Fix bug in reverse proxy (#16026)

Unfortunately go panics you try to cast a nil interface{} as another primitive
therefore you need to check interfaces are not nil before casting.

Fix #16025

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>

diff --git a/modules/auth/sso/reverseproxy.go b/modules/auth/sso/reverseproxy.go
index f8d17a3cf5a7f988f6233d2e8187649e2e1ae772..3fffee0320d23156c8b3a0a5177b232969449f6a 100644 (file)
--- a/modules/auth/sso/reverseproxy.go
+++ b/modules/auth/sso/reverseproxy.go
@@ -79,7 +79,7 @@ func (r *ReverseProxy) VerifyAuthData(req *http.Request, w http.ResponseWriter,
 
        // Make sure requests to API paths, attachment downloads, git and LFS do not create a new session
        if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isGitRawOrLFSPath(req) {
-               if sess.Get("uid").(int64) != user.ID {
+               if sess != nil && (sess.Get("uid") == nil || sess.Get("uid").(int64) != user.ID) {
                        handleSignIn(w, req, sess, user)
                }
        }