From 8328afa6d8c3da4440dc474feedb2d6691c43ad2 Mon Sep 17 00:00:00 2001
From: yan <sxty32@gmail.com>
Date: Wed, 3 Jun 2020 09:47:42 +0800
Subject: [PATCH] improved some issue.   * fix repo/dataset reqsign, when
 unsign   * attachement search list by permission

---
 routers/repo/dataset.go  | 17 ++++++++++++++++-
 routers/routes/routes.go |  9 +++++----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/routers/repo/dataset.go b/routers/repo/dataset.go
index cef47ef70..6db1b74b0 100644
--- a/routers/repo/dataset.go
+++ b/routers/repo/dataset.go
@@ -22,6 +22,21 @@ func MustEnableDataset(ctx *context.Context) {
 	}
 }
 
+func filterPrivateAttachments(ctx *context.Context, list []*models.Attachment) []*models.Attachment {
+	if ctx.Repo.CanWrite(models.UnitTypeDatasets) {
+		return list
+	} else {
+		var publicList []*models.Attachment
+		for _, attach := range list {
+			if !attach.IsPrivate {
+				publicList = append(publicList, attach)
+			}
+		}
+		return publicList
+	}
+
+}
+
 func DatasetIndex(ctx *context.Context) {
 	MustEnableDataset(ctx)
 
@@ -37,7 +52,7 @@ func DatasetIndex(ctx *context.Context) {
 		ctx.ServerError("GetDatasetAttachments", err)
 		return
 	}
-	attachments := dataset.Attachments
+	attachments := filterPrivateAttachments(ctx, dataset.Attachments)
 
 	ctx.Data["SortType"] = ctx.Query("sort")
 	switch ctx.Query("sort") {
diff --git a/routers/routes/routes.go b/routers/routes/routes.go
index 74fd5135a..1d821be6d 100644
--- a/routers/routes/routes.go
+++ b/routers/routes/routes.go
@@ -764,10 +764,6 @@ func RegisterRoutes(m *macaron.Macaron) {
 			m.Post("/status", reqRepoIssuesOrPullsWriter, repo.UpdateIssueStatus)
 			m.Post("/resolve_conversation", reqRepoIssuesOrPullsReader, repo.UpdateResolveConversation)
 		}, context.RepoMustNotBeArchived())
-		m.Group("/datasets", func() {
-			m.Get("", reqRepoDatasetReader, repo.DatasetIndex)
-			m.Post("", reqRepoDatasetWriter, bindIgnErr(auth.EditDatasetForm{}), repo.EditDatasetPost)
-		}, context.RepoMustNotBeArchived())
 		m.Group("/comments/:id", func() {
 			m.Post("", repo.UpdateCommentContent)
 			m.Post("/delete", repo.DeleteComment)
@@ -866,6 +862,11 @@ func RegisterRoutes(m *macaron.Macaron) {
 			m.Get("/milestones", reqRepoIssuesOrPullsReader, repo.Milestones)
 		}, context.RepoRef())
 
+		m.Group("/datasets", func() {
+			m.Get("", reqRepoDatasetReader, repo.DatasetIndex)
+			m.Post("", reqRepoDatasetWriter, bindIgnErr(auth.EditDatasetForm{}), repo.EditDatasetPost)
+		}, context.RepoRef())
+
 		m.Group("/wiki", func() {
 			m.Get("/?:page", repo.Wiki)
 			m.Get("/_pages", repo.WikiPages)