docker login reports sucessful login with incorrect password / token #9293

New Issue

GiteaMirror · 2025-11-02T08:34:16-06:00

GiteaMirror commented

2025-11-02 08:34:16 -06:00

Originally created by @noerw on GitHub (Jul 31, 2022).

Description

$ docker login localhost:3000
Username: foobar
Password: 
Login Succeeded

↑ this should fail as i entered gibberish for the password

$ docker push localhost:3000/foobar/qgis
Using default tag: latest
The push refers to repository [localhost:3000/foobar/qgis]
5a1bd4bee150: Layer already exists 
1b04ddff91f2: Layer already exists 
4dd0c5812fd4: Layer already exists 
unauthorized: authentication required

↑ ACLs seem to generally work at least ;)

Gitea Version

692707f145

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

build from source

Database

SQLite

Originally created by @noerw on GitHub (Jul 31, 2022). ### Description ``` $ docker login localhost:3000 Username: foobar Password: Login Succeeded ``` ↑ this should fail as i entered gibberish for the password ``` $ docker push localhost:3000/foobar/qgis Using default tag: latest The push refers to repository [localhost:3000/foobar/qgis] 5a1bd4bee150: Layer already exists 1b04ddff91f2: Layer already exists 4dd0c5812fd4: Layer already exists unauthorized: authentication required ``` ↑ ACLs seem to generally work at least ;) ### Gitea Version 692707f14519b677de4601e5f40469989f82eed6 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? build from source ### Database SQLite

GiteaMirror added the topic/packages type/bug labels 2025-11-02 08:34:16 -06:00

GiteaMirror closed this issue

2025-11-02 08:34:16 -06:00

GiteaMirror commented

2025-11-02 08:34:17 -06:00

@algernon commented on GitHub (Jul 31, 2022):

FWIWI, this appears to be the relevant code:

ff9b6fa663/routers/api/packages/container/container.go (L137-L152)

I would assume Doer is nil here, because of:

ff9b6fa663/routers/api/packages/api.go (L254-L256)

Thus, since Doer is nil, it the first block of code uses the ghost user, and thus, succeeds. If my assumption is correct, then it should treat Doer being nil as an error and 403.

Mind you, this is just my quick impression of the code, I have not verified either of the above assumptions.

@algernon commented on GitHub (Jul 31, 2022): FWIWI, this appears to be the relevant code: https://github.com/go-gitea/gitea/blob/ff9b6fa6639bacd4770b0e81661697af35c78aa6/routers/api/packages/container/container.go#L137-L152 I would assume Doer is nil here, because of: https://github.com/go-gitea/gitea/blob/ff9b6fa6639bacd4770b0e81661697af35c78aa6/routers/api/packages/api.go#L254-L256 Thus, since Doer is nil, it the first block of code uses the ghost user, and thus, succeeds. If my assumption is correct, then it should treat Doer being nil as an error and 403. Mind you, this is just my quick impression of the code, I have not verified either of the above assumptions.

GiteaMirror commented

2025-11-02 08:34:17 -06:00

@algernon commented on GitHub (Jul 31, 2022):

FWIW, I have a fix prepared for this, PR will be coming up shortly.

@algernon commented on GitHub (Jul 31, 2022): FWIW, I have a fix prepared for this, PR will be coming up shortly.

GiteaMirror commented

2025-11-02 08:34:17 -06:00

@algernon commented on GitHub (Jul 31, 2022):

...I spoke too soon. The ghost user is required for anonymous pulls, which also hit the token URL, so just going off of ctx.Doer being nil alone is incorrect. I'll have a PR up shortly anyway. :)

@algernon commented on GitHub (Jul 31, 2022): ...I spoke too soon. The ghost user is required for anonymous pulls, which *also* hit the token URL, so just going off of `ctx.Doer` being nil alone is incorrect. I'll have a PR up shortly anyway. :)

GiteaMirror commented

2025-11-02 08:34:18 -06:00

@lunny commented on GitHub (Dec 13, 2022):

The Auth interface need to be refactored to have a new return argument which indicate should we continue the next auth method.

@lunny commented on GitHub (Dec 13, 2022): The Auth interface need to be refactored to have a new return argument which indicate should we continue the next auth method.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9293

docker login reports sucessful login with incorrect password / token #9293

Description

Gitea Version

Can you reproduce the bug on the Gitea demo site?

Log Gist

Screenshots

Git Version

Operating System

How are you running Gitea?

Database

`docker login` reports sucessful login with incorrect password / token #9293