From: Lauris BH <lauris@nix.lv>
Date: Sat, 20 Mar 2021 20:39:43 +0000 (+0200)
Subject: Handle unauthorized user events gracefully (#15071)
X-Git-Tag: v1.15.0-rc1~587
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=2f0eb9fd5d95fbb023676f0644b2174f0feff3ad;p=gitea.git

Handle unauthorized user events gracefully (#15071)
---

diff --git a/routers/events/events.go b/routers/events/events.go
index 27dbb08fc8..aa8e2c8c74 100644
--- a/routers/events/events.go
+++ b/routers/events/events.go
@@ -30,6 +30,17 @@ func Events(ctx *context.Context) {
 	ctx.Resp.Header().Set("X-Accel-Buffering", "no")
 	ctx.Resp.WriteHeader(http.StatusOK)
 
+	if !ctx.IsSigned {
+		// Return unauthorized status event
+		event := (&eventsource.Event{
+			Name: "unauthorized",
+			Data: "sorry",
+		})
+		_, _ = event.WriteTo(ctx)
+		ctx.Resp.Flush()
+		return
+	}
+
 	// Listen to connection close and un-register messageChan
 	notify := ctx.Req.Context().Done()
 	ctx.Resp.Flush()
diff --git a/routers/routes/web.go b/routers/routes/web.go
index 166b4286a8..e59609d831 100644
--- a/routers/routes/web.go
+++ b/routers/routes/web.go
@@ -400,7 +400,7 @@ func RegisterRoutes(m *web.Route) {
 		})
 	}, reqSignOut)
 
-	m.Any("/user/events", reqSignIn, events.Events)
+	m.Any("/user/events", events.Events)
 
 	m.Group("/login/oauth", func() {
 		m.Get("/authorize", bindIgnErr(auth.AuthorizationForm{}), user.AuthorizeOAuth)