3 files changed, 32 insertions, 11 deletions
diff --git a/routers/user/setting/profile.go b/routers/user/setting/profile.go
index ac5c4c97fb..163bc869b4 100644
--- a/routers/user/setting/profile.go
+++ b/routers/user/setting/profile.go
@@ -141,13 +141,11 @@ func UpdateAvatarSetting(ctx *context.Context, form auth.AvatarForm, ctxUser *mo
 		if err = ctxUser.UploadAvatar(data); err != nil {
 			return fmt.Errorf("UploadAvatar: %v", err)
 		}
-	} else {
+	} else if ctxUser.UseCustomAvatar && !com.IsFile(ctxUser.CustomAvatarPath()) {
 		// No avatar is uploaded but setting has been changed to enable,
 		// generate a random one when needed.
-		if ctxUser.UseCustomAvatar && !com.IsFile(ctxUser.CustomAvatarPath()) {
-			if err := ctxUser.GenerateRandomAvatar(); err != nil {
-				log.Error("GenerateRandomAvatar[%d]: %v", ctxUser.ID, err)
-			}
+		if err := ctxUser.GenerateRandomAvatar(); err != nil {
+			log.Error("GenerateRandomAvatar[%d]: %v", ctxUser.ID, err)
 		}
 	}
 
diff --git a/routers/user/setting/security_twofa.go b/routers/user/setting/security_twofa.go
index fca1151a04..6e3516dbba 100644
--- a/routers/user/setting/security_twofa.go
+++ b/routers/user/setting/security_twofa.go
@@ -73,6 +73,10 @@ func twofaGenerateSecretAndQr(ctx *context.Context) bool {
 	uri := ctx.Session.Get("twofaUri")
 	if uri != nil {
 		otpKey, err = otp.NewKeyFromURL(uri.(string))
+		if err != nil {
+			ctx.ServerError("SettingsTwoFactor: NewKeyFromURL: ", err)
+			return false
+		}
 	}
 	// Filter unsafe character ':' in issuer
 	issuer := strings.Replace(setting.AppName+" ("+setting.Domain+")", ":", "", -1)
@@ -103,8 +107,16 @@ func twofaGenerateSecretAndQr(ctx *context.Context) bool {
 	}
 
 	ctx.Data["QrUri"] = template.URL("data:image/png;base64," + base64.StdEncoding.EncodeToString(imgBytes.Bytes()))
-	ctx.Session.Set("twofaSecret", otpKey.Secret())
-	ctx.Session.Set("twofaUri", otpKey.String())
+	err = ctx.Session.Set("twofaSecret", otpKey.Secret())
+	if err != nil {
+		ctx.ServerError("SettingsTwoFactor", err)
+		return false
+	}
+	err = ctx.Session.Set("twofaUri", otpKey.String())
+	if err != nil {
+		ctx.ServerError("SettingsTwoFactor", err)
+		return false
+	}
 	return true
 }
 
@@ -184,8 +196,16 @@ func EnrollTwoFactorPost(ctx *context.Context, form auth.TwoFactorAuthForm) {
 		return
 	}
 
-	ctx.Session.Delete("twofaSecret")
-	ctx.Session.Delete("twofaUri")
+	err = ctx.Session.Delete("twofaSecret")
+	if err != nil {
+		ctx.ServerError("SettingsTwoFactor", err)
+		return
+	}
+	err = ctx.Session.Delete("twofaUri")
+	if err != nil {
+		ctx.ServerError("SettingsTwoFactor", err)
+		return
+	}
 	ctx.Flash.Success(ctx.Tr("settings.twofa_enrolled", token))
 	ctx.Redirect(setting.AppSubURL + "/user/settings/security")
 }
diff --git a/routers/user/setting/security_u2f.go b/routers/user/setting/security_u2f.go
index c1d6eab967..b733467b84 100644
--- a/routers/user/setting/security_u2f.go
+++ b/routers/user/setting/security_u2f.go
@@ -42,7 +42,11 @@ func U2FRegister(ctx *context.Context, form auth.U2FRegistrationForm) {
 			return
 		}
 	}
-	ctx.Session.Set("u2fName", form.Name)
+	err = ctx.Session.Set("u2fName", form.Name)
+	if err != nil {
+		ctx.ServerError("", err)
+		return
+	}
 	ctx.JSON(200, u2f.NewWebRegisterRequest(challenge, regs.ToRegistrations()))
 }
 
@@ -95,5 +99,4 @@ func U2FDelete(ctx *context.Context, form auth.U2FDeleteForm) {
 	ctx.JSON(200, map[string]interface{}{
 		"redirect": setting.AppSubURL + "/user/settings/security",
 	})
-	return
 }