From 2a48833f9382a531f849195503b2e27fd35d7524 Mon Sep 17 00:00:00 2001
From: Wim <wim@42.be>
Date: Sun, 19 Jun 2022 19:02:18 +0200
Subject: [PATCH] Respond with a 401 on git push when password isn't changed
yet (#20027)
Fixes #19090
If the user-agent starts with git and user must change password but
hasn't return a 401 with the message.
It must be a 401, git doesn't seem to show the contents of the error message
when we return a 403
Co-authored-by: 6543 <6543@obermui.de>
---
modules/context/auth.go | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/modules/context/auth.go b/modules/context/auth.go
index 09c2295455..e6d882eb5b 100644
--- a/modules/context/auth.go
+++ b/modules/context/auth.go
@@ -7,6 +7,7 @@ package context
import (
"net/http"
+ "strings"
"code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/modules/log"
@@ -41,6 +42,10 @@ func Toggle(options *ToggleOptions) func(ctx *Context) {
if ctx.Doer.MustChangePassword {
if ctx.Req.URL.Path != "/user/settings/change_password" {
+ if strings.HasPrefix(ctx.Req.UserAgent(), "git") {
+ ctx.Error(http.StatusUnauthorized, ctx.Tr("auth.must_change_password"))
+ return
+ }
ctx.Data["Title"] = ctx.Tr("auth.must_change_password")
ctx.Data["ChangePasscodeLink"] = setting.AppSubURL + "/user/change_password"
if ctx.Req.URL.Path != "/user/events" {