mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-13 02:57:44 -05:00
migrations.ALLOWED_DOMAINS config value does not default to allow everything
#13343
Open
opened 2025-11-02 10:39:04 -06:00 by GiteaMirror
·
33 comments
No Branch/Tag Specified
main
release/v1.25
release/v1.24
release/v1.23
release/v1.22
release/v1.21
release/v1.20
release/v1.19
release/v1.18
release/v1.17
release/v1.16
release/v1.15
release/v1.14
release/v1.13
release/v1.12
release/v1.11
release/v1.10
release/v1.9
release/v1.8
v1.25.3
v1.25.2
v1.25.1
v1.25.0
v1.24.7
v1.25.0-rc0
v1.26.0-dev
v1.24.6
v1.24.5
v1.24.4
v1.24.3
v1.24.2
v1.24.1
v1.24.0
v1.23.8
v1.24.0-rc0
v1.25.0-dev
v1.23.7
v1.23.6
v1.23.5
v1.23.4
v1.23.3
v1.23.2
v1.23.1
v1.23.0
v1.23.0-rc0
v1.24.0-dev
v1.22.6
v1.22.5
v1.22.4
v1.22.3
v1.22.2
v1.22.1
v1.22.0
v1.23.0-dev
v1.22.0-rc1
v1.21.11
v1.22.0-rc0
v1.21.10
v1.21.9
v1.21.8
v1.21.7
v1.21.6
v1.21.5
v1.21.4
v1.21.3
v1.21.2
v1.20.6
v1.21.1
v1.21.0
v1.21.0-rc2
v1.21.0-rc1
v1.20.5
v1.22.0-dev
v1.21.0-rc0
v1.20.4
v1.20.3
v1.20.2
v1.20.1
v1.20.0
v1.19.4
v1.21.0-dev
v1.20.0-rc2
v1.20.0-rc1
v1.20.0-rc0
v1.19.3
v1.19.2
v1.19.1
v1.19.0
v1.19.0-rc1
v1.20.0-dev
v1.19.0-rc0
v1.18.5
v1.18.4
v1.18.3
v1.18.2
v1.18.1
v1.18.0
v1.17.4
v1.18.0-rc1
v1.19.0-dev
v1.18.0-rc0
v1.17.3
v1.17.2
v1.17.1
v1.17.0
v1.17.0-rc2
v1.16.9
v1.17.0-rc1
v1.18.0-dev
v1.16.8
v1.16.7
v1.16.6
v1.16.5
v1.16.4
v1.16.3
v1.16.2
v1.16.1
v1.16.0
v1.15.11
v1.17.0-dev
v1.16.0-rc1
v1.15.10
v1.15.9
v1.15.8
v1.15.7
v1.15.6
v1.15.5
v1.15.4
v1.15.3
v1.15.2
v1.15.1
v1.14.7
v1.15.0
v1.15.0-rc3
v1.14.6
v1.15.0-rc2
v1.14.5
v1.16.0-dev
v1.15.0-rc1
v1.14.4
v1.14.3
v1.14.2
v1.14.1
v1.14.0
v1.13.7
v1.14.0-rc2
v1.13.6
v1.13.5
v1.14.0-rc1
v1.15.0-dev
v1.13.4
v1.13.3
v1.13.2
v1.13.1
v1.13.0
v1.12.6
v1.13.0-rc2
v1.14.0-dev
v1.13.0-rc1
v1.12.5
v1.12.4
v1.12.3
v1.12.2
v1.12.1
v1.11.8
v1.12.0
v1.11.7
v1.12.0-rc2
v1.11.6
v1.12.0-rc1
v1.13.0-dev
v1.11.5
v1.11.4
v1.11.3
v1.10.6
v1.12.0-dev
v1.11.2
v1.10.5
v1.11.1
v1.10.4
v1.11.0
v1.11.0-rc2
v1.10.3
v1.11.0-rc1
v1.10.2
v1.10.1
v1.10.0
v1.9.6
v1.9.5
v1.10.0-rc2
v1.11.0-dev
v1.10.0-rc1
v1.9.4
v1.9.3
v1.9.2
v1.9.1
v1.9.0
v1.9.0-rc2
v1.10.0-dev
v1.9.0-rc1
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.8.0-rc3
v1.7.6
v1.8.0-rc2
v1.7.5
v1.8.0-rc1
v1.9.0-dev
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.7.0-rc3
v1.6.4
v1.7.0-rc2
v1.6.3
v1.7.0-rc1
v1.7.0-dev
v1.6.2
v1.6.1
v1.6.0
v1.6.0-rc2
v1.5.3
v1.6.0-rc1
v1.6.0-dev
v1.5.2
v1.5.1
v1.5.0
v1.5.0-rc2
v1.5.0-rc1
v1.5.0-dev
v1.4.3
v1.4.2
v1.4.1
v1.4.0
v1.4.0-rc3
v1.4.0-rc2
v1.3.3
v1.4.0-rc1
v1.3.2
v1.3.1
v1.3.0
v1.3.0-rc2
v1.3.0-rc1
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.2.0-rc3
v1.2.0-rc2
v1.1.4
v1.2.0-rc1
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.2
v1.0.1
v1.0.0
v0.9.99
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
Mirrored from GitHub Pull Request
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/gitea#13343
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mpeter50 on GitHub (Jul 30, 2024).
