Postgresql: panic when no password supplied with unix peer authentication method. #939

New Issue

GiteaMirror · 2025-11-02T03:42:29-06:00

GiteaMirror commented

2025-11-02 03:42:29 -06:00

Originally created by @jackyyf on GitHub (Aug 4, 2017).

Gitea version (or commit ref): 1.1.2
Git version: 2.11.0
Operating system: Debian "Stretch" 9.0 with kernel 4.9.2-2
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist: https://gist.github.com/jackyyf/037ce9657274ba193d469ba5037f039c

Description

As https://github.com/go-gitea/gitea/blob/master/models/models.go#L201, connStr made for postgresql force a password to be provided, but for postgresql, password can be omitted if peer authentication is used for unix socket connection.
In this version of gitea, omitting password will lead to a panic, however if any password, no matter correct or wrong, is provided, gitea will work properly.
Config parts used to reproduce the bug are provided in log gist.

Solution

Maybe we should check for if password really provided, if no password provided, the colon should be omitted.

Originally created by @jackyyf on GitHub (Aug 4, 2017). - Gitea version (or commit ref): 1.1.2 - Git version: 2.11.0 - Operating system: Debian "Stretch" 9.0 with kernel 4.9.2-2 - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: https://gist.github.com/jackyyf/037ce9657274ba193d469ba5037f039c ## Description As https://github.com/go-gitea/gitea/blob/master/models/models.go#L201, connStr made for postgresql force a password to be provided, but for postgresql, password can be omitted if peer authentication is used for unix socket connection. In this version of gitea, omitting password will lead to a panic, however if any password, no matter correct or wrong, is provided, gitea will work properly. Config parts used to reproduce the bug are provided in log gist. ## Solution Maybe we should check for if password really provided, if no password provided, the colon should be omitted.

GiteaMirror added the type/bug label 2025-11-02 03:42:29 -06:00

GiteaMirror closed this issue

2025-11-02 03:42:30 -06:00

GiteaMirror commented

2025-11-02 03:42:30 -06:00

@lunny commented on GitHub (Dec 12, 2017):

This should be fixed. Please feel free to reopen it.

@lunny commented on GitHub (Dec 12, 2017): This should be fixed. Please feel free to reopen it.

GiteaMirror referenced this issue

2025-11-02 11:51:50 -06:00

[PR #939] [MERGED] Add Screenshot-secion to IssueTemplate.md #15664

Sign in to join this conversation.