pub-solar/forgejo
5
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Return nicer error if trying to pull from non-existent user (#18288)

Browse source 
* Return nicer error if trying to pull from non-existent user

Gitea serv will currently return an 500 if we try to pull from a repository where
the owner does not exist.

This PR checks for the UserNotExist Error when checking for the user and will
return a NotFound error instead.

Fix #18225
This commit is contained in:
zeripath 2022-01-16 03:44:11 +00:00 committed by GitHub
parent a15353dc00
commit 4b4884ce88
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
routers/private/serv.go
View file

@ -111,8 +111,17 @@ func ServCommand(ctx *context.PrivateContext) {
owner, err := user_model.GetUserByName(results.OwnerName) owner, err := user_model.GetUserByName(results.OwnerName)
if err != nil { if err != nil {
if user_model.IsErrUserNotExist(err) {
// User is fetching/cloning a non-existent repository
log.Warn("Failed authentication attempt (cannot find repository: %s/%s) from %s", results.OwnerName, results.RepoName, ctx.RemoteAddr())
ctx.JSON(http.StatusNotFound, private.ErrServCommand{
Results: results,
Err: fmt.Sprintf("Cannot find repository: %s/%s", results.OwnerName, results.RepoName),
})
return
}
log.Error("Unable to get repository owner: %s/%s Error: %v", results.OwnerName, results.RepoName, err) log.Error("Unable to get repository owner: %s/%s Error: %v", results.OwnerName, results.RepoName, err)
ctx.JSON(http.StatusInternalServerError, private.ErrServCommand{ ctx.JSON(http.StatusForbidden, private.ErrServCommand{
Results: results, Results: results,
Err: fmt.Sprintf("Unable to get repository owner: %s/%s %v", results.OwnerName, results.RepoName, err), Err: fmt.Sprintf("Unable to get repository owner: %s/%s %v", results.OwnerName, results.RepoName, err),
}) })
@ -135,7 +144,7 @@ func ServCommand(ctx *context.PrivateContext) {
for _, verb := range ctx.FormStrings("verb") { for _, verb := range ctx.FormStrings("verb") {
if "git-upload-pack" == verb { if "git-upload-pack" == verb {
// User is fetching/cloning a non-existent repository // User is fetching/cloning a non-existent repository
log.Error("Failed authentication attempt (cannot find repository: %s/%s) from %s", results.OwnerName, results.RepoName, ctx.RemoteAddr()) log.Warn("Failed authentication attempt (cannot find repository: %s/%s) from %s", results.OwnerName, results.RepoName, ctx.RemoteAddr())
ctx.JSON(http.StatusNotFound, private.ErrServCommand{ ctx.JSON(http.StatusNotFound, private.ErrServCommand{
Results: results, Results: results,
Err: fmt.Sprintf("Cannot find repository: %s/%s", results.OwnerName, results.RepoName), Err: fmt.Sprintf("Cannot find repository: %s/%s", results.OwnerName, results.RepoName),
@ -325,7 +334,7 @@ func ServCommand(ctx *context.PrivateContext) {
userMode := perm.UnitAccessMode(unitType) userMode := perm.UnitAccessMode(unitType)
if userMode < mode { if userMode < mode {
log.Error("Failed authentication attempt for %s with key %s (not authorized to %s %s/%s) from %s", user.Name, key.Name, modeString, ownerName, repoName, ctx.RemoteAddr()) log.Warn("Failed authentication attempt for %s with key %s (not authorized to %s %s/%s) from %s", user.Name, key.Name, modeString, ownerName, repoName, ctx.RemoteAddr())
ctx.JSON(http.StatusUnauthorized, private.ErrServCommand{ ctx.JSON(http.StatusUnauthorized, private.ErrServCommand{
Results: results, Results: results,
Err: fmt.Sprintf("User: %d:%s with Key: %d:%s is not authorized to %s %s/%s.", user.ID, user.Name, key.ID, key.Name, modeString, ownerName, repoName), Err: fmt.Sprintf("User: %d:%s with Key: %d:%s is not authorized to %s %s/%s.", user.ID, user.Name, key.ID, key.Name, modeString, ownerName, repoName),