mod the right for attchment

models/dataset_permission.go

@@ -4,26 +4,27 @@
 
 package models
 
-import (
-	"code.gitea.io/gitea/modules/log"
-)
+import "code.gitea.io/gitea/modules/log"
 
 // GetUserDataSetPermission returns the user permissions to the data_set
 func GetUserDataSetPermission(dataSet *Dataset, user *User) (isPermit bool, err error) {
 	isPermit = false
 
-	switch dataSet.Status {
-	case DatasetStatusDeleted:
-		log.Error("the data_set has been deleted")
-	case DatasetStatusPrivate:
-		if !user.IsAdmin && user.ID != dataSet.UserID {
-			log.Error("the user is not admin nor the owner of the data_set")
+	if user != nil {
+		switch dataSet.Status {
+		case DatasetStatusDeleted:
+			log.Error("the data_set has been deleted")
+		case DatasetStatusPrivate:
+			if !user.IsAdmin && user.ID != dataSet.UserID {
+				log.Error("the user is not admin nor the owner of the data_set")
+			} else {
+				isPermit = true
+			}
+		case DatasetStatusPublic:
+			isPermit = true
+		default:
+			log.Error("the status of data_set is wrong")
 		}
-		isPermit = true
-	case DatasetStatusPublic:
-		isPermit = true
-	default:
-		log.Error("the status of data_set is wrong")
 	}
 
 	return isPermit, nil

routers/routes/routes.go

@@ -579,7 +579,7 @@ func RegisterRoutes(m *macaron.Macaron) {
 
 	m.Group("", func() {
 		m.Get("/attachments/:uuid", repo.GetAttachment)
-	}, reqSignIn)
+	})
 
 	m.Group("/attachments", func() {
 		m.Post("", repo.UploadAttachment)