github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-19 14:42:41 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

[NOT BUG] csrf check faild in add new commet #6100

New Issue
Closed
opened 2025-11-02 06:45:06 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-02 06:45:06 -06:00
Owner
Copy Link

Originally created by @a1012112796 on GitHub (Oct 6, 2020).

  • Gitea version (or commit ref): version 1.13.0+dev-735-gdf4bbcd23 built with GNU Make 4.2.1, go1.14.9 : bindata, sqlite, sqlite_unlock_notify (Build with last commit: df4bbcd235)
  • Git version:
  • Operating system:
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No
    • Not relevant
  • Log gist:

Description

GetInvalid csrf token. when add code comment. view:
Peek 2020-10-06 14-59

log:

[Macaron] 2020-10-06 14:59:24: Started POST /testg/test_repo/pulls/5/files/reviews/comments for 192.168.1.4
[Macaron] 2020-10-06 14:59:24: Completed POST /testg/test_repo/pulls/5/files/reviews/comments 400 Bad Request in 338.589µs
2020/10/06 14:59:24 ...s/context/context.go:332:func1() [D] Session ID: 87d1841579ba977c
2020/10/06 14:59:24 ...s/context/context.go:333:func1() [D] CSRF Token: bR_QLYCBp6bLpxZQHFc4FNzrJ4Y6MTYwMTk2NzU2NDc0ODM4NzM3NA

...

Originally created by @a1012112796 on GitHub (Oct 6, 2020). <!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue --> <!-- 1. Please speak English, this is the language all maintainers can speak and write. 2. Please ask questions or configuration/deploy problems on our Discord server (https://discord.gg/gitea) or forum (https://discourse.gitea.io). 3. Please take a moment to check that your issue doesn't already exist. 4. Please give all relevant information below for bug reports, because incomplete details will be handled as an invalid report. --> - Gitea version (or commit ref): ``version 1.13.0+dev-735-gdf4bbcd23`` built with GNU Make 4.2.1, go1.14.9 : bindata, sqlite, sqlite_unlock_notify (Build with last commit: df4bbcd235cec8708cd0cbdd9bcbdd00f5db4fd5) - Git version: - Operating system: - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description Get``Invalid csrf token.`` when add code comment. view: ![Peek 2020-10-06 14-59](https://user-images.githubusercontent.com/25342410/95169597-b88bb180-07e5-11eb-920d-8e8f7413a1f1.gif) log: ```SHELL [Macaron] 2020-10-06 14:59:24: Started POST /testg/test_repo/pulls/5/files/reviews/comments for 192.168.1.4 [Macaron] 2020-10-06 14:59:24: Completed POST /testg/test_repo/pulls/5/files/reviews/comments 400 Bad Request in 338.589µs 2020/10/06 14:59:24 ...s/context/context.go:332:func1() [D] Session ID: 87d1841579ba977c 2020/10/06 14:59:24 ...s/context/context.go:333:func1() [D] CSRF Token: bR_QLYCBp6bLpxZQHFc4FNzrJ4Y6MTYwMTk2NzU2NDc0ODM4NzM3NA ``` ...
GiteaMirror commented 2025-11-02 06:45:06 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Oct 6, 2020):

clean cache & login -> test again

@6543 commented on GitHub (Oct 6, 2020): clean cache & login -> test again
GiteaMirror commented 2025-11-02 06:45:07 -06:00
Author
Owner
Copy Link

@otbutz commented on GitHub (Oct 6, 2020):

clean cache & login -> test again

That's a workaround but not a solution.

@otbutz commented on GitHub (Oct 6, 2020): > clean cache & login -> test again That's a workaround but not a solution.
GiteaMirror commented 2025-11-02 06:45:07 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Oct 6, 2020):

If this fix it, there is already an issue about it ...

@6543 commented on GitHub (Oct 6, 2020): If this fix it, there is already an issue about it ...
GiteaMirror commented 2025-11-02 06:45:07 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Oct 6, 2020):

also interesting #11188

@6543 commented on GitHub (Oct 6, 2020): also interesting #11188
GiteaMirror commented 2025-11-02 06:45:07 -06:00
Author
Owner
Copy Link

@a1012112796 commented on GitHub (Oct 6, 2020):

Sadly it's not usefull, And I found an amazing thing. The submit review is usefull which is using same csrf value..., I don't know why, test with chorm 85.0.4183.12 in ubuntu 20.04 desktop
Peek 2020-10-06 16-52

@a1012112796 commented on GitHub (Oct 6, 2020): Sadly it's not usefull, And I found an amazing thing. The submit review is usefull which is using same csrf value..., I don't know why, test with chorm 85.0.4183.12 in ubuntu 20.04 desktop ![Peek 2020-10-06 16-52](https://user-images.githubusercontent.com/25342410/95180600-c7c62b80-07f4-11eb-81a8-971a931d1621.gif)
GiteaMirror commented 2025-11-02 06:45:07 -06:00
Author
Owner
Copy Link

@a1012112796 commented on GitHub (Oct 8, 2020):

Sorry, It's my config fault.

@a1012112796 commented on GitHub (Oct 8, 2020): Sorry, It's my config fault.
GiteaMirror commented 2025-11-02 06:45:08 -06:00
Author
Owner
Copy Link

@otbutz commented on GitHub (Oct 8, 2020):

Sorry, It's my config fault.

Could you explain?

@otbutz commented on GitHub (Oct 8, 2020): > Sorry, It's my config fault. Could you explain?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#6100
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?