Fix #6234 : Check organization visibility before everything else (#6235)

* Fix #6234 : Check organization visibility before everything else * Ensure that Owner is available in the Repo
go-gitea · Mar 5, 2019 · f80caa5 · f80caa5
1 parent b257e04
commit f80caa5
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/modules/context/repo.go b/modules/context/repo.go
@@ -212,6 +212,17 @@ func RedirectToRepo(ctx *Context, redirectRepoID int64) {
 
 func repoAssignment(ctx *Context, repo *models.Repository) {
 	var err error
+	if err = repo.GetOwner(); err != nil {
+		ctx.ServerError("GetOwner", err)
+		return
+	}
+
+	if repo.Owner.IsOrganization() {
+		if !models.HasOrgVisible(repo.Owner, ctx.User) {
+			ctx.NotFound("HasOrgVisible", nil)
+			return
+		}
+	}
 	ctx.Repo.Permission, err = models.GetUserRepoPermission(repo, ctx.User)
 	if err != nil {
 		ctx.ServerError("GetUserRepoPermission", err)