Description
Repositories can not be migrated anymore unless the following lines are present in Gitea's configuration file:
When this not present, starting a mirror migration from github.com results in this error message being shown:
The documentation's config cheat sheet for v1.22.1 tells that if this config value is undefined, it should not block anything:
I have first noticed this issue in v1.22.0, and the issue is also present after updating to v1.22.1.
On an other instance of mine, which is still running
v1.21.4, migrations can be created fine, without overriding the default value of themigrations.ALLOWED_DOMAINS.Gitea Version
v1.22.1
Can you reproduce the bug on the Gitea demo site?
No
Log Gist
https://gist.github.com/mpeter50/8a50ed8f4605ee833b3e7dc552e6eb2b
Screenshots
No response
Git Version
No response
Operating System
No response
How are you running Gitea?
Docker Compose, with a locally built image from unmodified source at versioned tag.
Database
MySQL/MariaDB
@yp05327 commented on GitHub (Jul 30, 2024):
Can you provide more settings in your app.ini?
I tested it in local, and there's no problem to migration from Github.
@Dev-Wiki commented on GitHub (Aug 19, 2024):
我的也是如此,配置如下:
@Dev-Wiki commented on GitHub (Aug 19, 2024):
经测试,ALLOWED_DOMAINS 设置为空不行, 必须设置具体的域名才可以
@mpeter50 commented on GitHub (Aug 19, 2024):
Oh, totally forgot about this, sorry.
This is my app.ini. I have redacted a few things.
https://gist.github.com/mpeter50/ae8b4341f0eac3587e31b5e1c22efdfc
@mpeter50 commented on GitHub (Aug 19, 2024):
@Dev-Wiki are you having the same problem?
@lunny commented on GitHub (Aug 19, 2024):
I cannot reproduce this on main branch(
0d24c9f383) and release/v1.22 branch(3913ef69d5)@mpeter50 commented on GitHub (Aug 20, 2024):
To be more complete, these are the complete migration settings:
Maybe this is helpful. Not sure why did I cut the issue screenshot that way.
Please note that this is a different repo that the one in the issue screenshot.
@mpeter50 commented on GitHub (Aug 20, 2024):
Hmm just did an additional test, and maybe this is happening while the Gitea container does not have internet access, e.g. because of container settings.
Of course its fine that it cannot do the migration without access to the source service. The problem may be that the failure is handled incorrectly.
If you have the capacity, it might be nice to allow creating migrations regardless of accessibility of the source service, but delay it until intenet access is available. It could be useful for when internet is genuinely not accessible for some time, or for when the target server is unstable, so that users may have a slightly easier time rescuing their repos. Not sure how realistic are these scenarios, probably not too much.
@yp05327 commented on GitHub (Aug 20, 2024):
I also cannot reproduce it in main and release 1.22
@Dev-Wiki commented on GitHub (Aug 20, 2024):
problem resolved!
ini config for this:
use * not empty!
use * not empty!
use * not empty!
@Dev-Wiki commented on GitHub (Aug 20, 2024):
problem resolved!
ini config for this:
use * not empty!
use * not empty!
use * not empty!
@yp05327 commented on GitHub (Aug 20, 2024):
@mpeter50 has mentioned this in the description
But I can not reproduce it even I left it empty in my app.ini
@Dev-Wiki commented on GitHub (Aug 20, 2024):
你使用的什么版本? 我是1.22.1, 这样配置没有提示任何错误, 但是我本地重新搭建了一个gitea 使用1.22.0 什么都没配置这个, 也能迁移任意网站, 现在还不清楚这个设置的逻辑.
