Cannot go to page 2 if more than 15 repos

[J-Siu]

• Gogs version (or commit ref): https://dl.gogs.io/gogs_v0.9.97_linux_amd64.tar.gz, also tested with source install 0.9.99.0915
• Git version: 2.9.3
• Operating system: Ubuntu 14.04.5 LTS (GNU/Linux 2.6.32-042stab116.2 x86_64)
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • SQLite
• Can you reproduce the bug at https://try.gogs.io:
  • Yes (provide example URL)
  • No - try.gogs.io only allow 10 repos
  • Not relevant
• Log gist:

Description

1. Create over 15 repos
2. In 'dashboard', under 'my repositories', click 'show more repositories'
3. Click 'Next' or '2' at the bottom of page, it will remain in page 1

I'm entirely unable to reproduce this bug.

[J-Siu]

@LefsFlarey You need over 15 repos to reproduce this.

I always end up in page 1 after clicking 2 or next.

I have 25 repositories, I cannot reproduce that error. Would you mind pasting your gogs.log?

[J-Siu]

Test with 0.9.97:

I changed log level to trace:

Click to dashboard:

2016/10/01 21:34:27 [D] Session ID: 11ad1ea4cd3d0dcc
2016/10/01 21:34:27 [D] CSRF Token: X66o5Y3VnCUgW90N98KFpK0m4mw6MTQ3NTM0OTI2NjU4MDEwNjIxOA==
2016/10/01 21:34:27 [D] Template: user/dashboard/dashboard

Click Show more repositories:

2016/10/01 21:34:43 [D] Session ID: 11ad1ea4cd3d0dcc
2016/10/01 21:34:43 [D] CSRF Token: X66o5Y3VnCUgW90N98KFpK0m4mw6MTQ3NTM0OTI2NjU4MDEwNjIxOA==
2016/10/01 21:34:43 [D] Template: user/profile

Click Next:

2016/10/01 21:34:49 [D] Session ID: 11ad1ea4cd3d0dcc
2016/10/01 21:34:49 [D] CSRF Token: X66o5Y3VnCUgW90N98KFpK0m4mw6MTQ3NTM0OTI2NjU4MDEwNjIxOA==
2016/10/01 21:34:49 [D] Template: user/profile

[J-Siu]

Following is log with 0.9.99.0915 running ./gogs web

2016/10/01 22:02:22 [D] Session ID: 9abdab7fc1392faa
2016/10/01 22:02:22 [D] CSRF Token: pK6vDCfpyGUl-FtvHbyo_-zsRaE6MTQ3NTM3MzczNzY0Njk0MDQ0MQ==
2016/10/01 22:02:22 [D] Template: user/auth/signin
[Macaron] 2016-10-01 22:02:22: Completed /user/login?redirect_to= 200 OK in 35.936298ms
[Macaron] 2016-10-01 22:02:29: Started POST /user/login for 127.0.0.1
2016/10/01 22:02:29 [D] Session ID: 9abdab7fc1392faa
2016/10/01 22:02:29 [D] CSRF Token: pK6vDCfpyGUl-FtvHbyo_-zsRaE6MTQ3NTM3MzczNzY0Njk0MDQ0MQ==
[Macaron] 2016-10-01 22:02:30: Completed /user/login 302 Found in 318.656337ms
[Macaron] 2016-10-01 22:02:30: Started GET / for 127.0.0.1
2016/10/01 22:02:30 [D] Session ID: 9abdab7fc1392faa
2016/10/01 22:02:30 [D] CSRF Token: NK0Luad9w8IohLhb22RInO_6sa06MTQ3NTM3Mzc1MDIxMDk3OTExMg==
2016/10/01 22:02:30 [D] Template: user/dashboard/dashboard
[Macaron] 2016-10-01 22:02:30: Completed / 200 OK in 271.76912ms
[Macaron] 2016-10-01 22:02:35: Started GET /js for 127.0.0.1
[Macaron] 2016-10-01 22:02:35: Completed /js 302 Found in 124.99µs
[Macaron] 2016-10-01 22:02:35: Started GET /js/ for 127.0.0.1
2016/10/01 22:02:35 [D] Session ID: 9abdab7fc1392faa
2016/10/01 22:02:35 [D] CSRF Token: NK0Luad9w8IohLhb22RInO_6sa06MTQ3NTM3Mzc1MDIxMDk3OTExMg==
2016/10/01 22:02:35 [D] Template: user/profile
[Macaron] 2016-10-01 22:02:35: Completed /js/ 200 OK in 22.795076ms
[Macaron] 2016-10-01 22:02:38: Started GET /js?page=2&q= for 127.0.0.1
[Macaron] 2016-10-01 22:02:38: Completed /js?page=2&q= 302 Found in 130.78µs
[Macaron] 2016-10-01 22:02:38: Started GET /js/ for 127.0.0.1
2016/10/01 22:02:38 [D] Session ID: 9abdab7fc1392faa
2016/10/01 22:02:38 [D] CSRF Token: NK0Luad9w8IohLhb22RInO_6sa06MTQ3NTM3Mzc1MDIxMDk3OTExMg==
2016/10/01 22:02:38 [D] Template: user/profile
[Macaron] 2016-10-01 22:02:38: Completed /js/ 200 OK in 6.177859ms

[J-Siu]

@LefsFlarey I think I found the issue. It only happen if username is "js".

That is now ultra strange. Can someone confirm this behaviour exists for the users,

assets
css
img
js
less
plugins

[J-Siu]

I tried with both binary install (0.9.97) and compile from source (0.9.99) and encounter the same. I believe username "js" is conflicting with public/js.

Yeah, I have to cook up an emergency patch since this could be a vulnerability.

[J-Siu]

One possible fix I can think of is to add a virtual path like "user" in the url before , so username will not conflict/hijack any gogs system path.

Tossed a fix, try it.

In reply to that possible fix, it no longer follows Github convention and thus such, we cannot do that :)

[J-Siu]

Do I have to change username? I am actually using "js" right now.

Another way would be to host assets on a CDN or mirror but I can't make that decision, so, @unknwon

[bkcsoft]

@LefsFlare or just namespace them to public/ where they belong

On Tue, Oct 4, 2016 at 9:59 AM, LefsFlare notifications@github.com wrote:

Another way would be to host assets on a CDN or mirror but I can't make
that decision, so, @unknwon https://github.com/Unknwon

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#3700 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AEgdoy5SWZX3tWCbEDvT8aN-1tRlzLWbks5qwgdQgaJpZM4KGOTe
.