Prevent transferring repos to invisible orgs (#11517) (#11549)

Co-authored-by: Guillermo Prandi <[email protected]> Co-authored-by: Guillermo Prandi <[email protected]> Co-authored-by: zeripath <[email protected]>
go-gitea · May 23, 2020 · 3b1e114 · 3b1e114
1 parent 573a9c6
commit 3b1e114
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/routers/repo/setting.go b/routers/repo/setting.go
@@ -22,6 +22,7 @@ import (
  "code.gitea.io/gitea/modules/log"
  "code.gitea.io/gitea/modules/repository"
  "code.gitea.io/gitea/modules/setting"
+ "code.gitea.io/gitea/modules/structs"
  "code.gitea.io/gitea/modules/timeutil"
  "code.gitea.io/gitea/modules/validation"
  "code.gitea.io/gitea/routers/utils"
@@ -379,6 +380,14 @@ func SettingsPost(ctx *context.Context, form auth.RepoSettingForm) {
  return
  }
 
+ if newOwner.Type == models.UserTypeOrganization {
+ if !ctx.User.IsAdmin && newOwner.Visibility == structs.VisibleTypePrivate && !ctx.User.IsUserPartOfOrg(newOwner.ID) {
+ // The user shouldn't know about this organization
+ ctx.RenderWithErr(ctx.Tr("form.enterred_invalid_owner_name"), tplSettingsOptions, nil)
+ return
+ }
+ }
+
  // Close the GitRepo if open
  if ctx.Repo.GitRepo != nil {
  ctx.Repo.GitRepo.Close()