[refactor] replace int with httpStatusCodes (#15282)

* replace "200" (int) with "http.StatusOK" (const)

* ctx.Error & ctx.HTML

* ctx.JSON Part1

* ctx.JSON Part2

* ctx.JSON Part3

15 files changed, 102 insertions, 83 deletions

diff --git a/routers/user/auth.go b/routers/user/auth.go
index 9217885519..a6d3ace7ba 100644
--- a/routers/user/auth.go
+++ b/routers/user/auth.go
@@ -146,7 +146,7 @@ func SignIn(ctx *context.Context) {
 	ctx.Data["PageIsLogin"] = true
 	ctx.Data["EnableSSPI"] = models.IsSSPIEnabled()
 
-	ctx.HTML(200, tplSignIn)
+	ctx.HTML(http.StatusOK, tplSignIn)
 }
 
 // SignInPost response for sign in request
@@ -167,7 +167,7 @@ func SignInPost(ctx *context.Context) {
 	ctx.Data["EnableSSPI"] = models.IsSSPIEnabled()
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplSignIn)
+		ctx.HTML(http.StatusOK, tplSignIn)
 		return
 	}
 
@@ -183,15 +183,15 @@ func SignInPost(ctx *context.Context) {
 		} else if models.IsErrUserProhibitLogin(err) {
 			log.Info("Failed authentication attempt for %s from %s: %v", form.UserName, ctx.RemoteAddr(), err)
 			ctx.Data["Title"] = ctx.Tr("auth.prohibit_login")
-			ctx.HTML(200, "user/auth/prohibit_login")
+			ctx.HTML(http.StatusOK, "user/auth/prohibit_login")
 		} else if models.IsErrUserInactive(err) {
 			if setting.Service.RegisterEmailConfirm {
 				ctx.Data["Title"] = ctx.Tr("auth.active_your_account")
-				ctx.HTML(200, TplActivate)
+				ctx.HTML(http.StatusOK, TplActivate)
 			} else {
 				log.Info("Failed authentication attempt for %s from %s: %v", form.UserName, ctx.RemoteAddr(), err)
 				ctx.Data["Title"] = ctx.Tr("auth.prohibit_login")
-				ctx.HTML(200, "user/auth/prohibit_login")
+				ctx.HTML(http.StatusOK, "user/auth/prohibit_login")
 			}
 		} else {
 			ctx.ServerError("UserSignIn", err)
@@ -248,7 +248,7 @@ func TwoFactor(ctx *context.Context) {
 		return
 	}
 
-	ctx.HTML(200, tplTwofa)
+	ctx.HTML(http.StatusOK, tplTwofa)
 }
 
 // TwoFactorPost validates a user's two-factor authentication token.
@@ -327,7 +327,7 @@ func TwoFactorScratch(ctx *context.Context) {
 		return
 	}
 
-	ctx.HTML(200, tplTwofaScratch)
+	ctx.HTML(http.StatusOK, tplTwofaScratch)
 }
 
 // TwoFactorScratchPost validates and invalidates a user's two-factor scratch token.
@@ -393,7 +393,7 @@ func U2F(ctx *context.Context) {
 		return
 	}
 
-	ctx.HTML(200, tplU2F)
+	ctx.HTML(http.StatusOK, tplU2F)
 }
 
 // U2FChallenge submits a sign challenge to the browser
@@ -427,7 +427,7 @@ func U2FChallenge(ctx *context.Context) {
 		ctx.ServerError("UserSignIn: unable to store session", err)
 	}
 
-	ctx.JSON(200, challenge.SignRequest(regs.ToRegistrations()))
+	ctx.JSON(http.StatusOK, challenge.SignRequest(regs.ToRegistrations()))
 }
 
 // U2FSign authenticates the user by signResp
@@ -487,7 +487,7 @@ func U2FSign(ctx *context.Context) {
 			return
 		}
 	}
-	ctx.Error(401)
+	ctx.Error(http.StatusUnauthorized)
 }
 
 // This handles the final part of the sign-in process of the user.
@@ -791,7 +791,7 @@ func LinkAccount(ctx *context.Context) {
 		}
 	}
 
