Do not allow Ghost access to limited visible user/org (#21849) (#21875)

Backport of #21849 Co-authored-by: Lauris BH <lauris@nix.lv>
go-gitea · Nov 20, 2022 · 87630a6 · 87630a6
1 parent 56716f5
commit 87630a6
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/models/organization/org.go b/models/organization/org.go
@@ -448,8 +448,9 @@ func CountOrgs(opts FindOrgOptions) (int64, error) {
 
 // HasOrgOrUserVisible tells if the given user can see the given org or user
 func HasOrgOrUserVisible(ctx context.Context, orgOrUser, user *user_model.User) bool {
-	// Not SignedUser
-	if user == nil {
+	// If user is nil, it's an anonymous user/request.
+	// The Ghost user is handled like an anonymous user.
+	if user == nil || user.IsGhost() {
 		return orgOrUser.Visibility == structs.VisibleTypePublic
 	}