Move /info outside authorization

[Gusted]

• To use the web's API to get information about a issue/pull on a repository, doesn't require authorization(nor that the repository isn't archived).
• Regressed by: Never use /api/v1 from Gitea UI Pages #19318

[lunny]

• Never use /api/v1 from Gitea UI Pages Never use /api/v1 from Gitea UI Pages #19318

1 Why do you think it doesn't need authorization? What about a private repository's issues?
2 routes in Web should only be visited from UI. Gitea should not guarantee the routes path compatibility and stability.

[Gusted]

1 Why do you think it doesn't need authorization? What about a private repository's issues?

Because not every user on a Gitea instance would be logged in and they shouldn't be shown a loading spinner when hovering over a issue reference. Private repository's issues are not being checked in reqSignin, but in context.RepoAssignment IIRC, that's the main difference.

2 routes in Web should only be visited from UI. Gitea should not guarantee the routes path compatibility and stability.

It's still on the same path as before, now it just doesn't have the reqSignin middleware.

[zeripath]

Hmm... I think it should require permissions check. If you can't read the issues or pull requests you should not be able to access this endpoint. How does your change affect leakage for private repos where you have been given say code access but not read issues access?

[zeripath]

This also needs:

diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index 079ccbf6c..d0ddf7048 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -1799,6 +1799,27 @@ func GetIssueInfo(ctx *context.Context) {
 		}
 		return
 	}
+
+	if issue.IsPull {
+		// Need to check if Pulls are enabled and we can read Pulls
+		if !ctx.Repo.Repository.CanEnablePulls() || !ctx.Repo.CanRead(unit.TypePullRequests) {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	} else {
+		// Need to check if Issues are enabled and we can read Issues
+		if !ctx.Repo.CanRead(unit.TypeIssues) &&
+			!ctx.Repo.CanRead(unit.TypeExternalTracker) {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+		_, err := ctx.Repo.Repository.GetUnit(unit.TypeExternalTracker)
+		if err == nil {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	ctx.JSON(http.StatusOK, convert.ToAPIIssue(issue))
 }

[zeripath]

Realistically we might actually need a context.IssueAssignment() function that can do this sort of check as I bet that there are lots of other places where this check is not happening properly.

[codecov-commenter]

Codecov Report

❗ No coverage uploaded for pull request base (main@12c742f). Click here to learn what that means.
The diff coverage is 37.50%.

@@           Coverage Diff           @@
##             main   #19888   +/-   ##
=======================================
  Coverage        ?   47.29%           
=======================================
  Files           ?      958           
  Lines           ?   133516           
  Branches        ?        0           
=======================================
  Hits            ?    63144           
  Misses          ?    62699           
  Partials        ?     7673           

Impacted Files	Coverage Δ
routers/web/repo/issue.go	36.77% <16.66%> (ø)
routers/web/web.go	86.30% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 12c742f...e1d328e. Read the comment docs.