TRKJ/gitea
2
0
Fork 0
mirror of https://gitee.com/gitea/gitea synced 2025-12-27 10:46:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Only view milestones from current repo (#18414)

Browse Source 
The endpoint /{username}/{reponame}/milestone/{id} is not currently restricted to
the repo. This PR restricts the milestones to those within the repo.

Signed-off-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
zeripath
2022-01-26 20:01:35 +00:00
committed by GitHub
parent 3bb028cc46
commit 9a75c2741d
4 changed files with 4 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
routers/web/repo/milestone.go
View File

@@ -264,7 +264,7 @@ func DeleteMilestone(ctx *context.Context) {
// MilestoneIssuesAndPulls lists all the issues and pull requests of the milestone
func MilestoneIssuesAndPulls(ctx *context.Context) {
milestoneID := ctx.ParamsInt64(":id")
milestone, err := models.GetMilestoneByID(milestoneID)
milestone, err := models.GetMilestoneByRepoID(ctx.Repo.Repository.ID, milestoneID)
if err != nil {
if models.IsErrMilestoneNotExist(err) {
ctx.NotFound("GetMilestoneByID", err)