Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"/api/packages/{username}/nuget" will always return http.StatusOK no matter whether doer has permission #23349

Open
yp05327 opened this issue Mar 7, 2023 · 6 comments
Labels

Comments

@yp05327
Copy link
Contributor

yp05327 commented Mar 7, 2023

Description

Related to #22705 CI result: https://drone.gitea.io/go-gitea/gitea/68876

It seems that /api/packages/{ownername}/nuget will always return http.StatusOK no matter whether doer has permission.
Is it by design?

If it is by design, I think it will be a security problem which is same as #23150.
If I give an unexisted username, it will return Internal Server Error
If I give an existed Private username, it will return xml

Gitea Version

latest

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

build

Database

None

@yardenshoham
Copy link
Member

@KN4CK3R

@techknowlogick techknowlogick added modifies/api This PR adds API routes or modifies them topic/packages labels Mar 7, 2023
@KN4CK3R
Copy link
Member

KN4CK3R commented Mar 7, 2023

That's intended, see #21242

@yp05327
Copy link
Contributor Author

yp05327 commented Mar 7, 2023

So what we need to do is fixing the Internal Server Error.

@KN4CK3R
Copy link
Member

KN4CK3R commented Mar 7, 2023

Yes, that's because the 404 can't be rendered.

@yp05327
Copy link
Contributor Author

yp05327 commented Mar 7, 2023

emmm…
I think not only 404, but also the others which is not 2xx should also be handled.

@KN4CK3R
Copy link
Member

KN4CK3R commented Mar 7, 2023

I just wanted to say that the rendering of the error page causes the internal server error.

@KN4CK3R KN4CK3R removed the modifies/api This PR adds API routes or modifies them label Jul 6, 2023
@silverwind silverwind added the topic/api Concerns mainly the API label Mar 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

5 participants