From f09b537a4ce8d460fc0b24becc800847963a0a76 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Fri, 14 Feb 2020 18:48:49 -0500
Subject: [PATCH] Fix anonymous download of artifacts

---
 gitsrht/blueprints/artifacts.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gitsrht/blueprints/artifacts.py b/gitsrht/blueprints/artifacts.py
index c382084..e02d68b 100644
--- a/gitsrht/blueprints/artifacts.py
+++ b/gitsrht/blueprints/artifacts.py
@@ -8,7 +8,7 @@ from gitsrht.repos import delete_artifact, upload_artifact
 from gitsrht.types import Artifact
 from minio import Minio
 from minio.error import BucketAlreadyOwnedByYou, BucketAlreadyExists
-from scmsrht.access import check_access, UserAccess
+from scmsrht.access import check_access, get_repo_or_redir, UserAccess
 from srht.config import cfg
 from srht.database import db
 from srht.oauth import loginrequired
@@ -58,7 +58,7 @@ def ref_upload(owner, repo, ref):
 
 @artifacts.route("/<owner>/<repo>/refs/<ref>/<filename>")
 def ref_download(owner, repo, ref, filename):
-    owner, repo = check_access(owner, repo, UserAccess.read)
+    owner, repo = get_repo_or_redir(owner, repo)
     with GitRepository(repo.path) as git_repo:
         try:
             tag = git_repo.revparse_single(ref)
@@ -83,6 +83,7 @@ def ref_download(owner, repo, ref, filename):
     return redirect(url)
 
 @artifacts.route("/<owner>/<repo>/refs/<ref>/<filename>", methods=["POST"])
+@loginrequired
 def ref_delete(owner, repo, ref, filename):
     owner, repo = check_access(owner, repo, UserAccess.manage)
     with GitRepository(repo.path) as git_repo:
-- 
2.38.4