TudbuT/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Fix the bug that user may logout if he switch pages too fast (#29962)

Browse source 
This PR fixed a bug when the user switching pages too fast, he will
logout automatically.

The reason is that when the error is context cancelled, the previous
code think user hasn't login then the session will be deleted. Now it
will return the errors but not think it's not login.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 82db9a2ba77d2a6c470b62be3c82b73c0a544fcc)
This commit is contained in:
Lunny Xiao 2024-03-21 16:48:08 +08:00 committed by Earl Warren
parent 6dabb41129
commit cb656d1a43
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
1 changed files with 9 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
services/auth/session.go
View file

@ -4,7 +4,6 @@
package auth
import (
"context"
"net/http"
user_model "code.gitea.io/gitea/models/user"
@ -29,40 +28,33 @@ func (s *Session) Name() string {
// object for that uid.
// Returns nil if there is no user uid stored in the session.
func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
user := SessionUser(req.Context(), sess)
if user != nil {
return user, nil
}
return nil, nil
}
// SessionUser returns the user object corresponding to the "uid" session variable.
func SessionUser(ctx context.Context, sess SessionStore) *user_model.User {
if sess == nil {
return nil
return nil, nil
}
// Get user ID
uid := sess.Get("uid")
if uid == nil {
return nil
return nil, nil
}
log.Trace("Session Authorization: Found user[%d]", uid)
id, ok := uid.(int64)
if !ok {
return nil
return nil, nil
}
// Get user object
user, err := user_model.GetUserByID(ctx, id)
user, err := user_model.GetUserByID(req.Context(), id)
if err != nil {
if !user_model.IsErrUserNotExist(err) {
log.Error("GetUserById: %v", err)
log.Error("GetUserByID: %v", err)
// Return the err as-is to keep current signed-in session, in case the err is something like context.Canceled. Otherwise non-existing user (nil, nil) will make the caller clear the signed-in session.
return nil, err
}
return nil
return nil, nil
}
log.Trace("Session Authorization: Logged in user %-v", user)
return user
return user, nil
}