GetUserDataSetPermission

models/attachment.go

@@ -295,3 +295,11 @@ func IterateAttachment(f func(attach *Attachment) error) error {
 		}
 	}
 }
+
+// LinkedDataSet returns the linked data_set if any
+func (a *Attachment) LinkedDataSet() (*Dataset, error) {
+	if a.DatasetID != 0 {
+		return GetDatasetByID(a.DatasetID)
+	}
+	return nil, nil
+}

models/dataset_permission.go

@@ -0,0 +1,36 @@
+// Copyright 2018 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package models
+
+import (
+	"code.gitea.io/gitea/modules/log"
+)
+
+const (
+	STATUS_PRIVATE = 0
+	STATUS_PUBLIC = 1
+	STATUS_DELETED = 2
+)
+
+// GetUserDataSetPermission returns the user permissions to the data_set
+func GetUserDataSetPermission(dataSet *Dataset, user *User) (isPermit bool, err error) {
+	isPermit = false
+
+	switch dataSet.Status {
+	case STATUS_DELETED:
+		log.Error("the data_set has been deleted")
+	case STATUS_PRIVATE:
+		if !user.IsAdmin && user.ID != dataSet.UserID {
+			log.Error("the user is not admin nor the owner of the data_set")
+		}
+	case STATUS_PUBLIC:
+		isPermit = true
+	default:
+		log.Error("the status of data_set is wrong")
+	}
+
+	return isPermit, nil
+
+}

routers/repo/attachment.go

@@ -17,6 +17,8 @@ import (
 	"code.gitea.io/gitea/modules/upload"
 )
 
+const MINIO_STORAGE_TYPE = "minio"
+
 func RenderAttachmentSettings(ctx *context.Context) {
 	renderAttachmentSettings(ctx)
 }
@@ -127,8 +129,26 @@ func GetAttachment(ctx *context.Context) {
 		}
 	}
 
+	dataSet, err := attach.LinkedDataSet()
+	if err != nil {
+		ctx.ServerError("LinkedDataSet", err)
+		return
+	}
+
+	if dataSet != nil {
+		isPermit, err := models.GetUserDataSetPermission(dataSet, ctx.User)
+		if err != nil {
+			ctx.Error(http.StatusInternalServerError, "GetUserDataSetPermission", err.Error())
+			return
+		}
+		if !isPermit {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	//If we have matched and access to release or issue
-	if setting.Attachment.StoreType == "minio" {
+	if setting.Attachment.StoreType == MINIO_STORAGE_TYPE {
 		url, err := storage.Attachments.PresignedGetURL(attach.RelativePath(), attach.Name)
 		if err != nil {
 			ctx.ServerError("PresignedGetURL", err)