Files
Basavaraj S mandsilverwind 25c5b6ab37 fix(issues): hide commit references the viewer cannot read (#40216)
Pushing a commit whose message mentions `owner/repo#1` adds a
"referenced this issue from a commit" event to that issue, with the
commit subject and a link into the pushed repository. The event never
recorded that repository, so a commit in a private repository
referencing a public issue showed its subject and repository path to
anonymous visitors of the issue page and the timeline API.

- The event now records the pushed repository in `RefRepoID`, and is
only shown to viewers who can read that repository's code, including the
issue's own. Older events have no recorded source and stay as they are.
- As on GitHub, the event stays attributed to the repository the commit
was first pushed to, even after the commit reaches another repository,
and is removed when that repository is deleted.

---------

Co-authored-by: silverwind <me@silverwind.io>
2026-11-10 06:13:50 +00:00

347 lines
12 KiB
Go

// Copyright 2019 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package issue
import (
"testing"
activities_model "gitea.dev/models/activities"
issues_model "gitea.dev/models/issues"
access_model "gitea.dev/models/perm/access"
repo_model "gitea.dev/models/repo"
"gitea.dev/models/unittest"
user_model "gitea.dev/models/user"
"gitea.dev/modules/repository"
"gitea.dev/modules/setting"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestUpdateIssuesCommit(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
pushCommits := []*repository.PushCommit{
{
Sha1: "abcdef1",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user4@example.com",
AuthorName: "User Four",
Message: "start working on #FST-1, #1",
},
{
Sha1: "abcdef2",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "a plain message",
},
{
Sha1: "abcdef2",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "close #2, reopen #2",
},
}
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
repo.Owner = user
commentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef1",
PosterID: user.ID,
IssueID: 1,
}
issueBean := &issues_model.Issue{RepoID: repo.ID, Index: 2}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 2}, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, commentBean)
unittest.AssertExistsAndLoadBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
// Test that push to a non-default branch closes no issue.
pushCommits = []*repository.PushCommit{
{
Sha1: "abcdef1",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user4@example.com",
AuthorName: "User Four",
Message: "close #1",
},
}
repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
commentBean = &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef1",
PosterID: user.ID,
IssueID: 6,
}
issueBean = &issues_model.Issue{RepoID: repo.ID, Index: 1}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 1}, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, "non-existing-branch"))
unittest.AssertExistsAndLoadBean(t, commentBean)
unittest.AssertNotExistsBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
pushCommits = []*repository.PushCommit{
{
Sha1: "abcdef3",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "close " + setting.AppURL + repo.FullName() + "/pulls/1",
},
}
repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
commentBean = &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef3",
PosterID: user.ID,
IssueID: 6,
}
issueBean = &issues_model.Issue{RepoID: repo.ID, Index: 1}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 1}, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, commentBean)
unittest.AssertExistsAndLoadBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 48})
admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
assert.NoError(t, UpdateIssuesCommit(t.Context(), admin, repo, []*repository.PushCommit{{Sha1: "abcdef4", Message: "close #1"}}, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 1}, "is_closed=0")
assert.NoError(t, UpdateIssuesCommit(t.Context(), admin, repo, []*repository.PushCommit{{Sha1: "abcdef5", Message: "close !1"}}, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 1}, "is_closed=1")
}
func TestUpdateIssuesCommit_Colon(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
pushCommits := []*repository.PushCommit{
{
Sha1: "abcdef2",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "close: #2",
},
}
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
repo.Owner = user
issueBean := &issues_model.Issue{RepoID: repo.ID, Index: 4}
unittest.AssertNotExistsBean(t, &issues_model.Issue{RepoID: repo.ID, Index: 2}, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
}
func TestUpdateIssuesCommit_Issue5957(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
// Test that push to a non-default branch closes an issue.
pushCommits := []*repository.PushCommit{
{
Sha1: "abcdef1",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user4@example.com",
AuthorName: "User Four",
Message: "close #2",
