From 6f4ba6884c85e5603e7510c0e0d114bc9f86965f Mon Sep 17 00:00:00 2001
From: Ethan Koenig <etk39@cornell.edu>
Date: Thu, 29 Dec 2016 08:17:32 -0500
Subject: [PATCH] Repo permission bug fixes (#513)

---
 modules/context/api.go      | 30 ------------------------------
 routers/api/v1/api.go       |  8 +++-----
 routers/api/v1/repo/repo.go |  4 ++++
 3 files changed, 7 insertions(+), 35 deletions(-)

diff --git a/modules/context/api.go b/modules/context/api.go
index 7a3ff990b..725a3461a 100644
--- a/modules/context/api.go
+++ b/modules/context/api.go
@@ -75,36 +75,6 @@ func APIContexter() macaron.Handler {
 	}
 }
 
-// ExtractOwnerAndRepo returns a handler that populates the `Repo.Owner` and
-// `Repo.Repository` fields of an APIContext
-func ExtractOwnerAndRepo() macaron.Handler {
-	return func(ctx *APIContext) {
-		owner, err := models.GetUserByName(ctx.Params(":username"))
-		if err != nil {
-			if models.IsErrUserNotExist(err) {
-				ctx.Error(422, "", err)
-			} else {
-				ctx.Error(500, "GetUserByName", err)
-			}
-			return
-		}
-
-		repo, err := models.GetRepositoryByName(owner.ID, ctx.Params(":reponame"))
-		if err != nil {
-			if models.IsErrRepoNotExist(err) {
-				ctx.Status(404)
-			} else {
-				ctx.Error(500, "GetRepositoryByName", err)
-			}
-			return
-		}
-		ctx.Repo.Owner = owner
-		ctx.Data["Owner"] = owner
-		ctx.Repo.Repository = repo
-		ctx.Data["Repository"] = repo
-	}
-}
-
 // ReferencesGitRepo injects the GitRepo into the Context
 func ReferencesGitRepo() macaron.Handler {
 	return func(ctx *APIContext) {
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index cfba8d713..547dbceb4 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -239,7 +239,7 @@ func RegisterRoutes(m *macaron.Macaron) {
 					m.Get("", user.IsStarring)
 					m.Put("", user.Star)
 					m.Delete("", user.Unstar)
-				}, context.ExtractOwnerAndRepo())
+				}, repoAssignment())
 			})
 
 			m.Get("/subscriptions", user.GetMyWatchedRepos)
@@ -258,11 +258,9 @@ func RegisterRoutes(m *macaron.Macaron) {
 
 		m.Group("/repos", func() {
 			m.Post("/migrate", bind(auth.MigrateRepoForm{}), repo.Migrate)
-			m.Combo("/:username/:reponame", context.ExtractOwnerAndRepo()).
-				Get(repo.Get).
-				Delete(repo.Delete)
 
 			m.Group("/:username/:reponame", func() {
+				m.Combo("").Get(repo.Get).Delete(repo.Delete)
 				m.Group("/hooks", func() {
 					m.Combo("").Get(repo.ListHooks).
 						Post(bind(api.CreateHookOption{}), repo.CreateHook)
@@ -330,7 +328,7 @@ func RegisterRoutes(m *macaron.Macaron) {
 					m.Get("", user.IsWatching)
 					m.Put("", user.Watch)
 					m.Delete("", user.Unwatch)
-				}, context.ExtractOwnerAndRepo())
+				})
 				m.Get("/editorconfig/:filename", context.RepoRef(), repo.GetEditorconfig)
 				m.Group("/pulls", func() {
 					m.Combo("").Get(bind(api.ListPullRequestsOptions{}), repo.ListPullRequests).Post(reqRepoWriter(), bind(api.CreatePullRequestOption{}), repo.CreatePullRequest)
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go
index 35e655427..fea625fbe 100644
--- a/routers/api/v1/repo/repo.go
+++ b/routers/api/v1/repo/repo.go
@@ -275,6 +275,10 @@ func GetByID(ctx *context.APIContext) {
 // Delete one repository
 // see https://github.com/gogits/go-gogs-client/wiki/Repositories#delete
 func Delete(ctx *context.APIContext) {
+	if !ctx.Repo.IsAdmin() {
+		ctx.Error(403, "", "Must have admin rights")
+		return
+	}
 	owner := ctx.Repo.Owner
 	repo := ctx.Repo.Repository