woodpecker-ci/woodpecker

Former org repos admins have access to org settings

Opened this issue · 0 comments

Component

server, web-ui

Describe the bug

After changing access of a team from Administrator to General, the members of the mentioned group loose access to the repos settings, but still have access to the org settings.

Steps to reproduce

  1. Deploy Gitea and Woodpecker
  2. As Gitea administrator create an organization, a user and a repository
  3. Create a team with repos admin access
    Screenshot 2024-12-06 1
  4. Add a user there
    Screenshot 2024-12-06 2
  5. Login into WP under new user, add repository
  6. Add an org secret
    Screenshot 2024-12-06 3
  7. Log out from WP and Gitea
  8. As Gitea administrator revoke admin access from a team
    Screenshot 2024-12-06 4
    Screenshot 2024-12-06 5
  9. Log in under test user to WP again
  10. Check, you don't have access to a repository settings anymore
    Screenshot 2024-12-06 6
  11. But there is still access to an org settings
    Screenshot 2024-12-06 7

Expected behavior

There is no access to an org settings after admin permissions were revoked from a team.

System Info

Woodpecker next-9f0611d1a1, Gitea 1.22.4, Postgres 16

Additional context

There is no issue, if move users between the groups.

Validations

  • Read the docs.
  • Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
  • Checked that the bug isn't fixed in the next version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]