-	ctx.HTML(200, tplLinkAccount)
+	ctx.HTML(http.StatusOK, tplLinkAccount)
 }
 
 // LinkAccountPostSignIn handle the coupling of external account with another account using signIn
@@ -821,7 +821,7 @@ func LinkAccountPostSignIn(ctx *context.Context) {
 	}
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplLinkAccount)
+		ctx.HTML(http.StatusOK, tplLinkAccount)
 		return
 	}
 
@@ -908,12 +908,12 @@ func LinkAccountPostRegister(ctx *context.Context) {
 	}
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplLinkAccount)
+		ctx.HTML(http.StatusOK, tplLinkAccount)
 		return
 	}
 
 	if setting.Service.DisableRegistration {
-		ctx.Error(403)
+		ctx.Error(http.StatusForbidden)
 		return
 	}
 
@@ -1033,7 +1033,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
 		ctx.Data["IsSendRegisterMail"] = true
 		ctx.Data["Email"] = u.Email
 		ctx.Data["ActiveCodeLives"] = timeutil.MinutesToFriendly(setting.Service.ActiveCodeLives, ctx.Locale.Language())
-		ctx.HTML(200, TplActivate)
+		ctx.HTML(http.StatusOK, TplActivate)
 
 		if err := ctx.Cache.Put("MailResendLimit_"+u.LowerName, u.LowerName, 180); err != nil {
 			log.Error("Set cache(MailResendLimit) fail: %v", err)
@@ -1084,7 +1084,7 @@ func SignUp(ctx *context.Context) {
 	//Show Disabled Registration message if DisableRegistration or AllowOnlyExternalRegistration options are true
 	ctx.Data["DisableRegistration"] = setting.Service.DisableRegistration || setting.Service.AllowOnlyExternalRegistration
 
-	ctx.HTML(200, tplSignUp)
+	ctx.HTML(http.StatusOK, tplSignUp)
 }
 
 // SignUpPost response for sign up information submission
@@ -1104,12 +1104,12 @@ func SignUpPost(ctx *context.Context) {
 
 	//Permission denied if DisableRegistration or AllowOnlyExternalRegistration options are true
 	if setting.Service.DisableRegistration || setting.Service.AllowOnlyExternalRegistration {
-		ctx.Error(403)
+		ctx.Error(http.StatusForbidden)
 		return
 	}
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplSignUp)
+		ctx.HTML(http.StatusOK, tplSignUp)
 		return
 	}
 
@@ -1218,7 +1218,7 @@ func SignUpPost(ctx *context.Context) {
 		ctx.Data["IsSendRegisterMail"] = true
 		ctx.Data["Email"] = u.Email
 		ctx.Data["ActiveCodeLives"] = timeutil.MinutesToFriendly(setting.Service.ActiveCodeLives, ctx.Locale.Language())
-		ctx.HTML(200, TplActivate)
+		ctx.HTML(http.StatusOK, TplActivate)
 
 		if err := ctx.Cache.Put("MailResendLimit_"+u.LowerName, u.LowerName, 180); err != nil {
 			log.Error("Set cache(MailResendLimit) fail: %v", err)
@@ -1238,7 +1238,7 @@ func Activate(ctx *context.Context) {
 	if len(code) == 0 {
 		ctx.Data["IsActivatePage"] = true
 		if ctx.User.IsActive {
-			ctx.Error(404)
+			ctx.Error(http.StatusNotFound)
 			return
 		}
 		// Resend confirmation email.
@@ -1256,7 +1256,7 @@ func Activate(ctx *context.Context) {
 		} else {
 			ctx.Data["ServiceNotEnabled"] = true
 		}
-		ctx.HTML(200, TplActivate)
+		ctx.HTML(http.StatusOK, TplActivate)
 		return
 	}
 
@@ -1264,7 +1264,7 @@ func Activate(ctx *context.Context) {
 	// if code is wrong
 	if user == nil {
 		ctx.Data["IsActivateFailed"] = true
-		ctx.HTML(200, TplActivate)
+		ctx.HTML(http.StatusOK, TplActivate)
 		return
 	}
 
