From 7c2f093e856395cc118dcaa390b7a2234b8363f3 Mon Sep 17 00:00:00 2001
From: Jack Hay <jack@allspice.io>
Date: Thu, 11 Jan 2024 20:57:58 -0500
Subject: [PATCH] Require token for GET subscription endpoint (#28765)

Fixes  #28756

## Changes
- Require and check API token for `GET
/repos/{owner}/{repo}/subscription` in order to populate `ctx.Doer`.
---
 routers/api/v1/api.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 4fe4e20e794..8d7669762b7 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -1156,9 +1156,9 @@ func Routes() *web.Route {
 				m.Get("/subscribers", repo.ListSubscribers)
 				m.Group("/subscription", func() {
 					m.Get("", user.IsWatching)
-					m.Put("", reqToken(), user.Watch)
-					m.Delete("", reqToken(), user.Unwatch)
-				})
+					m.Put("", user.Watch)
+					m.Delete("", user.Unwatch)
+				}, reqToken())
 				m.Group("/releases", func() {
 					m.Combo("").Get(repo.ListReleases).
 						Post(reqToken(), reqRepoWriter(unit.TypeReleases), context.ReferencesGitRepo(), bind(api.CreateReleaseOption{}), repo.CreateRelease)