opengist icon indicating copy to clipboard operation
opengist copied to clipboard
verified publisher icon thomiceli

Wrong visibility interaction when RequireLogin = true

Open thomiceli opened this issue 1 year ago • 2 comments

When RequireLogin is enabled in the admin panel, and when a user try to pull/clone a gist, the server obviously asks a user/password or check for an existing ssh key. But the access is granted only when the credentials passed match the owner of the gist.

thomiceli avatar May 12 '24 02:05 thomiceli

https://github.com/thomiceli/opengist/blob/2fd053a077e0502956b188dc3e3e4a3828b8b103/internal/web/git_http.go#L102 https://github.com/thomiceli/opengist/blob/2fd053a077e0502956b188dc3e3e4a3828b8b103/internal/ssh/git_ssh.go#L55

thomiceli avatar May 12 '24 02:05 thomiceli

Currently it behaves like a pull/clone and a push are the same thing when RequireLogin is enabled; where it should not be the case: a login is required but if the user exists, it should pull/clone where as only the gist owner should push

thomiceli avatar May 12 '24 02:05 thomiceli