@@ -1273,12 +1273,12 @@ func Activate(ctx *context.Context) {
 		if len(password) == 0 {
 			ctx.Data["Code"] = code
 			ctx.Data["NeedsPassword"] = true
-			ctx.HTML(200, TplActivate)
+			ctx.HTML(http.StatusOK, TplActivate)
 			return
 		}
 		if !user.ValidatePassword(password) {
 			ctx.Data["IsActivateFailed"] = true
-			ctx.HTML(200, TplActivate)
+			ctx.HTML(http.StatusOK, TplActivate)
 			return
 		}
 	}
@@ -1291,7 +1291,7 @@ func Activate(ctx *context.Context) {
 	}
 	if err := models.UpdateUserCols(user, "is_active", "rands"); err != nil {
 		if models.IsErrUserNotExist(err) {
-			ctx.Error(404)
+			ctx.Error(http.StatusNotFound)
 		} else {
 			ctx.ServerError("UpdateUser", err)
 		}
@@ -1348,7 +1348,7 @@ func ForgotPasswd(ctx *context.Context) {
 
 	if setting.MailService == nil {
 		ctx.Data["IsResetDisable"] = true
-		ctx.HTML(200, tplForgotPassword)
+		ctx.HTML(http.StatusOK, tplForgotPassword)
 		return
 	}
 
@@ -1356,7 +1356,7 @@ func ForgotPasswd(ctx *context.Context) {
 	ctx.Data["Email"] = email
 
 	ctx.Data["IsResetRequest"] = true
-	ctx.HTML(200, tplForgotPassword)
+	ctx.HTML(http.StatusOK, tplForgotPassword)
 }
 
 // ForgotPasswdPost response for forget password request
@@ -1377,7 +1377,7 @@ func ForgotPasswdPost(ctx *context.Context) {
 		if models.IsErrUserNotExist(err) {
 			ctx.Data["ResetPwdCodeLives"] = timeutil.MinutesToFriendly(setting.Service.ResetPwdCodeLives, ctx.Locale.Language())
 			ctx.Data["IsResetSent"] = true
-			ctx.HTML(200, tplForgotPassword)
+			ctx.HTML(http.StatusOK, tplForgotPassword)
 			return
 		}
 
@@ -1393,7 +1393,7 @@ func ForgotPasswdPost(ctx *context.Context) {
 
 	if ctx.Cache.IsExist("MailResendLimit_" + u.LowerName) {
 		ctx.Data["ResendLimited"] = true
-		ctx.HTML(200, tplForgotPassword)
+		ctx.HTML(http.StatusOK, tplForgotPassword)
 		return
 	}
 
@@ -1405,7 +1405,7 @@ func ForgotPasswdPost(ctx *context.Context) {
 
 	ctx.Data["ResetPwdCodeLives"] = timeutil.MinutesToFriendly(setting.Service.ResetPwdCodeLives, ctx.Locale.Language())
 	ctx.Data["IsResetSent"] = true
-	ctx.HTML(200, tplForgotPassword)
+	ctx.HTML(http.StatusOK, tplForgotPassword)
 }
 
 func commonResetPassword(ctx *context.Context) (*models.User, *models.TwoFactor) {
@@ -1461,7 +1461,7 @@ func ResetPasswd(ctx *context.Context) {
 		return
 	}
 
-	ctx.HTML(200, tplResetPassword)
+	ctx.HTML(http.StatusOK, tplResetPassword)
 }
 
 // ResetPasswdPost response from account recovery request
@@ -1473,7 +1473,7 @@ func ResetPasswdPost(ctx *context.Context) {
 
 	if u == nil {
 		// Flash error has been set
-		ctx.HTML(200, tplResetPassword)
+		ctx.HTML(http.StatusOK, tplResetPassword)
 		return
 	}
 
@@ -1578,7 +1578,7 @@ func MustChangePassword(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("auth.must_change_password")
 	ctx.Data["ChangePasscodeLink"] = setting.AppSubURL + "/user/settings/change_password"
 	ctx.Data["MustChangePassword"] = true
-	ctx.HTML(200, tplMustChangePassword)
+	ctx.HTML(http.StatusOK, tplMustChangePassword)
 }
 
 // MustChangePasswordPost response for updating a user's password after his/her
@@ -1588,7 +1588,7 @@ func MustChangePasswordPost(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("auth.must_change_password")
 	ctx.Data["ChangePasscodeLink"] = setting.AppSubURL + "/user/settings/change_password"
 	if ctx.HasError() {
-		ctx.HTML(200, tplMustChangePassword)
+		ctx.HTML(http.StatusOK, tplMustChangePassword)
 		return
 	}
 	u := ctx.User
diff --git a/routers/user/auth_openid.go b/routers/user/auth_openid.go
index 967e8aad2d..7db61dc09b 100644
--- a/routers/user/auth_openid.go
+++ b/routers/user/auth_openid.go
@@ -6,6 +6,7 @@ package user
 
 import (
 	"fmt"
+	"net/http"
 	"net/url"
 
