From f64f5495af50750349e187475c282f1f700beafc Mon Sep 17 00:00:00 2001
From: Giteabot <teabot@gitea.io>
Date: Tue, 13 Jun 2023 01:53:26 -0400
Subject: [PATCH] Hide limited users if viewed by anonymous ghost (#25214)
(#25220)
Backport #25214 by @KN4CK3R
The ghost user leads to inclusion of limited users/orgs in
`BuildCanSeeUserCondition`.
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
---
models/packages/container/search.go | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/models/packages/container/search.go b/models/packages/container/search.go
index 0d3664d384..9a16b3ae44 100644
--- a/models/packages/container/search.go
+++ b/models/packages/container/search.go
@@ -262,6 +262,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st
cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)})
}
+ if actor.IsGhost() {
+ actor = nil
+ }
+
cond = cond.And(user_model.BuildCanSeeUserCondition(actor))
sess := db.GetEngine(ctx).