Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-19 21:38:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956)

Browse Source 
Fixes https://github.com/go-gitea/gitea/issues/38950


Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-08-18 06:02:52 +02:00
committed by GitHub
parent 19ee791fe7
commit e8e1973e16
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/web.go
+7 -5
View File
@@ -345,14 +345,16 @@ func addProjectBoardRoutes(m *web.Router) {
// registerWebRoutes register routes // registerWebRoutes register routes
func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) { func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
// required to be signed in or signed out validation.AddBindingRules()
// middleware: required to be signed in or signed out
reqSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: true}) reqSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: true})
reqSignOut := verifyAuthWithOptions(&common.VerifyOptions{SignOutRequired: true}) reqSignOut := verifyAuthWithOptions(&common.VerifyOptions{SignOutRequired: true})
// optional sign in (if signed in, use the user as doer, if not, no doer) // middleware: optional sign in (if signed in, use the user as doer, if not, no doer)
optSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict}) optSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict})
optExploreSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict || setting.Service.Explore.RequireSigninView}) optExploreSignIn := verifyAuthWithOptions(&common.VerifyOptions{SignInRequired: setting.Service.RequireSignInViewStrict || setting.Service.Explore.RequireSigninView})
// middleware: only apply CrossOriginProtection
validation.AddBindingRules() crossOriginProtect := verifyAuthWithOptions(&common.VerifyOptions{DisableCrossOriginProtection: false})
openIDSignInEnabled := func(ctx *context.Context) { openIDSignInEnabled := func(ctx *context.Context) {
if !setting.Service.EnableOpenIDSignIn { if !setting.Service.EnableOpenIDSignIn {
@@ -548,7 +550,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
m.Post("/-/markup", reqSignIn, web.Bind[*structs.MarkupOption](), misc.Markup) m.Post("/-/markup", reqSignIn, web.Bind[*structs.MarkupOption](), misc.Markup)
m.Post("/-/web-banner/dismiss", misc.WebBannerDismiss) m.Post("/-/web-banner/dismiss", misc.WebBannerDismiss)
m.Get("/-/web-theme/list", misc.WebThemeList) m.Get("/-/web-theme/list", misc.WebThemeList)
m.Post("/-/web-theme/apply", optSignIn, misc.WebThemeApply) m.Post("/-/web-theme/apply", crossOriginProtect, misc.WebThemeApply)
m.Group("/explore", func() { m.Group("/explore", func() {
m.Get("", func(ctx *context.Context) { m.Get("", func(ctx *context.Context) {
tests/integration/signin_test.go
+12 -3
View File
@@ -17,6 +17,7 @@ import (
"gitea.dev/modules/test" "gitea.dev/modules/test"
"gitea.dev/modules/translation" "gitea.dev/modules/translation"
"gitea.dev/modules/web" "gitea.dev/modules/web"
"gitea.dev/modules/web/middleware"
"gitea.dev/routers" "gitea.dev/routers"
"gitea.dev/routers/web/auth" "gitea.dev/routers/web/auth"
"gitea.dev/services/context" "gitea.dev/services/context"
@@ -183,9 +184,17 @@ func TestRequireSignInView(t *testing.T) {
t.Run("RequireSignInView", func(t *testing.T) { t.Run("RequireSignInView", func(t *testing.T) {
defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, true)() defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, true)()
defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())() defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
req := NewRequest(t, "GET", "/user2/repo1/src/branch/master") t.Run("AccessPublicRepo", func(t *testing.T) {
resp := MakeRequest(t, req, http.StatusSeeOther) req := NewRequest(t, "GET", "/user2/repo1/src/branch/master")
assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location")) resp := MakeRequest(t, req, http.StatusSeeOther)
assert.Equal(t, "/user/login?redirect_to=%2Fuser2%2Frepo1%2Fsrc%2Fbranch%2Fmaster", resp.Header().Get("Location"))
})
t.Run("UpdateTheme", func(t *testing.T) {
session := emptyTestSession(t)
req := NewRequest(t, "POST", "/-/web-theme/apply?theme=gitea-dark")
session.MakeRequest(t, req, http.StatusOK)
assert.Equal(t, "gitea-dark", session.GetSiteCookie(middleware.CookieTheme))
})
}) })
t.Run("BlockAnonymousAccessExpensive", func(t *testing.T) { t.Run("BlockAnonymousAccessExpensive", func(t *testing.T) {
defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, false)() defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, false)()