 	"code.gitea.io/gitea/models"
@@ -61,7 +62,7 @@ func SignInOpenID(ctx *context.Context) {
 
 	ctx.Data["PageIsSignIn"] = true
 	ctx.Data["PageIsLoginOpenID"] = true
-	ctx.HTML(200, tplSignInOpenID)
+	ctx.HTML(http.StatusOK, tplSignInOpenID)
 }
 
 // Check if the given OpenID URI is allowed by blacklist/whitelist
@@ -97,7 +98,7 @@ func SignInOpenIDPost(ctx *context.Context) {
 	ctx.Data["PageIsLoginOpenID"] = true
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplSignInOpenID)
+		ctx.HTML(http.StatusOK, tplSignInOpenID)
 		return
 	}
 
@@ -273,7 +274,7 @@ func ConnectOpenID(ctx *context.Context) {
 	if userName != "" {
 		ctx.Data["user_name"] = userName
 	}
-	ctx.HTML(200, tplConnectOID)
+	ctx.HTML(http.StatusOK, tplConnectOID)
 }
 
 // ConnectOpenIDPost handles submission of a form to connect an OpenID URI to an existing account
@@ -344,7 +345,7 @@ func RegisterOpenID(ctx *context.Context) {
 	if email != "" {
 		ctx.Data["email"] = email
 	}
-	ctx.HTML(200, tplSignUpOID)
+	ctx.HTML(http.StatusOK, tplSignUpOID)
 }
 
 // RegisterOpenIDPost handles submission of a form to create a new user authenticated via an OpenID URI
@@ -472,7 +473,7 @@ func RegisterOpenIDPost(ctx *context.Context) {
 		ctx.Data["IsSendRegisterMail"] = true
 		ctx.Data["Email"] = u.Email
 		ctx.Data["ActiveCodeLives"] = timeutil.MinutesToFriendly(setting.Service.ActiveCodeLives, ctx.Locale.Language())
-		ctx.HTML(200, TplActivate)
+		ctx.HTML(http.StatusOK, TplActivate)
 
 		if err := ctx.Cache.Put("MailResendLimit_"+u.LowerName, u.LowerName, 180); err != nil {
 			log.Error("Set cache(MailResendLimit) fail: %v", err)
diff --git a/routers/user/home.go b/routers/user/home.go
index 24aaf00ba8..178ad57a79 100644
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -8,6 +8,7 @@ package user
 import (
 	"bytes"
 	"fmt"
+	"net/http"
 	"regexp"
 	"sort"
 	"strconv"
@@ -160,7 +161,7 @@ func Dashboard(ctx *context.Context) {
 	if ctx.Written() {
 		return
 	}
-	ctx.HTML(200, tplDashboard)
+	ctx.HTML(http.StatusOK, tplDashboard)
 }
 
 // Milestones render the user milestones page
@@ -320,7 +321,7 @@ func Milestones(ctx *context.Context) {
 	pager.AddParam(ctx, "state", "State")
 	ctx.Data["Page"] = pager
 
-	ctx.HTML(200, tplMilestones)
+	ctx.HTML(http.StatusOK, tplMilestones)
 }
 
 // Pulls renders the user's pull request overview page
@@ -705,7 +706,7 @@ func buildIssueOverview(ctx *context.Context, unitType models.UnitType) {
 	pager.AddParam(ctx, "assignee", "AssigneeID")
 	ctx.Data["Page"] = pager
 
-	ctx.HTML(200, tplIssues)
+	ctx.HTML(http.StatusOK, tplIssues)
 }
 
 func getRepoIDs(reposQuery string) []int64 {
diff --git a/routers/user/oauth.go b/routers/user/oauth.go
index d943ec4200..4502c2bd39 100644
--- a/routers/user/oauth.go
+++ b/routers/user/oauth.go
@@ -8,6 +8,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"html"
+	"net/http"
 	"net/url"
 	"strings"
 
@@ -339,7 +340,7 @@ func AuthorizeOAuth(ctx *context.Context) {
 		// we'll tolerate errors here as they *should* get saved elsewhere
 		log.Error("Unable to save changes to the session: %v", err)
 	}
-	ctx.HTML(200, tplGrantAccess)
+	ctx.HTML(http.StatusOK, tplGrantAccess)
 }
 
