User with no action unit access permission can also see the commit status

[yp05327]

Description

User's permission:

Gitea Version

latest

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

build

Database

None

[lunny]

It's commit status not actions' special feature.

[yp05327]

It's commit status not actions' special feature.

Reasonable answer. But, if click details, you will get 404 page.

Should we hidden this when using Gitea action and user have no unit permission?

[lunny]

It's commit status not actions' special feature.

Reasonable answer. But, if click details, you will get 404 page. Should we hidden this when using Gitea action and user have no unit permission?

Wow, I have no idea how to handle now.

[Zettat123]

I encountered a similar issue. If the repo's action unit is disabled, even though I'm a repo administrator, I'll still get a 404 page when clicking the "Details" link

[yp05327]

I think this should be hidden when user does not have permission or the unit is disabled.

[lunny]

But you don't know if the commit status comes from actions or external sites.

[Zettat123]

But you don't know if the commit status comes from actions or external sites.

Maybe we can check the TargetURL of a commit status. If a status comes from Gitea Actions, its TargetURL should have a prefix like /{owner}/{repo}/actions

[yp05327]

Actually, I noticed another related issue.
If user has no access to code unit, but have access to action unit,
you would see the workflow file name, branch name, commit id and so on.
And they also have links which will get 404.