Fix users cannot visit issue attachment bug (#25019) (#25027)

Backport #25019 by @lunny Caused by #24362 Co-authored-by: Lunny Xiao <[email protected]> Co-authored-by: John Olheiser <[email protected]>
go-gitea · Jun 1, 2023 · 73ae6b2 · 73ae6b2
1 parent b83e4f2
commit 73ae6b2
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
@@ -110,11 +110,6 @@ func GetAttachment(ctx *context.Context) {
 			return
 		}
 	} else { // If we have the repository we check access
-		context.CheckRepoScopedToken(ctx, repository)
-		if ctx.Written() {
-			return
-		}
-
 		perm, err := access_model.GetUserRepoPermission(ctx, repository, ctx.Doer)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "GetUserRepoPermission", err.Error())

diff --git a/tests/integration/attachment_test.go b/tests/integration/attachment_test.go
@@ -89,6 +89,9 @@ func TestCreateIssueAttachment(t *testing.T) {
 	// Validate that attachment is available
 	req = NewRequest(t, "GET", "/attachments/"+uuid)
 	session.MakeRequest(t, req, http.StatusOK)
+
+	// anonymous visit should be allowed because user2/repo1 is a public repository
+	MakeRequest(t, req, http.StatusOK)
 }
 
 func TestGetAttachment(t *testing.T) {