 // GrantApplicationOAuth manages the post request submitted when a user grants access to an application
@@ -347,7 +348,7 @@ func GrantApplicationOAuth(ctx *context.Context) {
 	form := web.GetForm(ctx).(*auth.GrantApplicationForm)
 	if ctx.Session.Get("client_id") != form.ClientID || ctx.Session.Get("state") != form.State ||
 		ctx.Session.Get("redirect_uri") != form.RedirectURI {
-		ctx.Error(400)
+		ctx.Error(http.StatusBadRequest)
 		return
 	}
 	app, err := models.GetOAuth2ApplicationByClientID(form.ClientID)
@@ -463,7 +464,7 @@ func handleRefreshToken(ctx *context.Context, form auth.AccessTokenForm) {
 		handleAccessTokenError(ctx, *tokenErr)
 		return
 	}
-	ctx.JSON(200, accessToken)
+	ctx.JSON(http.StatusOK, accessToken)
 }
 
 func handleAuthorizationCode(ctx *context.Context, form auth.AccessTokenForm) {
@@ -526,11 +527,11 @@ func handleAuthorizationCode(ctx *context.Context, form auth.AccessTokenForm) {
 		return
 	}
 	// send successful response
-	ctx.JSON(200, resp)
+	ctx.JSON(http.StatusOK, resp)
 }
 
 func handleAccessTokenError(ctx *context.Context, acErr AccessTokenError) {
-	ctx.JSON(400, acErr)
+	ctx.JSON(http.StatusBadRequest, acErr)
 }
 
 func handleServerError(ctx *context.Context, state string, redirectURI string) {
diff --git a/routers/user/profile.go b/routers/user/profile.go
index ea4a1e8893..40619aaf0f 100644
--- a/routers/user/profile.go
+++ b/routers/user/profile.go
@@ -7,6 +7,7 @@ package user
 
 import (
 	"fmt"
+	"net/http"
 	"path"
 	"strings"
 
@@ -49,7 +50,7 @@ func Profile(ctx *context.Context) {
 		ctx.ServeFile(path.Join(setting.StaticRootPath, "public/img/favicon.png"))
 		return
 	} else if strings.HasSuffix(uname, ".png") {
-		ctx.Error(404)
+		ctx.Error(http.StatusNotFound)
 		return
 	}
 
@@ -268,7 +269,7 @@ func Profile(ctx *context.Context) {
 
 	ctx.Data["ShowUserEmail"] = len(ctxUser.Email) > 0 && ctx.IsSigned && (!ctxUser.KeepEmailPrivate || ctxUser.ID == ctx.User.ID)
 
-	ctx.HTML(200, tplProfile)
+	ctx.HTML(http.StatusOK, tplProfile)
 }
 
 // Action response for follow/unfollow user request
diff --git a/routers/user/setting/account.go b/routers/user/setting/account.go
index 0bf6cf8b87..2b2804b53b 100644
--- a/routers/user/setting/account.go
+++ b/routers/user/setting/account.go
@@ -7,6 +7,7 @@ package setting
 
 import (
 	"errors"
+	"net/http"
 	"time"
 
 	"code.gitea.io/gitea/models"
@@ -33,7 +34,7 @@ func Account(ctx *context.Context) {
 
 	loadAccountData(ctx)
 
-	ctx.HTML(200, tplSettingsAccount)
+	ctx.HTML(http.StatusOK, tplSettingsAccount)
 }
 
 // AccountPost response for change user's password
@@ -45,7 +46,7 @@ func AccountPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadAccountData(ctx)
 
-		ctx.HTML(200, tplSettingsAccount)
+		ctx.HTML(http.StatusOK, tplSettingsAccount)
 		return
 	}
 
@@ -167,7 +168,7 @@ func EmailPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadAccountData(ctx)
 
-		ctx.HTML(200, tplSettingsAccount)
+		ctx.HTML(http.StatusOK, tplSettingsAccount)
 		return
 	}
 
