Administrator/gitea-MIRROR
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-11-09 17:37:20 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(pull): enforce user blocks on pull request reviews (#40194)

Browse Source 
Code review never checked user blocks, so a user blocked by the poster
or repository owner could still post reviews, code comments and replies
through the web, API and email.

- `CreateCodeComment` and `SubmitReview` now check blocks, with the repo
admin exemption issue comments have.
- Official reviewers blocked only by the author can still review, so an
author can't keep a maintainer from requesting changes.
- Review requests are handled in
https://github.com/go-gitea/gitea/pull/39296.

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
Basavaraj S m
2026-11-06 07:31:58 +00:00
committed by GitHub
parent 87ebf3b1ba
commit 8d14c9af20
4 changed files with 56 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
tests/integration/pull_review_test.go
View File

@@ -9,6 +9,7 @@ import (
"net/http/httptest"
"net/url"
"path"
"strconv"
"strings"
"testing"
"time"
@@ -36,7 +37,7 @@ import (
func TestPullReview(t *testing.T) {
defer tests.PrepareTestEnv(t)()
t.Run("ReviewerMissed", testPullReviewReviewerMissed)
t.Run("LockedPR", testPullReviewLockedPR)
t.Run("LockedOrBlocked", testPullReviewLockedOrBlocked)
}
func testPullReviewReviewerMissed(t *testing.T) {
@@ -58,24 +59,33 @@ func testPullReviewReviewerMissed(t *testing.T) {
assert.True(t, test.IsNormalPageCompleted(resp.Body.String()))
}
func testPullReviewLockedPR(t *testing.T) {
const reviewsURL = "/api/v1/repos/user2/repo1/pulls/3/reviews"
token := getUserToken(t, "user4", auth_model.AccessTokenScopeWriteRepository)
resp := MakeRequest(t, NewRequestWithJSON(t, "POST", reviewsURL, &api.CreatePullReviewOptions{Event: api.ReviewStatePending, Body: "test"}).AddTokenAuth(token), http.StatusOK)
pendingReview := DecodeJSON(t, resp, &api.PullReview{})
func testPullReviewLockedOrBlocked(t *testing.T) {
require.NoError(t, issues_model.UpdateIssueCols(t.Context(), &issues_model.Issue{ID: 3, IsLocked: true}, "is_locked"))
commentCount := unittest.GetCount(t, &issues_model.Comment{IssueID: 3})
reviewOptions := &api.CreatePullReviewOptions{Event: api.ReviewStateComment, Body: "test"}
for _, tc := range []struct{ reviewerID, index, replyCommentID int64 }{{4, 3, 7}, {34, 2, 4}} {
reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: tc.reviewerID})
issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: 1, Index: tc.index})
pendingReview, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{Type: issues_model.ReviewTypePending, Issue: issue, Reviewer: reviewer})
require.NoError(t, err)
commentCount := unittest.GetCount(t, &issues_model.Comment{IssueID: issue.ID})
pullPath := fmt.Sprintf("user2/repo1/pulls/%d", tc.index)
session := loginUser(t, reviewer.Name)
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
session := loginUser(t, "user4")
testSubmitReview(t, session, "user2", "repo1", "3", "", "comment", http.StatusBadRequest)
session.MakeRequest(t, NewRequestWithValues(t, "POST", "/user2/repo1/pulls/3/files/reviews/comments", map[string]string{"content": "test"}), http.StatusBadRequest)
MakeRequest(t, NewRequestWithJSON(t, "POST", reviewsURL, reviewOptions).AddTokenAuth(token), http.StatusForbidden)
MakeRequest(t, NewRequestWithJSON(t, "POST", fmt.Sprintf("%s/%d", reviewsURL, pendingReview.ID), &api.SubmitPullReviewOptions{Event: api.ReviewStateComment, Body: "test"}).AddTokenAuth(token), http.StatusForbidden)
MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/pulls/3/comments/7/replies", &api.CreatePullReviewCommentReplyOptions{Body: "test"}).AddTokenAuth(token), http.StatusForbidden)
unittest.AssertCount(t, &issues_model.Comment{IssueID: 3}, commentCount)
testSubmitReview(t, session, "user2", "repo1", strconv.FormatInt(tc.index, 10), "", "comment", http.StatusBadRequest)
session.MakeRequest(t, NewRequestWithValues(t, "POST", "/"+pullPath+"/files/reviews/comments", map[string]string{
"origin": "diff", "content": "test", "path": "README.md", "side": "proposed", "line": "1",
}), http.StatusBadRequest)
MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/repos/"+pullPath+"/reviews", &api.CreatePullReviewOptions{Event: api.ReviewStateComment, Body: "test"}).AddTokenAuth(token), http.StatusForbidden)
MakeRequest(t, NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/reviews/%d", pullPath, pendingReview.ID), &api.SubmitPullReviewOptions{Event: api.ReviewStateComment, Body: "test"}).AddTokenAuth(token), http.StatusForbidden)
MakeRequest(t, NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/comments/%d/replies", pullPath, tc.replyCommentID), &api.CreatePullReviewCommentReplyOptions{Body: "test"}).AddTokenAuth(token), http.StatusForbidden)
unittest.AssertCount(t, &issues_model.Comment{IssueID: issue.ID}, commentCount)
}
MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/pulls/3/reviews", &api.CreatePullReviewOptions{Event: api.ReviewStateComment, Body: "test"}).AddTokenAuth(getUserToken(t, "user2", auth_model.AccessTokenScopeWriteRepository)), http.StatusOK)
MakeRequest(t, NewRequestWithJSON(t, "POST", reviewsURL, reviewOptions).AddTokenAuth(getUserToken(t, "user2", auth_model.AccessTokenScopeWriteRepository)), http.StatusOK)
for name, status := range map[string]int{"user5": http.StatusBadRequest, "user40": http.StatusOK} {
require.NoError(t, db.Insert(t.Context(), &user_model.Blocking{BlockerID: 1, BlockeeID: unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: name}).ID}))
testSubmitReview(t, loginUser(t, name), "user2", "repo1", "2", "", "comment", status)
}
}
func TestPullView_CodeOwner(t *testing.T) {