also related to #31715. Some Actions resources could has different types of ownership. It could be: - global: all repos and orgs/users can use it. - org/user level: only the org/user can use it. - repo level: only the repo can use it. There are two ways to distinguish org/user level from repo level: 1. `{owner_id: 1, repo_id: 2}` for repo level, and `{owner_id: 1, repo_id: 0}` for org level. 2. `{owner_id: 0, repo_id: 2}` for repo level, and `{owner_id: 1, repo_id: 0}` for org level. The first way seems more reasonable, but it may not be true. The point is that although a resource, like a runner, belongs to a repo (it can be used by the repo), the runner doesn't belong to the repo's org (other repos in the same org cannot use the runner). So, the second method makes more sense. And the first way is not user-friendly to query, we must set the repo id to zero to avoid wrong results. So, #31715 should be right. And the most simple way to fix #31707 is just: ```diff - shared.GetRegistrationToken(ctx, ctx.Repo.Repository.OwnerID, ctx.Repo.Repository.ID) + shared.GetRegistrationToken(ctx, 0, ctx.Repo.Repository.ID) ``` However, it is quite intuitive to set both owner id and repo id since the repo belongs to the owner. So I prefer to be compatible with it. If we get both owner id and repo id not zero when creating or finding, it's very clear that the caller want one with repo level, but set owner id accidentally. So it's OK to accept it but fix the owner id to zero.
|
I was unable to create a backport for 1.22. @appleboy, please send one manually. 🍵 |
GiteaBot
added
the
backport/manual
appleboy
added a commit
to appleboy/gitea
that referenced
this pull request
Aug 9, 2024
…31715) - Change condition to include `RepoID` equal to 0 for organization secrets --------- Signed-off-by: Bo-Yi Wu <[email protected]> Co-authored-by: Giteabot <[email protected]>
lunny
pushed a commit
that referenced
this pull request
Aug 9, 2024
…31811) - Change condition to include `RepoID` equal to 0 for organization secrets Backport #31715 by @appleboy Signed-off-by: Bo-Yi Wu <[email protected]>
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
RepoIDequal to 0 for organization secrets