[PR #4840] [MERGED] Enforce token on api routes [fixed critical security issue #4357] #17514

New Issue

GiteaMirror · 2025-11-02T13:48:38-06:00

GiteaMirror commented

2025-11-02 13:48:38 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/4840
Author: @beeonthego
Created: 9/1/2018
Status: ✅ Merged
Merged: 9/10/2018
Merged by: @techknowlogick

Base: master ← Head: api-routes-enforce-token

📝 Commits (10+)

c53ef40 enforce token on api routes
94c1708 remove redundant check on signin
5840433 Merge branch 'master' into api-routes-enforce-token
26eb5da add function to get a new token for logged in user
5a3e4c8 test api create with token
14cc933 make fmt fix
fe45731 update function
1c7615a Update api_comment_test.go
3c38127 make fmt fix
83f01a8 fix build errors

📊 Changes

17 files changed (+131 additions, -89 deletions)

View changed files

📝 integrations/api_admin_test.go (+13 -7)
📝 integrations/api_branch_test.go (+2 -1)
📝 integrations/api_comment_test.go (+9 -6)
📝 integrations/api_gpg_keys_test.go (+37 -35)
📝 integrations/api_issue_label_test.go (+8 -6)
📝 integrations/api_issue_test.go (+5 -4)
📝 integrations/api_keys_test.go (+4 -4)
📝 integrations/api_pull_test.go (+4 -2)
📝 integrations/api_releases_test.go (+5 -5)
📝 integrations/api_repo_raw_test.go (+3 -2)
📝 integrations/api_repo_test.go (+14 -11)
📝 integrations/api_team_test.go (+2 -1)
📝 integrations/git_test.go (+4 -2)
📝 integrations/integration_test.go (+16 -0)
📝 integrations/repo_commits_test.go (+2 -1)
📝 modules/auth/auth.go (+2 -1)
📝 routers/api/v1/api.go (+1 -1)

📄 Description

Check and make sure an authentication has been made using token or basic auth in reqToken handler.

When a user logs into Drone using gitea password, the current integration with Drone depends on basic auth to authenticate a Gitea user and fetches/creates an access token with the name drone. So this PR treats a valid basic auth header as the equivalent of api token, in order for Drone integration continue to work.

The user dashboard uses a few API routes for searching user/repo. All these requests use GET methods, and return results depending on whether the user has signed in, including token and other methods. These routes do not use reqToken handler, and will continue to work as they are now.

Please review and comment if changes are required. It is highly appreciated if it can be merged soon to have API routes covered.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/4840 **Author:** [@beeonthego](https://github.com/beeonthego) **Created:** 9/1/2018 **Status:** ✅ Merged **Merged:** 9/10/2018 **Merged by:** [@techknowlogick](https://github.com/techknowlogick) **Base:** `master` ← **Head:** `api-routes-enforce-token` --- ### 📝 Commits (10+) - [`c53ef40`](https://github.com/go-gitea/gitea/commit/c53ef4060eec422828e467d8cd30651e3fee2885) enforce token on api routes - [`94c1708`](https://github.com/go-gitea/gitea/commit/94c170875188140e71feebb9ab6f3e395f8b5526) remove redundant check on signin - [`5840433`](https://github.com/go-gitea/gitea/commit/5840433d821e1b826829bebe6e03d7e0b910a84c) Merge branch 'master' into api-routes-enforce-token - [`26eb5da`](https://github.com/go-gitea/gitea/commit/26eb5da6271eefbd6f477f1398a9be124b391f62) add function to get a new token for logged in user - [`5a3e4c8`](https://github.com/go-gitea/gitea/commit/5a3e4c8a416b243e5e3f6d46543be8a3f42b9c57) test api create with token - [`14cc933`](https://github.com/go-gitea/gitea/commit/14cc933f99132a61f5af0ab78de87bcf8e74e02b) make fmt fix - [`fe45731`](https://github.com/go-gitea/gitea/commit/fe457315b0dea7d854a87d9ea5cb34c9e1c529f0) update function - [`1c7615a`](https://github.com/go-gitea/gitea/commit/1c7615a8a897388adb3ce84f59505396e5385aac) Update api_comment_test.go - [`3c38127`](https://github.com/go-gitea/gitea/commit/3c381279840c03c9c35c3b952182adecf71989ba) make fmt fix - [`83f01a8`](https://github.com/go-gitea/gitea/commit/83f01a8c631e9327c1d62b82582f16269219755f) fix build errors ### 📊 Changes **17 files changed** (+131 additions, -89 deletions) <details> <summary>View changed files</summary> 📝 `integrations/api_admin_test.go` (+13 -7) 📝 `integrations/api_branch_test.go` (+2 -1) 📝 `integrations/api_comment_test.go` (+9 -6) 📝 `integrations/api_gpg_keys_test.go` (+37 -35) 📝 `integrations/api_issue_label_test.go` (+8 -6) 📝 `integrations/api_issue_test.go` (+5 -4) 📝 `integrations/api_keys_test.go` (+4 -4) 📝 `integrations/api_pull_test.go` (+4 -2) 📝 `integrations/api_releases_test.go` (+5 -5) 📝 `integrations/api_repo_raw_test.go` (+3 -2) 📝 `integrations/api_repo_test.go` (+14 -11) 📝 `integrations/api_team_test.go` (+2 -1) 📝 `integrations/git_test.go` (+4 -2) 📝 `integrations/integration_test.go` (+16 -0) 📝 `integrations/repo_commits_test.go` (+2 -1) 📝 `modules/auth/auth.go` (+2 -1) 📝 `routers/api/v1/api.go` (+1 -1) </details> ### 📄 Description Check and make sure an authentication has been made using token or basic auth in reqToken handler. When a user logs into Drone using gitea password, the current integration with Drone depends on basic auth to authenticate a Gitea user and fetches/creates an access token with the name drone. So this PR treats a valid basic auth header as the equivalent of api token, in order for Drone integration continue to work. The user dashboard uses a few API routes for searching user/repo. All these requests use GET methods, and return results depending on whether the user has signed in, including token and other methods. These routes do not use reqToken handler, and will continue to work as they are now. Please review and comment if changes are required. It is highly appreciated if it can be merged soon to have API routes covered. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 13:48:38 -06:00

GiteaMirror closed this issue

2025-11-02 13:48:41 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17514