@@ -22,6 +22,7 @@ import (
2222 "code.gitea.io/gitea/modules/log"
2323 "code.gitea.io/gitea/modules/password"
2424 "code.gitea.io/gitea/modules/recaptcha"
25+ "code.gitea.io/gitea/modules/session"
2526 "code.gitea.io/gitea/modules/setting"
2627 "code.gitea.io/gitea/modules/timeutil"
2728 "code.gitea.io/gitea/modules/web"
@@ -87,6 +88,10 @@ func AutoSignIn(ctx *context.Context) (bool, error) {
8788
8889 isSucceed = true
8990
91+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
92+ return false , fmt .Errorf ("unable to RegenerateSession: Error: %w" , err )
93+ }
94+
9095 // Set session IDs
9196 if err := ctx .Session .Set ("uid" , u .ID ); err != nil {
9297 return false , err
@@ -235,6 +240,11 @@ func SignInPost(ctx *context.Context) {
235240 return
236241 }
237242
243+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
244+ ctx .ServerError ("UserSignIn: Unable to set regenerate session" , err )
245+ return
246+ }
247+
238248 // User needs to use 2FA, save data and redirect to 2FA page.
239249 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
240250 ctx .ServerError ("UserSignIn: Unable to set twofaUid in session" , err )
@@ -395,6 +405,9 @@ func TwoFactorScratchPost(ctx *context.Context) {
395405 }
396406
397407 handleSignInFull (ctx , u , remember , false )
408+ if ctx .Written () {
409+ return
410+ }
398411 ctx .Flash .Info (ctx .Tr ("auth.twofa_scratch_used" ))
399412 ctx .Redirect (setting .AppSubURL + "/user/settings/security" )
400413 return
@@ -505,6 +518,9 @@ func U2FSign(ctx *context.Context) {
505518 }
506519 }
507520 redirect := handleSignInFull (ctx , user , remember , false )
521+ if ctx .Written () {
522+ return
523+ }
508524 if redirect == "" {
509525 redirect = setting .AppSubURL + "/"
510526 }
@@ -517,7 +533,11 @@ func U2FSign(ctx *context.Context) {
517533
518534// This handles the final part of the sign-in process of the user.
519535func handleSignIn (ctx * context.Context , u * models.User , remember bool ) {
520- handleSignInFull (ctx , u , remember , true )
536+ redirect := handleSignInFull (ctx , u , remember , true )
537+ if ctx .Written () {
538+ return
539+ }
540+ ctx .Redirect (redirect )
521541}
522542
523543func handleSignInFull (ctx * context.Context , u * models.User , remember bool , obeyRedirect bool ) string {
@@ -528,6 +548,12 @@ func handleSignInFull(ctx *context.Context, u *models.User, remember bool, obeyR
528548 setting .CookieRememberName , u .Name , days )
529549 }
530550
551+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
552+ ctx .ServerError ("RegenerateSession" , err )
553+ return setting .AppSubURL + "/"
554+ }
555+
556+ // Delete the openid, 2fa and linkaccount data
531557 _ = ctx .Session .Delete ("openid_verified_uri" )
532558 _ = ctx .Session .Delete ("openid_signin_remember" )
533559 _ = ctx .Session .Delete ("openid_determined_email" )
@@ -551,7 +577,7 @@ func handleSignInFull(ctx *context.Context, u *models.User, remember bool, obeyR
551577 if len (u .Language ) == 0 {
552578 u .Language = ctx .Locale .Language ()
553579 if err := models .UpdateUserCols (u , "language" ); err != nil {
554- log . Error ( fmt .Sprintf ("Error updating user language [user: %d, locale: %s]" , u .ID , u .Language ))
580+ ctx . ServerError ( "UpdateUserCols Language" , fmt .Errorf ("Error updating user language [user: %d, locale: %s]" , u .ID , u .Language ))
555581 return setting .AppSubURL + "/"
556582 }
557583 }
@@ -697,6 +723,11 @@ func getUserName(gothUser *goth.User) string {
697723}
698724
