From f64f5495af50750349e187475c282f1f700beafc Mon Sep 17 00:00:00 2001 From: Giteabot Date: Tue, 13 Jun 2023 01:53:26 -0400 Subject: [PATCH] Hide limited users if viewed by anonymous ghost (#25214) (#25220) Backport #25214 by @KN4CK3R The ghost user leads to inclusion of limited users/orgs in `BuildCanSeeUserCondition`. Co-authored-by: KN4CK3R --- models/packages/container/search.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/models/packages/container/search.go b/models/packages/container/search.go index 0d3664d384..9a16b3ae44 100644 --- a/models/packages/container/search.go +++ b/models/packages/container/search.go @@ -262,6 +262,10 @@ func GetRepositories(ctx context.Context, actor *user_model.User, n int, last st cond = cond.And(builder.Gt{"package_property.value": strings.ToLower(last)}) } + if actor.IsGhost() { + actor = nil + } + cond = cond.And(user_model.BuildCanSeeUserCondition(actor)) sess := db.GetEngine(ctx).