@@ -216,7 +217,7 @@ func DeleteEmail(ctx *context.Context) {
 	log.Trace("Email address deleted: %s", ctx.User.Name)
 
 	ctx.Flash.Success(ctx.Tr("settings.email_deletion_success"))
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/account",
 	})
 }
diff --git a/routers/user/setting/applications.go b/routers/user/setting/applications.go
index 8da36dc6cf..367f2b38c1 100644
--- a/routers/user/setting/applications.go
+++ b/routers/user/setting/applications.go
@@ -6,6 +6,8 @@
 package setting
 
 import (
+	"net/http"
+
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
@@ -25,7 +27,7 @@ func Applications(ctx *context.Context) {
 
 	loadApplicationsData(ctx)
 
-	ctx.HTML(200, tplSettingsApplications)
+	ctx.HTML(http.StatusOK, tplSettingsApplications)
 }
 
 // ApplicationsPost response for add user's access token
@@ -37,7 +39,7 @@ func ApplicationsPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadApplicationsData(ctx)
 
-		ctx.HTML(200, tplSettingsApplications)
+		ctx.HTML(http.StatusOK, tplSettingsApplications)
 		return
 	}
 
@@ -76,7 +78,7 @@ func DeleteApplication(ctx *context.Context) {
 		ctx.Flash.Success(ctx.Tr("settings.delete_token_success"))
 	}
 
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/applications",
 	})
 }
diff --git a/routers/user/setting/keys.go b/routers/user/setting/keys.go
index a52ffd667b..98b7b74137 100644
--- a/routers/user/setting/keys.go
+++ b/routers/user/setting/keys.go
@@ -6,6 +6,8 @@
 package setting
 
 import (
+	"net/http"
+
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
@@ -28,7 +30,7 @@ func Keys(ctx *context.Context) {
 
 	loadKeysData(ctx)
 
-	ctx.HTML(200, tplSettingsKeys)
+	ctx.HTML(http.StatusOK, tplSettingsKeys)
 }
 
 // KeysPost response for change user's SSH/GPG keys
@@ -43,7 +45,7 @@ func KeysPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadKeysData(ctx)
 
-		ctx.HTML(200, tplSettingsKeys)
+		ctx.HTML(http.StatusOK, tplSettingsKeys)
 		return
 	}
 	switch form.Type {
@@ -188,7 +190,7 @@ func DeleteKey(ctx *context.Context) {
 		ctx.Flash.Warning("Function not implemented")
 		ctx.Redirect(setting.AppSubURL + "/user/settings/keys")
 	}
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/keys",
 	})
 }
diff --git a/routers/user/setting/oauth2.go b/routers/user/setting/oauth2.go
index 7f0f8db1c8..a12f4dc1ba 100644
--- a/routers/user/setting/oauth2.go
+++ b/routers/user/setting/oauth2.go
@@ -6,6 +6,7 @@ package setting
 
 import (
 	"fmt"
+	"net/http"
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/base"
@@ -29,7 +30,7 @@ func OAuthApplicationsPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadApplicationsData(ctx)
 
-		ctx.HTML(200, tplSettingsApplications)
+		ctx.HTML(http.StatusOK, tplSettingsApplications)
 		return
 	}
 	// TODO validate redirect URI
@@ -49,7 +50,7 @@ func OAuthApplicationsPost(ctx *context.Context) {
 		ctx.ServerError("GenerateClientSecret", err)
 		return
 	}
-	ctx.HTML(200, tplSettingsOAuthApplications)
+	ctx.HTML(http.StatusOK, tplSettingsOAuthApplications)
 }
 
 // OAuthApplicationsEdit response for editing oauth2 application
@@ -61,7 +62,7 @@ func OAuthApplicationsEdit(ctx *context.Context) {
 	if ctx.HasError() {
 		loadApplicationsData(ctx)
 
-		ctx.HTML(200, tplSettingsApplications)
+		ctx.HTML(http.StatusOK, tplSettingsApplications)
 		return
 	}
 	// TODO validate redirect URI
@@ -76,7 +77,7 @@ func OAuthApplicationsEdit(ctx *context.Context) {
 		return
 	}
 	ctx.Flash.Success(ctx.Tr("settings.update_oauth2_application_success"))
-	ctx.HTML(200, tplSettingsOAuthApplications)
+	ctx.HTML(http.StatusOK, tplSettingsOAuthApplications)
 }
 
