0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-24 08:06:49 -05:00
forgejo/routers
Sergey Zolotarev 7b79be24ca
Fix panic in storageHandler (#27446)
storageHandler() is written as a middleware but is used as an endpoint
handler, and thus `next` is actually `nil`, which causes a null pointer
dereference when a request URL does not match the pattern (where it
calls `next.ServerHTTP()`).

Example CURL command to trigger the panic:

```
curl -I "http://yourhost/gitea//avatars/a"
```

Fixes #27409

---

Note: the diff looks big but it's actually a small change - all I did
was to remove the outer closure (and one level of indentation) ~and
removed the HTTP method and pattern checks as they seem redundant
because go-chi already does those checks~. You might want to check "Hide
whitespace" when reviewing it.

Alternative solution (a bit simpler): append `, misc.DummyOK` to the
route declarations that utilize `storageHandler()` - this makes it
return an empty response when the URL is invalid. I've tested this one
and it works too. Or maybe it would be better to return a 400 error in
that case (?)
2023-10-06 13:23:14 +00:00
..
api Don't let API add 2 exclusive labels from same scope (#27433) 2023-10-05 03:37:36 +00:00
common Refactor system setting (#27000) 2023-10-05 09:08:19 +08:00
install Refactor system setting (#27000) 2023-10-05 09:08:19 +08:00
private make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
utils
web Fix panic in storageHandler (#27446) 2023-10-06 13:23:14 +00:00
init.go Another round of db.DefaultContext refactor (#27103) 2023-09-25 13:17:37 +00:00