github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-07-15 20:09:18 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Previously edited private user URLs will redirect instead of 404'ing #14356

New Issue
Open
opened 2025-11-02 11:10:44 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-02 11:10:44 -06:00
Owner
Copy Link

Originally created by @VillainsRule on GitHub (Apr 10, 2025).

Description

Say you are a user named "a", where your profile is set to limited or private. Users not signed in can't see your profile. You decide to rename yourself to "b". Users not signed in visiting the /a profile URL will be visibly redirected to /b (and then shown a 404), which poses a concern since it essentially 'leaks' that this "b" user exists as well as their previous username.

Gitea Version

latest

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

N/A

Screenshots

No response

Git Version

No response

Operating System

Linux

How are you running Gitea?

I'm using systemd, although this isn't process-specific.

Database

SQLite

Originally created by @VillainsRule on GitHub (Apr 10, 2025). ### Description Say you are a user named "a", where your profile is set to limited or private. Users not signed in can't see your profile. You decide to rename yourself to "b". Users not signed in visiting the /a profile URL will be visibly redirected to /b (and then shown a 404), which poses a concern since it essentially 'leaks' that this "b" user exists as well as their previous username. ### Gitea Version latest ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist N/A ### Screenshots _No response_ ### Git Version _No response_ ### Operating System Linux ### How are you running Gitea? I'm using `systemd`, although this isn't process-specific. ### Database SQLite
GiteaMirror added the type/bug label 2025-11-02 11:10:44 -06:00
GiteaMirror commented 2025-11-02 11:10:45 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Apr 10, 2025):

This may be a regression from #34034

@lunny commented on GitHub (Apr 10, 2025): This may be a regression from #34034
GiteaMirror commented 2025-11-02 11:10:45 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Apr 10, 2025):

This may be a regression from #34034

How could it be related? 34034 only touches the "rename repo" logic for "git route handlers". Why it affects a "owner"'s redirection?

@wxiaoguang commented on GitHub (Apr 10, 2025): > This may be a regression from [#34034](https://github.com/go-gitea/gitea/pull/34034) How could it be related? 34034 only touches the "rename repo" logic for "git route handlers". Why it affects a "owner"'s redirection?
GiteaMirror commented 2025-11-02 11:10:45 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Apr 10, 2025):

The Lookup checking should be moved after permission checking. https://github.com/go-gitea/gitea/pull/34032/files

Image
@lunny commented on GitHub (Apr 10, 2025): The Lookup checking should be moved after permission checking. https://github.com/go-gitea/gitea/pull/34032/files <img width="902" alt="Image" src="https://github.com/user-attachments/assets/e8009d56-7224-43fe-9bd9-dcbcf3bfec6c" />
GiteaMirror commented 2025-11-02 11:10:45 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Apr 10, 2025):

The Lookup checking should be moved after permission checking. https://github.com/go-gitea/gitea/pull/34032/files

Again, how could it be related?

The issue description says "Users not signed in visiting the /a profile URL will be visibly redirected to /b (and then shown a 404)", but your screenshot only shows githttp.go, it's not related to "user profile". Even if the githttp has a problem, that's a new problem.

@wxiaoguang commented on GitHub (Apr 10, 2025): > The Lookup checking should be moved after permission checking. https://github.com/go-gitea/gitea/pull/34032/files Again, how could it be related? The issue description says "Users not signed in visiting the `/a` profile URL will be visibly redirected to `/b` (and then shown a 404)", but your screenshot only shows `githttp.go`, it's not related to "user profile". Even if the githttp has a problem, that's a new problem.
GiteaMirror commented 2025-11-02 11:10:46 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Apr 10, 2025):

Because the reqGitSignIn has been removed which is assumed to have been checked. When checking the permission, the first step is to check the repository in the database, the current logic is to redirect if the repository doesn't exist before returned ctx.Resp.Header().Set("WWW-Authenticate", Basic realm="Gitea")

redirect ref: https://github.com/go-gitea/gitea/blob/main/routers/web/repo/githttp.go#L113
auth ref: https://github.com/go-gitea/gitea/blob/main/routers/web/repo/githttp.go#L148

@lunny commented on GitHub (Apr 10, 2025): Because the `reqGitSignIn` has been removed which is assumed to have been checked. When checking the permission, the first step is to check the repository in the database, the current logic is to redirect if the repository doesn't exist before returned `ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm="Gitea"`)` redirect ref: https://github.com/go-gitea/gitea/blob/main/routers/web/repo/githttp.go#L113 auth ref: https://github.com/go-gitea/gitea/blob/main/routers/web/repo/githttp.go#L148
GiteaMirror commented 2025-11-02 11:10:46 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Apr 10, 2025):

Are we talking about the same thing?

The issue is asking about "Users not signed in visiting the /a profile URL will be visibly redirected to /b", they are "owner" handlers and related to "renamed user"

But your "githttp.go" is ONLY for GIT CLIENT access and related to "rename repo".

@wxiaoguang commented on GitHub (Apr 10, 2025): Are we talking about the same thing? The issue is asking about "Users not signed in visiting the `/a` profile URL will be visibly redirected to `/b`", they are "owner" handlers and related to "renamed **user**" But your "githttp.go" is ONLY for GIT CLIENT access and related to "rename **repo**".
GiteaMirror commented 2025-11-02 11:10:46 -06:00
Author
Owner
Copy Link

@VillainsRule commented on GitHub (Apr 10, 2025):

I'm here to clarify that this is not related to #34034, as that refers to repository renaming and this issue refers to owner renaming and owner privacy.

@VillainsRule commented on GitHub (Apr 10, 2025): I'm here to clarify that this is not related to #34034, as that refers to repository renaming and this issue refers to owner renaming and owner privacy.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#14356
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?