PUT on /notifications endpoint with invalid date causes internal server error #7133

New Issue

GiteaMirror · 2025-11-02T07:16:35-06:00

GiteaMirror commented

2025-11-02 07:16:35 -06:00

Originally created by @matusf on GitHub (Apr 8, 2021).

Gitea version (or commit ref): Gitea version 1.13.7 built with GNU Make 4.1, go1.15.11 : bindata, sqlite, sqlite_unlock_notify
Git version: git version 2.17.
Operating system: Ubuntu 18.04
Downloaded gitea from downloads page
Running as a command-line program
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
Log gist:

2021/04/08 18:14:24 Completed PUT /api/v1/notifications?last_read_at=xxx 500 Internal Server Error in 35.807758ms

Description

Make PUT request on /notifications endpoint with supplied authorization token and invalid date in query parameters. Then 500 response is returned with following response body:

curl -X PUT 'http://localhost:3000/api/v1/notifications?last_read_at=xxx' -H "Authorization: token $TOKEN"
{"message":"","url":"http://localhost:3000/api/swagger"}

Originally created by @matusf on GitHub (Apr 8, 2021).   - Gitea version (or commit ref): Gitea version 1.13.7 built with GNU Make 4.1, go1.15.11 : bindata, sqlite, sqlite_unlock_notify - Git version: git version 2.17. - Operating system: Ubuntu 18.04 - Downloaded gitea from downloads page - Running as a command-line program - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [X] Yes (provide example URL) - [ ] No - Log gist: ``` 2021/04/08 18:14:24 Completed PUT /api/v1/notifications?last_read_at=xxx 500 Internal Server Error in 35.807758ms ```    ## Description Make PUT request on `/notifications` endpoint with supplied authorization token and invalid date in query parameters. Then 500 response is returned with following response body: ``` curl -X PUT 'http://localhost:3000/api/v1/notifications?last_read_at=xxx' -H "Authorization: token $TOKEN" {"message":"","url":"http://localhost:3000/api/swagger"} ```

GiteaMirror added the type/bug modifies/api labels 2025-11-02 07:16:35 -06:00

GiteaMirror closed this issue

2025-11-02 07:16:35 -06:00

GiteaMirror commented

2025-11-02 07:16:36 -06:00

@6543 commented on GitHub (Apr 9, 2021):

I think we should return a 400 with an error description

@6543 commented on GitHub (Apr 9, 2021): I think we should return a 400 with an error description

GiteaMirror commented

2025-11-02 07:16:36 -06:00

@zeripath commented on GitHub (Apr 10, 2021):

I mean a 500 here is not entirely inappropriate, from MDN:

500 Internal Server Error
The server has encountered a situation it doesn't know how to handle.

I think 422 is really supposed to be emitted by WebDAV servers - I'm not sure how many other services use it.

400: Bad Request is probably the better supported option.

@zeripath commented on GitHub (Apr 10, 2021): I mean a 500 here is not entirely inappropriate, from MDN: ``` 500 Internal Server Error The server has encountered a situation it doesn't know how to handle. ``` I think 422 is really supposed to be emitted by WebDAV servers - I'm not sure how many other services use it. 400: Bad Request is probably the better supported option.

GiteaMirror commented

2025-11-02 07:16:36 -06:00

@6543 commented on GitHub (Jun 17, 2021):

shuld be solve by #16177

@6543 commented on GitHub (Jun 17, 2021): shuld be solve by #16177

GiteaMirror referenced this issue

2025-11-02 11:19:32 -06:00

Avatars not visible in commit view when no-reply address is configured to the real domain #14668

Sign in to join this conversation.