},
}
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
commentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef1",
PosterID: user.ID,
IssueID: 7,
}
issueBean := &issues_model.Issue{RepoID: repo.ID, Index: 2, ID: 7}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, issueBean, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, "non-existing-branch"))
unittest.AssertExistsAndLoadBean(t, commentBean)
unittest.AssertExistsAndLoadBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
}
func TestUpdateIssuesCommit_AnotherRepo(t *testing.T) {
for _, message := range []string{
"close user2/repo1#1",
"close " + setting.AppURL + "user2/repo1/issues/1",
} {
t.Run(message, func(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
// Test that a push to default branch closes issue in another repo
// If the user also has push permissions to that repo
pushCommits := []*repository.PushCommit{
{
Sha1: "abcdef1",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: message,
},
}
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
commentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef1",
PosterID: user.ID,
IssueID: 1,
}
issueBean := &issues_model.Issue{RepoID: 1, Index: 1, ID: 1}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, issueBean, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
comment := unittest.AssertExistsAndLoadBean(t, commentBean)
issue := unittest.AssertExistsAndLoadBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
require.NoError(t, issue.LoadRepo(t.Context()))
for doer, visibleCount := range map[*user_model.User]int{nil: 0, user: 1} {
perm, err := access_model.GetDoerRepoPermission(t.Context(), issue.Repo, doer)
require.NoError(t, err)
comments, err := FilterReadableComments(t.Context(), doer, perm, issue, issues_model.CommentList{comment})
require.NoError(t, err)
assert.Len(t, comments, visibleCount)
}
})
}
}
func TestUpdateIssuesCommit_AnotherRepoNoPermission(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 10})
// Test that a push with close reference *can not* close issue
// If the committer doesn't have push rights in that repo
pushCommits := []*repository.PushCommit{
{
Sha1: "abcdef3",
CommitterEmail: "user10@example.com",
CommitterName: "User Ten",
AuthorEmail: "user10@example.com",
AuthorName: "User Ten",
Message: "close org3/repo3#1",
},
{
Sha1: "abcdef4",
CommitterEmail: "user10@example.com",
CommitterName: "User Ten",
AuthorEmail: "user10@example.com",
AuthorName: "User Ten",
Message: "close " + setting.AppURL + "org3/repo3/issues/1",
},
}
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 6})
commentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef3",
PosterID: user.ID,
IssueID: 6,
}
commentBean2 := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef4",
PosterID: user.ID,
IssueID: 6,
}
issueBean := &issues_model.Issue{RepoID: 3, Index: 1, ID: 6}
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, commentBean2)
unittest.AssertNotExistsBean(t, issueBean, "is_closed=1")
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
unittest.AssertNotExistsBean(t, commentBean)
unittest.AssertNotExistsBean(t, commentBean2)
unittest.AssertNotExistsBean(t, issueBean, "is_closed=1")
unittest.CheckConsistencyFor(t, &activities_model.Action{})
}
func TestUpdateIssuesCommit_SelfReference(t *testing.T) {
assert.NoError(t, unittest.PrepareTestDatabase())
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
// Test that a PR merge commit that references its own PR does not create a self-reference comment
// PR #2 (issue_id=2) has merged_commit_id: 1a8823cd1a9549fde083f992f6b9b87a7ab74fb3
pushCommits := []*repository.PushCommit{
{
Sha1: "1a8823cd1a9549fde083f992f6b9b87a7ab74fb3",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "Merge pull request 'issue2' (#2) from branch1 into master",
},
}
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
selfRefCommentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "1a8823cd1a9549fde083f992f6b9b87a7ab74fb3",
PosterID: user.ID,
IssueID: 2,
}
unittest.AssertNotExistsBean(t, selfRefCommentBean)
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits, repo.DefaultBranch))
unittest.AssertNotExistsBean(t, selfRefCommentBean)
unittest.CheckConsistencyFor(t, &activities_model.Action{})
// Test that normal commit references are still created
pushCommits2 := []*repository.PushCommit{
{
Sha1: "abcdef9876543210",
CommitterEmail: "user2@example.com",
CommitterName: "User Two",
AuthorEmail: "user2@example.com",
AuthorName: "User Two",
Message: "Fix bug, refs #1",
},
}
otherRefCommentBean := &issues_model.Comment{
Type: issues_model.CommentTypeCommitRef,
CommitSHA: "abcdef9876543210",
PosterID: user.ID,
IssueID: 1,
}
unittest.AssertNotExistsBean(t, otherRefCommentBean)
assert.NoError(t, UpdateIssuesCommit(t.Context(), user, repo, pushCommits2, repo.DefaultBranch))
unittest.AssertExistsAndLoadBean(t, otherRefCommentBean)
unittest.CheckConsistencyFor(t, &activities_model.Action{})
}