Panic when listing user repos using API and not authenticated #665

New Issue

GiteaMirror · 2025-11-02T03:32:19-06:00

GiteaMirror commented

2025-11-02 03:32:19 -06:00

Originally created by @cez81 on GitHub (Apr 25, 2017).

Gitea version (or commit ref): 1.1.0+138-gc58708d3
Git version: 2.7.4
Operating system: Ubuntu 16.04
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL) https://try.gitea.io/api/v1/users/cez81/repos
- No
- Not relevant
Log gist:

/home/jonas/go/src/code.gitea.io/gitea/routers/api/v1/user/repo.go:12 (0x101b389)
	listUserRepos: showPrivateRepos := (ctx.User.ID == userID || ctx.User.IsAdmin) && ctx.IsSigned
/home/jonas/go/src/code.gitea.io/gitea/routers/api/v1/user/repo.go:40 (0x101b764)
	ListUserRepos: listUserRepos(ctx, user)

Description

Trying to get users repositories using the API when not signed in will cause panic on line https://github.com/go-gitea/gitea/blob/master/routers/api/v1/user/repo.go#L12.
ctx.User is not populated unless signed in.

Github seems to allow this operation even when nog logged in so I guess that should be correct behaviour?

Originally created by @cez81 on GitHub (Apr 25, 2017). - Gitea version (or commit ref): 1.1.0+138-gc58708d3 - Git version: 2.7.4 - Operating system: Ubuntu 16.04 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) https://try.gitea.io/api/v1/users/cez81/repos - [ ] No - [ ] Not relevant - Log gist: ``` /home/jonas/go/src/code.gitea.io/gitea/routers/api/v1/user/repo.go:12 (0x101b389) listUserRepos: showPrivateRepos := (ctx.User.ID == userID || ctx.User.IsAdmin) && ctx.IsSigned /home/jonas/go/src/code.gitea.io/gitea/routers/api/v1/user/repo.go:40 (0x101b764) ListUserRepos: listUserRepos(ctx, user) ``` ## Description Trying to get users repositories using the API when not signed in will cause panic on line https://github.com/go-gitea/gitea/blob/master/routers/api/v1/user/repo.go#L12. ctx.User is not populated unless signed in. Github seems to allow this operation even when nog logged in so I guess that should be correct behaviour?

GiteaMirror added the type/bug label 2025-11-02 03:32:19 -06:00

GiteaMirror closed this issue

2025-11-02 03:32:19 -06:00

GiteaMirror commented

2025-11-02 03:32:20 -06:00

@bkcsoft commented on GitHub (Apr 25, 2017):

Related to #1539 which has the same issue (but for the web-view controller)

@bkcsoft commented on GitHub (Apr 25, 2017): Related to #1539 which has the same issue (but for the web-view controller)

GiteaMirror referenced this issue

2025-11-02 11:48:25 -06:00

[PR #665] [MERGED] Fix ambiguity bug in getCommentsByRepoIDSince #15518

Sign in to join this conversation.