Fix the bug that user may logout if he switch pages too fast (#29962)

loading up the forgejo repo on tangled to test page performance

This PR fixed a bug when the user switching pages too fast, he will
logout automatically.

The reason is that when the error is context cancelled, the previous
code think user hasn't login then the session will be deleted. Now it
will return the errors but not think it's not login.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 82db9a2ba77d2a6c470b62be3c82b73c0a544fcc)

authored by

Lunny Xiao

wxiaoguang and committed by

Earl Warren 2 years ago cb656d1a 6dabb411

+9 -17

1 changed file

expand all

services

auth

session.go

+9 -17

services/auth/session.go

··· 4 4 package auth 5 5 6 6 import ( 7 - "context" 8 7 "net/http" 9 8 10 9 user_model "code.gitea.io/gitea/models/user" ··· 29 28 // object for that uid. 30 29 // Returns nil if there is no user uid stored in the session. 31 30 func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) { 32 - user := SessionUser(req.Context(), sess) 33 - if user != nil { 34 - return user, nil 35 - } 36 - return nil, nil 37 - } 38 - 39 - // SessionUser returns the user object corresponding to the "uid" session variable. 40 - func SessionUser(ctx context.Context, sess SessionStore) *user_model.User { 41 31 if sess == nil { 42 - return nil 32 + return nil, nil 43 33 } 44 34 45 35 // Get user ID 46 36 uid := sess.Get("uid") 47 37 if uid == nil { 48 - return nil 38 + return nil, nil 49 39 } 50 40 log.Trace("Session Authorization: Found user[%d]", uid) 51 41 52 42 id, ok := uid.(int64) 53 43 if !ok { 54 - return nil 44 + return nil, nil 55 45 } 56 46 57 47 // Get user object 58 - user, err := user_model.GetUserByID(ctx, id) 48 + user, err := user_model.GetUserByID(req.Context(), id) 59 49 if err != nil { 60 50 if !user_model.IsErrUserNotExist(err) { 61 - log.Error("GetUserById: %v", err) 51 + log.Error("GetUserByID: %v", err) 52 + // Return the err as-is to keep current signed-in session, in case the err is something like context.Canceled. Otherwise non-existing user (nil, nil) will make the caller clear the signed-in session. 53 + return nil, err 62 54 } 63 - return nil 55 + return nil, nil 64 56 } 65 57 66 58 log.Trace("Session Authorization: Logged in user %-v", user) 67 - return user 59 + return user, nil 68 60 }

Configure Feed

Configure Feed