From 3039ef90f221f40b62e6896041d0d1ab13ea384a Mon Sep 17 00:00:00 2001 From: 6543 <6543@obermui.de> Date: Mon, 13 Nov 2023 18:21:37 +0100 Subject: [PATCH 1/2] dont leak users via rss --- routers/web/user/home.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/routers/web/user/home.go b/routers/web/user/home.go index 8b9a4cd2241c6..f9dc93dc7d890 100644 --- a/routers/web/user/home.go +++ b/routers/web/user/home.go @@ -822,6 +822,11 @@ func UsernameSubRoute(ctx *context.Context) { reloadParam := func(suffix string) (success bool) { ctx.SetParams("username", strings.TrimSuffix(username, suffix)) context_service.UserAssignmentWeb()(ctx) + // check view permissions + if ctx.ContextUser.IsIndividual() && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) { + ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name)) + return false + } return !ctx.Written() } switch { From 6c374b8a456e67627e7916bc5a55593c79c297cf Mon Sep 17 00:00:00 2001 From: 6543 <6543@obermui.de> Date: Mon, 13 Nov 2023 20:13:39 +0100 Subject: [PATCH 2/2] Update routers/web/user/home.go Co-authored-by: delvh --- routers/web/user/home.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routers/web/user/home.go b/routers/web/user/home.go index f9dc93dc7d890..db3778d9e1816 100644 --- a/routers/web/user/home.go +++ b/routers/web/user/home.go @@ -823,7 +823,7 @@ func UsernameSubRoute(ctx *context.Context) { ctx.SetParams("username", strings.TrimSuffix(username, suffix)) context_service.UserAssignmentWeb()(ctx) // check view permissions - if ctx.ContextUser.IsIndividual() && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) { + if !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) { ctx.NotFound("user", fmt.Errorf(ctx.ContextUser.Name)) return false }