 // OAuthApplicationsRegenerateSecret handles the post request for regenerating the secret
@@ -104,7 +105,7 @@ func OAuthApplicationsRegenerateSecret(ctx *context.Context) {
 		return
 	}
 	ctx.Flash.Success(ctx.Tr("settings.update_oauth2_application_success"))
-	ctx.HTML(200, tplSettingsOAuthApplications)
+	ctx.HTML(http.StatusOK, tplSettingsOAuthApplications)
 }
 
 // OAuth2ApplicationShow displays the given application
@@ -123,7 +124,7 @@ func OAuth2ApplicationShow(ctx *context.Context) {
 		return
 	}
 	ctx.Data["App"] = app
-	ctx.HTML(200, tplSettingsOAuthApplications)
+	ctx.HTML(http.StatusOK, tplSettingsOAuthApplications)
 }
 
 // DeleteOAuth2Application deletes the given oauth2 application
@@ -135,7 +136,7 @@ func DeleteOAuth2Application(ctx *context.Context) {
 	log.Trace("OAuth2 Application deleted: %s", ctx.User.Name)
 
 	ctx.Flash.Success(ctx.Tr("settings.remove_oauth2_application_success"))
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/applications",
 	})
 }
@@ -152,7 +153,7 @@ func RevokeOAuth2Grant(ctx *context.Context) {
 	}
 
 	ctx.Flash.Success(ctx.Tr("settings.revoke_oauth2_grant_success"))
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/applications",
 	})
 }
diff --git a/routers/user/setting/profile.go b/routers/user/setting/profile.go
index 38e371196a..c04428261a 100644
--- a/routers/user/setting/profile.go
+++ b/routers/user/setting/profile.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io/ioutil"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
@@ -37,7 +38,7 @@ func Profile(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("settings")
 	ctx.Data["PageIsSettingsProfile"] = true
 
-	ctx.HTML(200, tplSettingsProfile)
+	ctx.HTML(http.StatusOK, tplSettingsProfile)
 }
 
 // HandleUsernameChange handle username changes from user settings and admin interface
@@ -79,7 +80,7 @@ func ProfilePost(ctx *context.Context) {
 	ctx.Data["PageIsSettingsProfile"] = true
 
 	if ctx.HasError() {
-		ctx.HTML(200, tplSettingsProfile)
+		ctx.HTML(http.StatusOK, tplSettingsProfile)
 		return
 	}
 
@@ -204,7 +205,7 @@ func Organization(ctx *context.Context) {
 		return
 	}
 	ctx.Data["Orgs"] = orgs
-	ctx.HTML(200, tplSettingsOrganization)
+	ctx.HTML(http.StatusOK, tplSettingsOrganization)
 }
 
 // Repos display a list of all repositories of the user
@@ -305,5 +306,5 @@ func Repos(ctx *context.Context) {
 	pager := context.NewPagination(int(count), opts.PageSize, opts.Page, 5)
 	pager.SetDefaultParams(ctx)
 	ctx.Data["Page"] = pager
-	ctx.HTML(200, tplSettingsRepositories)
+	ctx.HTML(http.StatusOK, tplSettingsRepositories)
 }
diff --git a/routers/user/setting/security.go b/routers/user/setting/security.go
index 87e2ba1c02..7753c5c161 100644
--- a/routers/user/setting/security.go
+++ b/routers/user/setting/security.go
@@ -6,6 +6,8 @@
 package setting
 
 import (
+	"net/http"
+
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
@@ -30,7 +32,7 @@ func Security(ctx *context.Context) {
 
 	loadSecurityData(ctx)
 
-	ctx.HTML(200, tplSettingsSecurity)
+	ctx.HTML(http.StatusOK, tplSettingsSecurity)
 }
 
 // DeleteAccountLink delete a single account link
@@ -46,7 +48,7 @@ func DeleteAccountLink(ctx *context.Context) {
 		}
 	}
 
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/security",
 	})
 }
diff --git a/routers/user/setting/security_openid.go b/routers/user/setting/security_openid.go
index 401705608a..c5d106e990 100644
--- a/routers/user/setting/security_openid.go
+++ b/routers/user/setting/security_openid.go
@@ -5,6 +5,8 @@
 package setting
 
 import (
+	"net/http"
+
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/auth/openid"
 	"code.gitea.io/gitea/modules/context"
@@ -23,7 +25,7 @@ func OpenIDPost(ctx *context.Context) {
 	if ctx.HasError() {
 		loadSecurityData(ctx)
 
