When visit /favicon.ico and the static file is not exist return 404 but not continue to handle the route

[lunny]

This should fix #13771. When requesting a route /favicon.ico and there is no static file found, a 404 should be given immediately but not continue next middlewares or routes.

@nuno-silva could you confirm this fix your problem?

[codecov-io]

Codecov Report

Merging #14211 (b6fd8a9) into master (8c086ba) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #14211   +/-   ##
=======================================
  Coverage   42.01%   42.01%           
=======================================
  Files         734      734           
  Lines       78773    78773           
=======================================
+ Hits        33093    33096    +3     
+ Misses      40244    40242    -2     
+ Partials     5436     5435    -1     

Impacted Files	Coverage Δ
modules/public/public.go	54.79% <ø> (ø)
modules/indexer/stats/db.go	56.00% <0.00%> (-4.00%)	⬇️
modules/process/manager.go	72.50% <0.00%> (-2.50%)	⬇️
modules/git/repo_commit_nogogit.go	63.33% <0.00%> (-1.67%)	⬇️
models/repo_list.go	78.76% <0.00%> (+0.88%)	⬆️
modules/queue/unique_queue_disk_channel.go	55.38% <0.00%> (+1.53%)	⬆️
modules/git/utils.go	80.55% <0.00%> (+2.77%)	⬆️
modules/git/repo_base_nogogit.go	72.72% <0.00%> (+9.09%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c086ba...b6fd8a9. Read the comment docs.

[nuno-silva]

It does indeed fix the problem. Thank you!

---

Applied the patch to gitea 1.13.1 and set REQUIRE_SIGNIN_VIEW = true:

• before patch:

# curl -sI 127.0.0.1:3000/favicon.ico | grep -E "HTTP|redirect|Location"
HTTP/1.1 302 Found
Location: /user/login
Set-Cookie: redirect_to=%2Ffavicon.ico; Path=/

• after:

# curl -sI 127.0.0.1:3000/favicon.ico | grep -E "HTTP|redirect|Location"
HTTP/1.1 404 Not Found

Note, however, that the issue can still happen if the browser requests some other arbitrary file not listed in KnownPublicEntries (though that's unlikely; can't remember anything right now).

[techknowlogick]

@lunny please send backport :)