我这个配置目前只在我自己的nas上测试可以,
另外一种可用的方式为:
@wxiaoguang commented on GitHub (Aug 20, 2024):
The reason is simple: the sentence
Blank means everything will be allowed.is wrong, it is from #13610 (2020-11-29), which is older than the security fix by #17605 & #20016 (2021-11-20, 2022-06-19), since #17605, "empty" means allowing external hosts by default, but some document updating was forgotten at that time.The document is just outdated and needs to be updated.
@lunny commented on GitHub (Aug 20, 2024):
Yes, see https://gitea.com/gitea/docs/pulls/55 .
But from the screenshot, it's migrating from github.com which should be an external address.
@wxiaoguang commented on GitHub (Aug 20, 2024):
Oh yes, re-read the code again, it is a bug. Will fix it.@wxiaoguang commented on GitHub (Aug 20, 2024):
Well, no code problem, it is well covered by a test. Maybe some users are using fake-IP proxies to access GitHub?
@mpeter50 commented on GitHub (Aug 20, 2024):
To add a bit of a clarification, it seems that to me the problem was caused by my Gitea container being configured like this:
The proxy net is a reverse proxy through which I access Gitea, it does not work in the other direction.
Normally the container is not given the network that Docker Compose calls as
default, and that means Gitea does not have access to the network to which the Docker Host is connected. This is when the discussed error occurs.When I uncomment the
defaultnetwork, and recreate the Gitea container, the migration will work on the next try.@wxiaoguang commented on GitHub (Aug 20, 2024):
Well, that's my guess, you are using proxy for external access ......
@mpeter50 commented on GitHub (Aug 20, 2024):
I do not know about such happening here. I have an internal DNS server if that counts, but shouldnt modify anything.
@wxiaoguang commented on GitHub (Aug 20, 2024):
More contexts:
@mpeter50 commented on GitHub (Aug 20, 2024):
This is the definition of the
proxynetwork from above:Here it is seen that it is externally defined, outside of the compose file.
According to running
docker network inspect proxy-internal, the network only hosts a few other services' frontends, and an Nginx, which is only configured as a reverse proxy.The
defaultnetwork is a network created by docker compose, technically named asgitea_default, according todocker network inspect gitea_defaultit uses the bridge driver. Only the Gitea container is connected to it.@mpeter50 commented on GitHub (Aug 20, 2024):
If I can help with diagnosing in any way, let me know.
This is the result of
nslookup github.comexecuted inside the Gitea container when it is not given access to the internet:This is the result of
nslookup github.comexecuted inside the Gitea container when it is given access to the internet:@mpeter50 commented on GitHub (Aug 20, 2024):
I was wondering if maybe Gitea would be processing the SERVFAIL response as an empty IP address being resolved or something like that, when trying to check if the migration source is allowed, and detecting that as a not-a-public address?
@wxiaoguang commented on GitHub (Aug 20, 2024):
Sorry but no more idea from my side ..... maybe it needs a reproducible setup and some code level debugging work, I am not able to provide more support at the moment. (and will leave keyboard for a while)
@mpeter50 commented on GitHub (Aug 20, 2024):
I just noticed that there are related entries in the System Notices:
However, by doing further tries with revoked internet access, these do not appear to be generated when the discussed disallowed host error apepars. I have tried to migrate a new repo several times, every time producing the error, but no new system notices have appeared.
@yp05327 commented on GitHub (Aug 20, 2024):
By the hit from https://github.com/go-gitea/gitea/issues/31733#issuecomment-2297912917 and https://github.com/go-gitea/gitea/issues/31733#issuecomment-2297872720
I added this in my hosts
Then I got the same error.
@GiteaBot commented on GitHub (Sep 20, 2024):
We close issues that need feedback from the author if there were no new comments for a month. 🍵
@mpeter50 commented on GitHub (Sep 22, 2024):
Can we reopen this issue? I do not know what additional feedback I can give. Though if you ask for something, of course I may be able to give more information.
@wxiaoguang commented on GitHub (Oct 6, 2024):
https://github.com/go-gitea/gitea/issues/31733#issuecomment-2297915772
it needs a reproducible setup (to make sure others could reproduce in their environments)
@mpeter50 commented on GitHub (Oct 6, 2024):
I will try to make a copy of the instance and trim it down to what is needed for this to happen. This will take some time, though.
If anyone else having this issue is reading this, please consider of you can make a reproducer too.
@GiteaBot commented on GitHub (Nov 6, 2024):
We close issues that need feedback from the author if there were no new comments for a month. 🍵
@mpeter50 commented on GitHub (Nov 6, 2024):
Can we reopen this issue? I did not yet find the time to make a minimal reproducer installation.