diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2023-06-16 14:32:43 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-16 06:32:43 +0000 |
| commit | b71cb7acdc8840c9fc16b496c90a048051d15823 (patch) | |
| tree | fae5454a2c9f1a7d510255260b562519681841c0 /modules/context | |
| parent | a305c37e62eca42aaad16b4521520bad6bca58d2 (diff) | |
| download | gitea-b71cb7acdc8840c9fc16b496c90a048051d15823.tar.gz gitea-b71cb7acdc8840c9fc16b496c90a048051d15823.zip | |
Use fetch to send requests to create issues/comments (#25258)
Follow #23290
Network error won't make content lost. And this is a much better
approach than "loading-button".
The UI is not perfect and there are still some TODOs, they can be done
in following PRs, not a must in this PR's scope.
<details>
</details>
Diffstat (limited to 'modules/context')
| -rw-r--r-- | modules/context/base.go | 4 | ||||
| -rw-r--r-- | modules/context/context_response.go | 10 |
2 files changed, 6 insertions, 8 deletions
diff --git a/modules/context/base.go b/modules/context/base.go index 5ae5e65d3e..c8238050f9 100644 --- a/modules/context/base.go +++ b/modules/context/base.go @@ -136,6 +136,10 @@ func (b *Base) JSONRedirect(redirect string) { b.JSON(http.StatusOK, map[string]any{"redirect": redirect}) } +func (b *Base) JSONError(msg string) { + b.JSON(http.StatusBadRequest, map[string]any{"errorMessage": msg}) +} + // RemoteAddr returns the client machine ip address func (b *Base) RemoteAddr() string { return b.Req.RemoteAddr diff --git a/modules/context/context_response.go b/modules/context/context_response.go index 1f215eb8ad..88e375986c 100644 --- a/modules/context/context_response.go +++ b/modules/context/context_response.go @@ -16,6 +16,7 @@ import ( user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/base" + "code.gitea.io/gitea/modules/httplib" "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/templates" @@ -49,14 +50,7 @@ func (ctx *Context) RedirectToFirst(location ...string) { continue } - // Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" - // Therefore we should ignore these redirect locations to prevent open redirects - if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') { - continue - } - - u, err := url.Parse(loc) - if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { + if httplib.IsRiskyRedirectURL(loc) { continue } |