forgejo/routers
Giteabot 5b670d83e1
Fix panic in storageHandler (#27446) (#27479)
Backport #27446 by @sryze

storageHandler() is written as a middleware but is used as an endpoint
handler, and thus `next` is actually `nil`, which causes a null pointer
dereference when a request URL does not match the pattern (where it
calls `next.ServerHTTP()`).

Example CURL command to trigger the panic:

```
curl -I "http://yourhost/gitea//avatars/a"
```

Fixes #27409

---

Note: the diff looks big but it's actually a small change - all I did
was to remove the outer closure (and one level of indentation) ~and
removed the HTTP method and pattern checks as they seem redundant
because go-chi already does those checks~. You might want to check "Hide
whitespace" when reviewing it.

Alternative solution (a bit simpler): append `, misc.DummyOK` to the
route declarations that utilize `storageHandler()` - this makes it
return an empty response when the URL is invalid. I've tested this one
and it works too. Or maybe it would be better to return a 400 error in
that case (?)

Co-authored-by: Sergey Zolotarev <sryze@outlook.com>
2023-10-06 16:51:26 +02:00
..
api Don't let API add 2 exclusive labels from same scope (#27433) (#27460) 2023-10-06 05:06:31 +08:00
common Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
install Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
private Redefine the meaning of column is_active to make Actions Registration Token generation easier (#27143) (#27304) 2023-09-28 04:15:53 +00:00
utils Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
web Fix panic in storageHandler (#27446) (#27479) 2023-10-06 16:51:26 +02:00
init.go Another round of db.DefaultContext refactor (#27103) (#27262) 2023-09-25 19:24:35 +02:00