Fix: Add authenticate to projects head

Project head only allow authenticated user to call.

Signed-off-by: DQ <dengq@vmware.com>

src/core/api/project.go

@@ -234,6 +234,12 @@ func (p *ProjectAPI) Post() {
 
 // Head ...
 func (p *ProjectAPI) Head() {
+
+	if !p.SecurityCtx.IsAuthenticated() {
+		p.SendUnAuthorizedError(errors.New("Unauthorized"))
+		return
+	}
+
 	name := p.GetString("project_name")
 	if len(name) == 0 {
 		p.SendBadRequestError(errors.New("project_name is needed"))

src/core/api/project_test.go

@@ -329,13 +329,13 @@ func TestDeleteProject(t *testing.T) {
 
 }
 func TestProHead(t *testing.T) {
-	fmt.Println("\nTest for Project HEAD API")
+	t.Log("\nTest for Project HEAD API")
 	assert := assert.New(t)
 
 	apiTest := newHarborAPI()
 
 	// ----------------------------case 1 : Response Code=200----------------------------//
-	fmt.Println("case 1: response code:200")
+	t.Log("case 1: response code:200")
 	httpStatusCode, err := apiTest.ProjectsHead(*admin, "library")
 	if err != nil {
 		t.Error("Error while search project by proName", err.Error())
@@ -345,7 +345,7 @@ func TestProHead(t *testing.T) {
 	}
 
 	// ----------------------------case 2 : Response Code=404:Project name does not exist.----------------------------//
-	fmt.Println("case 2: response code:404,Project name does not exist.")
+	t.Log("case 2: response code:404,Project name does not exist.")
 	httpStatusCode, err = apiTest.ProjectsHead(*admin, "libra")
 	if err != nil {
 		t.Error("Error while search project by proName", err.Error())
@@ -354,6 +354,24 @@ func TestProHead(t *testing.T) {
 		assert.Equal(int(404), httpStatusCode, "httpStatusCode should be 404")
 	}
 
+	t.Log("case 3: response code:401. Project exist with unauthenticated user")
+	httpStatusCode, err = apiTest.ProjectsHead(*unknownUsr, "library")
+	if err != nil {
+		t.Error("Error while search project by proName", err.Error())
+		t.Log(err)
+	} else {
+		assert.Equal(int(401), httpStatusCode, "httpStatusCode should be 404")
+	}
+
+	t.Log("case 4: response code:401. Project name does not exist with unauthenticated user")
+	httpStatusCode, err = apiTest.ProjectsHead(*unknownUsr, "libra")
+	if err != nil {
+		t.Error("Error while search project by proName", err.Error())
+		t.Log(err)
+	} else {
+		assert.Equal(int(401), httpStatusCode, "httpStatusCode should be 404")
+	}
+
 	fmt.Printf("\n")
 }
 

src/core/controllers/base.go

@@ -17,7 +17,6 @@ package controllers
 import (
 	"bytes"
 	"context"
-	"github.com/goharbor/harbor/src/core/filter"
 	"html/template"
 	"net"
 	"net/http"
@@ -36,6 +35,7 @@ import (
 	"github.com/goharbor/harbor/src/common/utils/log"
 	"github.com/goharbor/harbor/src/core/auth"
 	"github.com/goharbor/harbor/src/core/config"
+	"github.com/goharbor/harbor/src/core/filter"
 )
 
 const userKey = "user"