Members of a team in org can view detail of other teams (in the same org) via api #6704
Description
- Gitea version (or commit ref): 1.8.0
- Git version: 2.20.1
- Operating system: linux
- Database (use
[x]):- PostgreSQL
- MySQL
- MSSQL
- SQLite
- Can you reproduce the bug at https://try.gitea.io:
- Yes ( https://rucciva-peasant:mC2yjUj5K5gcFPP@try.gitea.io/api/v1/teams/2633/members)
- No
- Not relevant
- Log gist:
Description
If a user is added to a team in organization, the user could obtains information on other teams in the same organization via api (GET /teams/{id} and GET /teams/{id}/*). Meanwhile, accessing other team's page via web ui is forbidden