699725func showLinkingLogin (ctx * context.Context , gothUser goth.User ) {
726+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
727+ ctx .ServerError ("RegenerateSession" , err )
728+ return
729+ }
730+
700731 if err := ctx .Session .Set ("linkAccountGothUser" , gothUser ); err != nil {
701732 log .Error ("Error setting linkAccountGothUser in session: %v" , err )
702733 }
@@ -736,6 +767,11 @@ func handleOAuth2SignIn(ctx *context.Context, u *models.User, gothUser goth.User
736767 return
737768 }
738769
770+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
771+ ctx .ServerError ("RegenerateSession" , err )
772+ return
773+ }
774+
739775 if err := ctx .Session .Set ("uid" , u .ID ); err != nil {
740776 log .Error ("Error setting uid in session: %v" , err )
741777 }
@@ -776,6 +812,11 @@ func handleOAuth2SignIn(ctx *context.Context, u *models.User, gothUser goth.User
776812 return
777813 }
778814
815+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
816+ ctx .ServerError ("RegenerateSession" , err )
817+ return
818+ }
819+
779820 // User needs to use 2FA, save data and redirect to 2FA page.
780821 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
781822 log .Error ("Error setting twofaUid in session: %v" , err )
@@ -965,6 +1006,11 @@ func linkAccount(ctx *context.Context, u *models.User, gothUser goth.User, remem
9651006 return
9661007 }
9671008
1009+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
1010+ ctx .ServerError ("RegenerateSession" , err )
1011+ return
1012+ }
1013+
9681014 // User needs to use 2FA, save data and redirect to 2FA page.
9691015 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
9701016 log .Error ("Error setting twofaUid in session: %v" , err )
@@ -1102,7 +1148,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
11021148 return
11031149 }
11041150
1105- ctx . Redirect ( setting . AppSubURL + "/user/login" )
1151+ handleSignIn ( ctx , u , false )
11061152}
11071153
11081154// HandleSignOut resets the session and sets the cookies
@@ -1244,7 +1290,7 @@ func SignUpPost(ctx *context.Context) {
12441290 }
12451291
12461292 ctx .Flash .Success (ctx .Tr ("auth.sign_up_successful" ))
1247- handleSignInFull (ctx , u , false , true )
1293+ handleSignIn (ctx , u , false )
12481294}
12491295
12501296// createAndHandleCreatedUser calls createUserInContext and
@@ -1465,6 +1511,13 @@ func handleAccountActivation(ctx *context.Context, user *models.User) {
14651511
14661512 log .Trace ("User activated: %s" , user .Name )
14671513
1514+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
1515+ log .Error ("Unable to regenerate session for user: %-v with email: %s: %v" , user , user .Email , err )
1516+ ctx .ServerError ("ActivateUserEmail" , err )
1517+ return
1518+ }
1519+
1520+ // Set session IDs
14681521 if err := ctx .Session .Set ("uid" , user .ID ); err != nil {
14691522 log .Error ("Error setting uid in session[%s]: %v" , ctx .Session .ID (), err )
14701523 }
@@ -1737,11 +1790,14 @@ func ResetPasswdPost(ctx *context.Context) {
17371790
17381791 handleSignInFull (ctx , u , remember , false )
17391792 ctx .Flash .Info (ctx .Tr ("auth.twofa_scratch_used" ))
1793+ if ctx .Written () {
1794+ return
1795+ }
17401796 ctx .Redirect (setting .AppSubURL + "/user/settings/security" )
17411797 return
17421798 }
17431799
1744- handleSignInFull (ctx , u , remember , true )
1800+ handleSignIn (ctx , u , remember )
17451801}
17461802
17471803// MustChangePassword renders the page to change a user's password
0 commit comments