From fccb34c389711fbc639fda04a01a58c793a66823 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Thu, 21 Mar 2024 22:30:55 +0800 Subject: [PATCH] Fix the bug that user may logout if GetUserByID return unknow error (#29964) backport #29962 This PR fixed a bug when the user switching pages too fast, he will logout automatically. The reason is that when the error is context cancelled, the previous code think user hasn't login then the session will be deleted. Now it will return the errors but not think it's not login. Co-authored-by: wxiaoguang (cherry picked from commit c03b1e28544ee60c72f9dc7d9f362753bb3d778c) --- services/auth/session.go | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/services/auth/session.go b/services/auth/session.go index 52cfb8ac21..35d97e42da 100644 --- a/services/auth/session.go +++ b/services/auth/session.go @@ -6,7 +6,6 @@ package auth import ( "net/http" - "code.gitea.io/gitea/models/db" user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/log" ) @@ -29,40 +28,33 @@ func (s *Session) Name() string { // object for that uid. // Returns nil if there is no user uid stored in the session. func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) { - user := SessionUser(sess) - if user != nil { - return user, nil - } - return nil, nil -} - -// SessionUser returns the user object corresponding to the "uid" session variable. -func SessionUser(sess SessionStore) *user_model.User { if sess == nil { - return nil + return nil, nil } // Get user ID uid := sess.Get("uid") if uid == nil { - return nil + return nil, nil } log.Trace("Session Authorization: Found user[%d]", uid) id, ok := uid.(int64) if !ok { - return nil + return nil, nil } // Get user object - user, err := user_model.GetUserByID(db.DefaultContext, id) + user, err := user_model.GetUserByID(req.Context(), id) if err != nil { if !user_model.IsErrUserNotExist(err) { - log.Error("GetUserById: %v", err) + log.Error("GetUserByID: %v", err) + // Return the err as-is to keep current signed-in session, in case the err is something like context.Canceled. Otherwise non-existing user (nil, nil) will make the caller clear the signed-in session. + return nil, err } - return nil + return nil, nil } log.Trace("Session Authorization: Logged in user %-v", user) - return user + return user, nil }