Fix users cannot visit issue attachment bug (go-gitea#25019) (go-gite…

…a#25027) Backport go-gitea#25019 by @lunny Caused by go-gitea#24362 Co-authored-by: Lunny Xiao <[email protected]> Co-authored-by: John Olheiser <[email protected]> (cherry picked from commit 73ae6b2)
Codeberg-org · Jun 5, 2023 · 05a3e85 · 05a3e85
1 parent c5245fa
commit 05a3e85
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
@@ -110,11 +110,6 @@ func GetAttachment(ctx *context.Context) {
 			return
 		}
 	} else { // If we have the repository we check access
-		context.CheckRepoScopedToken(ctx, repository)
-		if ctx.Written() {
-			return
-		}
-
 		perm, err := access_model.GetUserRepoPermission(ctx, repository, ctx.Doer)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err.Error())

diff --git a/tests/integration/attachment_test.go b/tests/integration/attachment_test.go
@@ -89,6 +89,9 @@ func TestCreateIssueAttachment(t *testing.T) {
 	// Validate that attachment is available
 	req = NewRequest(t, "GET", "/attachments/"+uuid)
 	session.MakeRequest(t, req, http.StatusOK)
+
+	// anonymous visit should be allowed because user2/repo1 is a public repository
+	MakeRequest(t, req, http.StatusOK)
 }
 
 func TestGetAttachment(t *testing.T) {