@@ -22,6 +22,7 @@ import (
2222 "code.gitea.io/gitea/modules/log"
2323 "code.gitea.io/gitea/modules/password"
2424 "code.gitea.io/gitea/modules/recaptcha"
25+ "code.gitea.io/gitea/modules/session"
2526 "code.gitea.io/gitea/modules/setting"
2627 "code.gitea.io/gitea/modules/timeutil"
2728 "code.gitea.io/gitea/modules/web"
@@ -90,6 +91,10 @@ func AutoSignIn(ctx *context.Context) (bool, error) {
9091
9192 isSucceed = true
9293
94+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
95+ return false , fmt .Errorf ("unable to RegenerateSession: Error: %w" , err )
96+ }
97+
9398 // Set session IDs
9499 if err := ctx .Session .Set ("uid" , u .ID ); err != nil {
95100 return false , err
@@ -256,6 +261,11 @@ func SignInPost(ctx *context.Context) {
256261 return
257262 }
258263
264+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
265+ ctx .ServerError ("UserSignIn: Unable to set regenerate session" , err )
266+ return
267+ }
268+
259269 // User will need to use 2FA TOTP or U2F, save data
260270 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
261271 ctx .ServerError ("UserSignIn: Unable to set twofaUid in session" , err )
@@ -419,6 +429,9 @@ func TwoFactorScratchPost(ctx *context.Context) {
419429 }
420430
421431 handleSignInFull (ctx , u , remember , false )
432+ if ctx .Written () {
433+ return
434+ }
422435 ctx .Flash .Info (ctx .Tr ("auth.twofa_scratch_used" ))
423436 ctx .Redirect (setting .AppSubURL + "/user/settings/security" )
424437 return
@@ -526,6 +539,9 @@ func U2FSign(ctx *context.Context) {
526539 }
527540 }
528541 redirect := handleSignInFull (ctx , user , remember , false )
542+ if ctx .Written () {
543+ return
544+ }
529545 if redirect == "" {
530546 redirect = setting .AppSubURL + "/"
531547 }
@@ -538,7 +554,11 @@ func U2FSign(ctx *context.Context) {
538554
539555// This handles the final part of the sign-in process of the user.
540556func handleSignIn (ctx * context.Context , u * user_model.User , remember bool ) {
541- handleSignInFull (ctx , u , remember , true )
557+ redirect := handleSignInFull (ctx , u , remember , true )
558+ if ctx .Written () {
559+ return
560+ }
561+ ctx .Redirect (redirect )
542562}
543563
544564func handleSignInFull (ctx * context.Context , u * user_model.User , remember , obeyRedirect bool ) string {
@@ -549,6 +569,12 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember, obeyRe
549569 setting .CookieRememberName , u .Name , days )
550570 }
551571
572+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
573+ ctx .ServerError ("RegenerateSession" , err )
574+ return setting .AppSubURL + "/"
575+ }
576+
577+ // Delete the openid, 2fa and linkaccount data
552578 _ = ctx .Session .Delete ("openid_verified_uri" )
553579 _ = ctx .Session .Delete ("openid_signin_remember" )
554580 _ = ctx .Session .Delete ("openid_determined_email" )
@@ -572,7 +598,7 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember, obeyRe
572598 if len (u .Language ) == 0 {
573599 u .Language = ctx .Locale .Language ()
574600 if err := user_model .UpdateUserCols (db .DefaultContext , u , "language" ); err != nil {
575- log . Error ( fmt .Sprintf ("Error updating user language [user: %d, locale: %s]" , u .ID , u .Language ))
601+ ctx . ServerError ( "UpdateUserCols Language" , fmt .Errorf ("Error updating user language [user: %d, locale: %s]" , u .ID , u .Language ))
576602 return setting .AppSubURL + "/"
577603 }
578604 }
@@ -779,6 +805,11 @@ func getUserName(gothUser *goth.User) string {
779805}
780806
781807func showLinkingLogin (ctx * context.Context , gothUser goth.User ) {
808+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
809+ ctx .ServerError ("RegenerateSession" , err )
810+ return
811+ }
812+
782813 if err := ctx .Session .Set ("linkAccountGothUser" , gothUser ); err != nil {
783814 log .Error ("Error setting linkAccountGothUser in session: %v" , err )
784815 }
@@ -822,6 +853,12 @@ func handleOAuth2SignIn(ctx *context.Context, source *login.Source, u *user_mode
822853 // If this user is enrolled in 2FA and this source doesn't override it,
823854 // we can't sign the user in just yet. Instead, redirect them to the 2FA authentication page.
