From b14f5af220d695fc53bdeab0fb0dcb4b9a10ed6f Mon Sep 17 00:00:00 2001
From: lichengjun <lichengjun@easycorp.ltd>
Date: Thu, 19 Aug 2021 08:28:59 +0000
Subject: [PATCH] * Add GitLab Token authority verification.

---
 module/gitlab/control.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/module/gitlab/control.php b/module/gitlab/control.php
index 50a2c8f94f..4128af9db8 100644
--- a/module/gitlab/control.php
+++ b/module/gitlab/control.php
@@ -101,6 +101,11 @@ class gitlab extends control
     {
         $userPairs = $this->loadModel('user')->getPairs();
 
+        $gitlab = $this->gitlab->getByID($gitlabID);
+        $user   = $this->gitlab->apiGetCurrentUser($gitlab->url, $gitlab->token);
+        if(!isset($user->is_admin) or !$user->is_admin) die(js::alert($this->lang->gitlab->tokenLimit) . js::locate($this->createLink('gitlab', 'edit', array('gitlabID' => $gitlabID))));
+
+
         if($_POST)
         {
             $users       = $this->post->zentaoUsers;
@@ -140,7 +145,6 @@ class gitlab extends control
             return $this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess, 'locate' => $this->server->http_referer));
         }
 
-        $gitlab      = $this->gitlab->getByID($gitlabID);
         $zentaoUsers = $this->dao->select('account,email,realname')->from(TABLE_USER)->fetchAll('account');
 
         $this->view->title         = $this->lang->gitlab->bindUser;