Pushing a new cargo release returns 500 if user does not have write access to cargo index repo #11573

New Issue

GiteaMirror · 2025-11-02T09:41:29-06:00

GiteaMirror commented

2025-11-02 09:41:29 -06:00

Originally created by @merlleu on GitHub (Aug 31, 2023).

Description

When you have an user with Packages: Read+Write access, he can't push to cargo registry if he does not have permission to the _cargo-index repo, returning a 500 error code.

I think at least we should change the error code for this, not sure if we should allow push for users without the repo write permissions still.

Gitea Version

1.21

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

https://gist.github.com/merlleu/50d26b2fe4dd1a1fb1ba9aa57d29c030

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

It is run from docker on the a587d25261 commit's nightly build

Database

PostgreSQL

Originally created by @merlleu on GitHub (Aug 31, 2023). ### Description When you have an user with Packages: Read+Write access, he can't push to cargo registry if he does not have permission to the _cargo-index repo, returning a 500 error code. I think at least we should change the error code for this, not sure if we should allow push for users without the repo write permissions still. ### Gitea Version 1.21 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist https://gist.github.com/merlleu/50d26b2fe4dd1a1fb1ba9aa57d29c030 ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? It is run from docker on the a587d2526163153a4d992527fe6040d578beaa83 commit's nightly build ### Database PostgreSQL

GiteaMirror added the topic/packages type/bug labels 2025-11-02 09:41:29 -06:00

GiteaMirror commented

2025-11-02 09:41:29 -06:00

@lng2020 commented on GitHub (Sep 1, 2023):

I reproduced this issue as well.
Here is the detailed procedure to reproduce.

Assume there are test_org and test_team
Set write access in test_team->settings->packages
remove write access of test_team in _cargo-index.git->settings->collaborators
cargo publish then the error occurs

The credential passed the access control of the package, so cargo starts to use git to upload files. However, the repo denied the files because the credential can't write the repo. So here I come up with two possible solutions.

Check the error type then use a different HTTP error in routers/api/packages/cargo/cargo.go#250
A more elegant way is to sync the package permission with the package repo as mentioned in #20596. It requires more effort but solves all issues of this kind.

I prefer the second solution but it's a little beyond my ability.
What do you think? @KN4CK3R

@lng2020 commented on GitHub (Sep 1, 2023): I reproduced this issue as well. Here is the detailed procedure to reproduce. 1. Assume there are `test_org` and `test_team` 2. Set `write` access in `test_team->settings->packages` 3. remove `write` access of `test_team` in `_cargo-index.git->settings->collaborators` 4. `cargo publish` then the error occurs The credential passed the access control of the `package`, so cargo starts to use `git` to upload files. However, the repo denied the files because the credential can't write the `repo`. So here I come up with two possible solutions. 1. Check the error type then use a different HTTP error in `routers/api/packages/cargo/cargo.go#250` 2. A more elegant way is to sync the `package` permission with the package `repo` as mentioned in #20596. It requires more effort but solves all issues of this kind. I prefer the second solution but it's a little beyond my ability. What do you think? @KN4CK3R

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11573