-		ctx.HTML(200, tplSettingsSecurity)
+		ctx.HTML(http.StatusOK, tplSettingsSecurity)
 		return
 	}
 
@@ -111,7 +113,7 @@ func DeleteOpenID(ctx *context.Context) {
 	log.Trace("OpenID address deleted: %s", ctx.User.Name)
 
 	ctx.Flash.Success(ctx.Tr("settings.openid_deletion_success"))
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/security",
 	})
 }
diff --git a/routers/user/setting/security_twofa.go b/routers/user/setting/security_twofa.go
index 0dee827cab..a830495f54 100644
--- a/routers/user/setting/security_twofa.go
+++ b/routers/user/setting/security_twofa.go
@@ -10,6 +10,7 @@ import (
 	"encoding/base64"
 	"html/template"
 	"image/png"
+	"net/http"
 	"strings"
 
 	"code.gitea.io/gitea/models"
@@ -162,7 +163,7 @@ func EnrollTwoFactor(ctx *context.Context) {
 		return
 	}
 
-	ctx.HTML(200, tplSettingsTwofaEnroll)
+	ctx.HTML(http.StatusOK, tplSettingsTwofaEnroll)
 }
 
 // EnrollTwoFactorPost handles enrolling the user into 2FA.
@@ -187,7 +188,7 @@ func EnrollTwoFactorPost(ctx *context.Context) {
 		if !twofaGenerateSecretAndQr(ctx) {
 			return
 		}
-		ctx.HTML(200, tplSettingsTwofaEnroll)
+		ctx.HTML(http.StatusOK, tplSettingsTwofaEnroll)
 		return
 	}
 
diff --git a/routers/user/setting/security_u2f.go b/routers/user/setting/security_u2f.go
index 8140c3c04a..040af34b5b 100644
--- a/routers/user/setting/security_u2f.go
+++ b/routers/user/setting/security_u2f.go
@@ -6,6 +6,7 @@ package setting
 
 import (
 	"errors"
+	"net/http"
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/context"
@@ -21,7 +22,7 @@ import (
 func U2FRegister(ctx *context.Context) {
 	form := web.GetForm(ctx).(*auth.U2FRegistrationForm)
 	if form.Name == "" {
-		ctx.Error(409)
+		ctx.Error(http.StatusConflict)
 		return
 	}
 	challenge, err := u2f.NewChallenge(setting.U2F.AppID, setting.U2F.TrustedFacets)
@@ -40,7 +41,7 @@ func U2FRegister(ctx *context.Context) {
 	}
 	for _, reg := range regs {
 		if reg.Name == form.Name {
-			ctx.Error(409, "Name already taken")
+			ctx.Error(http.StatusConflict, "Name already taken")
 			return
 		}
 	}
@@ -53,7 +54,7 @@ func U2FRegister(ctx *context.Context) {
 		// we'll tolerate errors here as they *should* get saved elsewhere
 		log.Error("Unable to save changes to the session: %v", err)
 	}
-	ctx.JSON(200, u2f.NewWebRegisterRequest(challenge, regs.ToRegistrations()))
+	ctx.JSON(http.StatusOK, u2f.NewWebRegisterRequest(challenge, regs.ToRegistrations()))
 }
 
 // U2FRegisterPost receives the response of the security key
@@ -104,7 +105,7 @@ func U2FDelete(ctx *context.Context) {
 		ctx.ServerError("DeleteRegistration", err)
 		return
 	}
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/security",
 	})
 }
diff --git a/routers/user/task.go b/routers/user/task.go
index a88257ee50..b8df5d99c7 100644
--- a/routers/user/task.go
+++ b/routers/user/task.go
@@ -5,6 +5,8 @@
 package user
 
 import (
+	"net/http"
+
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/context"
 )
@@ -13,13 +15,13 @@ import (
 func TaskStatus(ctx *context.Context) {
 	task, opts, err := models.GetMigratingTaskByID(ctx.ParamsInt64("task"), ctx.User.ID)
 	if err != nil {
-		ctx.JSON(500, map[string]interface{}{
+		ctx.JSON(http.StatusInternalServerError, map[string]interface{}{
 			"err": err,
 		})
 		return
 	}
 
-	ctx.JSON(200, map[string]interface{}{
+	ctx.JSON(http.StatusOK, map[string]interface{}{
 		"status":    task.Status,
 		"err":       task.Errors,
 		"repo-id":   task.RepoID,