824855 if ! needs2FA {
856+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
857+ ctx .ServerError ("RegenerateSession" , err )
858+ return
859+ }
860+
861+ // Set session IDs
825862 if err := ctx .Session .Set ("uid" , u .ID ); err != nil {
826863 log .Error ("Error setting uid in session: %v" , err )
827864 }
@@ -878,6 +915,11 @@ func handleOAuth2SignIn(ctx *context.Context, source *login.Source, u *user_mode
878915 }
879916 }
880917
918+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
919+ ctx .ServerError ("RegenerateSession" , err )
920+ return
921+ }
922+
881923 // User needs to use 2FA, save data and redirect to 2FA page.
882924 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
883925 log .Error ("Error setting twofaUid in session: %v" , err )
@@ -1090,6 +1132,11 @@ func linkAccount(ctx *context.Context, u *user_model.User, gothUser goth.User, r
10901132 return
10911133 }
10921134
1135+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
1136+ ctx .ServerError ("RegenerateSession" , err )
1137+ return
1138+ }
1139+
10931140 // User needs to use 2FA, save data and redirect to 2FA page.
10941141 if err := ctx .Session .Set ("twofaUid" , u .ID ); err != nil {
10951142 log .Error ("Error setting twofaUid in session: %v" , err )
@@ -1227,7 +1274,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
12271274 return
12281275 }
12291276
1230- ctx . Redirect ( setting . AppSubURL + "/user/login" )
1277+ handleSignIn ( ctx , u , false )
12311278}
12321279
12331280// HandleSignOut resets the session and sets the cookies
@@ -1370,7 +1417,7 @@ func SignUpPost(ctx *context.Context) {
13701417 }
13711418
13721419 ctx .Flash .Success (ctx .Tr ("auth.sign_up_successful" ))
1373- handleSignInFull (ctx , u , false , true )
1420+ handleSignIn (ctx , u , false )
13741421}
13751422
13761423// createAndHandleCreatedUser calls createUserInContext and
@@ -1591,6 +1638,13 @@ func handleAccountActivation(ctx *context.Context, user *user_model.User) {
15911638
15921639 log .Trace ("User activated: %s" , user .Name )
15931640
1641+ if _ , err := session .RegenerateSession (ctx .Resp , ctx .Req ); err != nil {
1642+ log .Error ("Unable to regenerate session for user: %-v with email: %s: %v" , user , user .Email , err )
1643+ ctx .ServerError ("ActivateUserEmail" , err )
1644+ return
1645+ }
1646+
1647+ // Set session IDs
15941648 if err := ctx .Session .Set ("uid" , user .ID ); err != nil {
15951649 log .Error ("Error setting uid in session[%s]: %v" , ctx .Session .ID (), err )
15961650 }
@@ -1862,11 +1916,14 @@ func ResetPasswdPost(ctx *context.Context) {
18621916
18631917 handleSignInFull (ctx , u , remember , false )
18641918 ctx .Flash .Info (ctx .Tr ("auth.twofa_scratch_used" ))
1919+ if ctx .Written () {
1920+ return
1921+ }
18651922 ctx .Redirect (setting .AppSubURL + "/user/settings/security" )
18661923 return
18671924 }
18681925
1869- handleSignInFull (ctx , u , remember , true )
1926+ handleSignIn (ctx , u , remember )
18701927}
18711928
18721929// MustChangePassword renders the page to change a user's password
0 commit comments