mirror of https://github.com/go-gitea/gitea.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4ffa683820
Backport #27446 by @sryze storageHandler() is written as a middleware but is used as an endpoint handler, and thus `next` is actually `nil`, which causes a null pointer dereference when a request URL does not match the pattern (where it calls `next.ServerHTTP()`). Example CURL command to trigger the panic: ``` curl -I "http://yourhost/gitea//avatars/a" ``` Fixes #27409 --- Note: the diff looks big but it's actually a small change - all I did was to remove the outer closure (and one level of indentation) ~and removed the HTTP method and pattern checks as they seem redundant because go-chi already does those checks~. You might want to check "Hide whitespace" when reviewing it. Alternative solution (a bit simpler): append `, misc.DummyOK` to the route declarations that utilize `storageHandler()` - this makes it return an empty response when the URL is invalid. I've tested this one and it works too. Or maybe it would be better to return a 400 error in that case (?) Co-authored-by: Sergey Zolotarev <sryze@outlook.com> |
1 year ago | |
|---|---|---|
| .. | ||
| admin | 2 years ago | |
| auth | 2 years ago | |
| devtest | 2 years ago | |
| events | 2 years ago | |
| explore | 2 years ago | |
| feed | 2 years ago | |
| healthcheck | 2 years ago | |
| misc | 2 years ago | |
| org | 2 years ago | |
| repo | 1 year ago | |
| shared | 2 years ago | |
| user | 1 year ago | |
| auth.go | 2 years ago | |
| auth_windows.go | 2 years ago | |
| base.go | 1 year ago | |
| goget.go | 2 years ago | |
| home.go | 2 years ago | |
| metrics.go | 2 years ago | |
| nodeinfo.go | 2 years ago | |
| swagger_json.go | 2 years ago | |
| web.go | 1 year ago | |
| webfinger.go | 2 years ago | |