Preview of Markdown not working, getting 403

[fhuberts]

Gitea Version

1.15.6+27-gd29a0fc3b

Git Version

2.33.1

Operating System

Fedora 35 x64

How are you running Gitea?

Self-made RPM package, see https://gitlab.com/fhuberts/rpmsUpstream/-/tree/master/fedora/gitea

Database

PostgreSQL

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Description

Nov 28 14:57:07 git.somewhere gitea[3372]: 2021/11/28 14:57:07 Started POST /api/v1/repos/servers/server-installs/markdown for 192.168.180.11:0
Nov 28 14:57:07 git.somewhere gitea[3372]: 2021/11/28 14:57:07 Completed POST /api/v1/repos/servers/server-installs/markdown 403 Forbidden in 821.289µs

Screenshots

No response

[fhuberts]

The same 403 is present in the apache webserver log.
I run gitea behind apache, on a unix domain socket.

[28/Nov/2021:15:18:04 +0100] "POST /git/api/v1/repos/servers/server-installs/markdown HTTP/1.1" 403 59 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0"

[wxiaoguang]

I just remembered another similar issue:

• Markdown Preview can't be viewed - 403 Forbidden #17408

[fhuberts]

This was also present on 1.14.
Just upgraded my server to 1.15 in the hopes that it would work now...

[fhuberts]

I've tried changing the ROOT_URL as mentioned in the referenced issue, but that doesn't fix the problem.

[fhuberts]

Setting the *_VISIBILITY variables to public also doesn't work.

Don't know what else to check now.

[wxiaoguang]

Can you check (inspect) the requests sent by your browser? What's the difference between a correct request and an incorrect request?

[fhuberts]

From the Firefox console.

Headers:

{
	"POST": {
		"scheme": "https",
		"host": "<hostname>",
		"filename": "/git/api/v1/repos/servers/server-installs/markdown",
		"remote": {
			"Address": "<host ip>:443"
		}
	}
}

Request:

_csrf=<token>&mode=gfm&context=%2Fgit%2Fservers%2Fserver-installs&text=something&wiki=true

Must note that a different token appears to be sent than is stored in my cookies.

Also, Firefox reports 'CORS Missing Allow Origin' in the transferred column
for the request.

[wxiaoguang]

Must note that a different token appears to be sent than is stored in my cookies.

Also, Firefox reports 'CORS Missing Allow Origin' in the transferred column for the request.

Maybe that's the problem. On my side, the CSRF token in POST and in COOKIE are the same.

Can you check the source code of the page to see which CSRF token is correct? which is incorrect? The correct CSRF token should also exist in the page source code.

ps: You can safely paste the starting sub-string of your CSRF tokens here, it won't cause any security problem.

[fhuberts]

The csrf is changed by the 403 response.
I checked after the response so that is why the token was different

[zeripath]

What are your cookie settings in app.ini? It might just be helpful to paste that up entirely - skipping the secrets and the confidential stuff but explaining what the values are. (For example if your root URL is something like https://foo.example.com/bar put this in instead.)

Could you check if the problem still occurs in an incognito window?

Have you tried deleting all of your Gitea cookies?

[fhuberts]

I have changed nothing in app.ini wrt cookies, everything is at defaults.
I've not set ROOT_URL.

Problem is present is private window as well.

Removing all cookies doesn't help.

[fhuberts]

Even disabling selinux doesn't help, so it appears to be somewhere inside the application code

[fhuberts]

This can easily be reproduced by setting up a Fedora 35 machine/VM and installing the RPM I created (see https://gitlab.com/fhuberts/rpmsUpstream/-/tree/master/fedora/gitea). I'll attach a built RPM package in a minute.

This should make it a lot easier to debug.

[fhuberts]

Github refuses to attach the rpms/gz/zip. bummer.

It's quite easy to build the RPM yourself, or just ping me