Skip to content

Commit

Permalink
Fix the bug that user may logout if GetUserByID return unknow error (#…
Browse files Browse the repository at this point in the history
…29964)

backport #29962

This PR fixed a bug when the user switching pages too fast, he will
logout automatically.

The reason is that when the error is context cancelled, the previous
code think user hasn't login then the session will be deleted. Now it
will return the errors but not think it's not login.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
  • Loading branch information
lunny and wxiaoguang authored Mar 21, 2024
1 parent 3ff3c5b commit c03b1e2
Showing 1 changed file with 9 additions and 17 deletions.
26 changes: 9 additions & 17 deletions services/auth/session.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package auth
import (
"net/http"

"code.gitea.io/gitea/models/db"
user_model "code.gitea.io/gitea/models/user"
"code.gitea.io/gitea/modules/log"
)
Expand All @@ -29,40 +28,33 @@ func (s *Session) Name() string {
// object for that uid.
// Returns nil if there is no user uid stored in the session.
func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
user := SessionUser(sess)
if user != nil {
return user, nil
}
return nil, nil
}

// SessionUser returns the user object corresponding to the "uid" session variable.
func SessionUser(sess SessionStore) *user_model.User {
if sess == nil {
return nil
return nil, nil
}

// Get user ID
uid := sess.Get("uid")
if uid == nil {
return nil
return nil, nil
}
log.Trace("Session Authorization: Found user[%d]", uid)

id, ok := uid.(int64)
if !ok {
return nil
return nil, nil
}

// Get user object
user, err := user_model.GetUserByID(db.DefaultContext, id)
user, err := user_model.GetUserByID(req.Context(), id)
if err != nil {
if !user_model.IsErrUserNotExist(err) {
log.Error("GetUserById: %v", err)
log.Error("GetUserByID: %v", err)
// Return the err as-is to keep current signed-in session, in case the err is something like context.Canceled. Otherwise non-existing user (nil, nil) will make the caller clear the signed-in session.
return nil, err
}
return nil
return nil, nil
}

log.Trace("Session Authorization: Logged in user %-v", user)
return user
return user, nil
}

0 comments on commit c03b1e2

Please sign in to comment.