From 3e8de17db3bdfef2e370fd9753638ce1dc14feda Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Wed, 23 Nov 2022 16:05:36 +0800
Subject: [PATCH] permission

---
 modules/notification/notification.go |  3 +++
 routers/api/v1/api.go                | 12 ++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/modules/notification/notification.go b/modules/notification/notification.go
index fe1abf9386..c1098e1017 100644
--- a/modules/notification/notification.go
+++ b/modules/notification/notification.go
@@ -143,6 +143,9 @@ func NotifyNewPullRequest(ctx context.Context, pr *issues_model.PullRequest, men
 		log.Error("%v", err)
 		return
 	}
+	if err := pr.Issue.LoadPoster(ctx); err != nil {
+		return
+	}
 	if pr.Issue.Poster.IsBots() {
 		return
 	}
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index eeb364c73f..d67bd28b80 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -71,6 +71,7 @@ import (
 	"reflect"
 	"strings"
 
+	bots_model "code.gitea.io/gitea/models/bots"
 	"code.gitea.io/gitea/models/organization"
 	"code.gitea.io/gitea/models/perm"
 	perm_model "code.gitea.io/gitea/models/perm"
@@ -187,6 +188,17 @@ func repoAssignment() func(ctx *context.APIContext) {
 		ctx.Repo.Repository = repo
 
 		if ctx.Doer != nil && ctx.Doer.ID == user_model.BotUserID {
+			botTaskID := ctx.Data["BotTaskID"].(int64)
+			task, err := bots_model.GetTaskByID(ctx, botTaskID)
+			if err != nil {
+				ctx.Error(http.StatusInternalServerError, "bots_model.GetTaskByID", err)
+				return
+			}
+			if task.RepoID != repo.ID {
+				ctx.NotFound()
+				return
+			}
+
 			ctx.Repo.Permission.AccessMode = perm_model.AccessModeAdmin
 			if err := ctx.Repo.Repository.LoadUnits(ctx); err != nil {
 				ctx.Error(http.StatusInternalServerError, "LoadUnits", err)