Files
Basavaraj S mandsilverwind 25c5b6ab37 fix(issues): hide commit references the viewer cannot read (#40216)
Pushing a commit whose message mentions `owner/repo#1` adds a
"referenced this issue from a commit" event to that issue, with the
commit subject and a link into the pushed repository. The event never
recorded that repository, so a commit in a private repository
referencing a public issue showed its subject and repository path to
anonymous visitors of the issue page and the timeline API.

- The event now records the pushed repository in `RefRepoID`, and is
only shown to viewers who can read that repository's code, including the
issue's own. Older events have no recorded source and stay as they are.
- As on GitHub, the event stays attributed to the repository the commit
was first pushed to, even after the commit reaches another repository,
and is removed when that repository is deleted.

---------

Co-authored-by: silverwind <me@silverwind.io>
2026-11-10 06:13:50 +00:00

36 lines
1.6 KiB
Go

// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package issue
import (
"testing"
issues_model "gitea.dev/models/issues"
perm_model "gitea.dev/models/perm"
access_model "gitea.dev/models/perm/access"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unit"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestFilterReadableCommentsChecksUnitOfSameRepoTargets(t *testing.T) {
var perm access_model.Permission
perm.SetUnitsWithDefaultAccessMode([]*repo_model.RepoUnit{{Type: unit.TypeIssues}}, perm_model.AccessModeRead)
issueRef := &issues_model.Comment{Type: issues_model.CommentTypeIssueRef, RefRepoID: 1}
pullRef := &issues_model.Comment{Type: issues_model.CommentTypePullRef, RefRepoID: 1, RefIsPull: true}
issueDependency := &issues_model.Comment{Type: issues_model.CommentTypeAddDependency, DependentIssue: &issues_model.Issue{RepoID: 1}}
pullDependency := &issues_model.Comment{Type: issues_model.CommentTypeAddDependency, DependentIssue: &issues_model.Issue{RepoID: 1, IsPull: true}}
commitRef := &issues_model.Comment{Type: issues_model.CommentTypeCommitRef, RefRepoID: 1}
repo := &repo_model.Repository{ID: 1}
comments, err := FilterReadableComments(t.Context(), nil, perm, &issues_model.Issue{RepoID: 1, Repo: repo}, issues_model.CommentList{issueRef, pullRef, issueDependency, pullDependency, commitRef})
require.NoError(t, err)
assert.Equal(t, issues_model.CommentList{issueRef, issueDependency}, comments)
assert.Same(t, repo, issueRef.RefRepo)
assert.Same(t, repo, issueDependency.RefRepo)
assert.Same(t, repo, issueDependency.DependentIssue.Repo)
}