Merge branch 'fix-2392' of git.openi.org.cn:OpenI/aiforge into fix-2392

modules/context/permission_json.go

@@ -0,0 +1,43 @@
+package context
+
+import (
+	"net/http"
+
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/modules/log"
+	"gitea.com/macaron/macaron"
+)
+
+func RequireRepoReaderJson(unitType models.UnitType) macaron.Handler {
+	return func(ctx *Context) {
+		if !ctx.Repo.CanRead(unitType) {
+			if log.IsTrace() {
+				if ctx.IsSigned {
+					log.Trace("Permission Denied: User %-v cannot read %-v in Repo %-v\n"+
+						"User in Repo has Permissions: %-+v",
+						ctx.User,
+						unitType,
+						ctx.Repo.Repository,
+						ctx.Repo.Permission)
+				} else {
+					log.Trace("Permission Denied: Anonymous user cannot read %-v in Repo %-v\n"+
+						"Anonymous user in Repo has Permissions: %-+v",
+						unitType,
+						ctx.Repo.Repository,
+						ctx.Repo.Permission)
+				}
+			}
+			ctx.JSON(http.StatusOK, models.BaseErrorMessage(ctx.Tr("error.no_right")))
+			return
+		}
+	}
+}
+
+func RequireRepoWriterJson(unitType models.UnitType) macaron.Handler {
+	return func(ctx *Context) {
+		if !ctx.Repo.CanWrite(unitType) {
+			ctx.JSON(http.StatusOK, models.BaseErrorMessage(ctx.Tr("error.no_right")))
+			return
+		}
+	}
+}

options/locale/locale_en-US.ini

@@ -98,6 +98,7 @@ error500= Sorry, the site has encountered some problems, we are trying to <stron
 [error]
 occurred = An error has occurred
 report_message = An error has occurred
+no_right=You have no right to do the operation.
 
 [install]
 install = Installation

options/locale/locale_zh-CN.ini

@@ -99,6 +99,7 @@ error500=抱歉，站点遇到一些问题，我们正尝试<strong>修复网页
 [error]
 occurred=发生错误
 report_message=发生错误
+no_right=您没有权限执行本操作。
 
 [install]
 install=安装页面

routers/repo/dataset.go

@@ -558,6 +558,7 @@ func ReferenceDataset(ctx *context.Context) {
 	MustEnableDataset(ctx)
 	ctx.Data["PageIsDataset"] = true
 	ctx.Data["MaxReferenceDatasetNum"] = setting.RepoMaxReferenceDatasetNum
+	ctx.Data["CanWrite"] = ctx.Repo.CanWrite(models.UnitTypeDatasets)
 	ctx.HTML(200, tplReference)
 
 }

routers/routes/routes.go

@@ -676,6 +676,9 @@ func RegisterRoutes(m *macaron.Macaron) {
 	reqRepoIssuesOrPullsReader := context.RequireRepoReaderOr(models.UnitTypeIssues, models.UnitTypePullRequests)
 	reqRepoDatasetReader := context.RequireRepoReader(models.UnitTypeDatasets)
 	reqRepoDatasetWriter := context.RequireRepoWriter(models.UnitTypeDatasets)
+	reqRepoDatasetReaderJson := context.RequireRepoReaderJson(models.UnitTypeDatasets)
+	reqRepoDatasetWriterJson := context.RequireRepoWriterJson(models.UnitTypeDatasets)
+
 	reqRepoCloudBrainReader := context.RequireRepoReader(models.UnitTypeCloudBrain)
 	reqRepoCloudBrainWriter := context.RequireRepoWriter(models.UnitTypeCloudBrain)
 	reqRepoModelManageReader := context.RequireRepoReader(models.UnitTypeModelManage)
@@ -1033,13 +1036,13 @@ func RegisterRoutes(m *macaron.Macaron) {
 		m.Group("/datasets", func() {
 			m.Get("", reqRepoDatasetReader, repo.DatasetIndex)
 			m.Get("/reference_datasets", reqRepoDatasetReader, repo.ReferenceDataset)
-			m.Get("/reference_datasets_data", reqRepoDatasetReader, repo.ReferenceDatasetData)
-			m.Delete("/reference_datasets/:id", reqRepoDatasetWriter, repo.ReferenceDatasetDelete)
+			m.Get("/reference_datasets_data", reqRepoDatasetReaderJson, repo.ReferenceDatasetData)
+			m.Delete("/reference_datasets/:id", reqRepoDatasetWriterJson, repo.ReferenceDatasetDelete)
 			m.Put("/:id/:action", reqRepoDatasetReader, repo.DatasetAction)
 			m.Get("/create", reqRepoDatasetWriter, repo.CreateDataset)
 			m.Post("/create", reqRepoDatasetWriter, bindIgnErr(auth.CreateDatasetForm{}), repo.CreateDatasetPost)
 			m.Get("/edit/:id", reqRepoDatasetWriter, repo.EditDataset)
-			m.Post("/reference_datasets", reqRepoDatasetWriter, bindIgnErr(auth.ReferenceDatasetForm{}), repo.ReferenceDatasetPost)
+			m.Post("/reference_datasets", reqRepoDatasetWriterJson, bindIgnErr(auth.ReferenceDatasetForm{}), repo.ReferenceDatasetPost)
 			m.Post("/edit", reqRepoDatasetWriter, bindIgnErr(auth.EditDatasetForm{}), repo.EditDatasetPost)
 			m.Get("/current_repo", repo.CurrentRepoDataset)
 			m.Get("/my_datasets", repo.MyDatasets)