MokoConsulting/MokoGitea-Fork
1
0
Fork 0
Code Issues 129 Pull Requests 2 Releases 96 Wiki Activity

fix(licenses): bypass attachment permission check for licensed downloads
Branch Policy Check / Verify merge target (pull_request) Has been cancelled
Details
Universal: PR Check / Branch Policy (pull_request) Has been cancelled
Details
Universal: PR Check / Validate PR (pull_request) Has been cancelled
Details
Branch Cleanup / Delete merged branch (pull_request) Has been cancelled
Details
PR RC Release / Build RC Release (pull_request) Has been cancelled
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details

Browse Source 
ServeAttachment checks perm.CanRead(unitType) which fails for
licensed read-only access on private repos. Now skips the check
when LicensedReadOnly is set in context (from RepoAssignment).

This allows Joomla/WordPress clients with valid dlid= params to
download release files from private licensed repos.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jonathan Miller
2026-06-02 10:17:06 -05:00
parent 02424c3f75
commit 95d93da2bc
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/repo/attachment.go
+5 -2
View File
@@ -182,8 +182,11 @@ func ServeAttachment(ctx *context.Context, uuid string) {
}
if !perm.CanRead(unitType) {
ctx.HTTPError(http.StatusNotFound)
return
// Allow access for licensed read-only mode (private repo with valid license key).
if ctx.Data["LicensedReadOnly"] != true {
ctx.HTTPError(http.StatusNotFound)
return
}
}
if requiredScope, ok := attachmentReadScope(unitType); ok {