Skip to content

Commit e9288c2

Browse files
wxiaoguanglunny
wxiaoguang
and
lunny
authored
Fix improper HTMLURL usages in Go code (#22839)
In Go code, HTMLURL should be only used for external systems, like API/webhook/mail/notification, etc. If a URL is used by `Redirect` or rendered in a template, it should be a relative URL (aka `Link()` in Gitea) Co-authored-by: Lunny Xiao <[email protected]>
1 parent 1cb8d14 commit e9288c2

17 files changed

+33
-33
lines changed

‎models/repo/repo.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ func (repo *Repository) CommitLink(commitID string) (result string) {
274274
if commitID == "" || commitID == "0000000000000000000000000000000000000000" {
275275
result = ""
276276
} else {
277-
result = repo.HTMLURL() + "/commit/" + url.PathEscape(commitID)
277+
result = repo.Link() + "/commit/" + url.PathEscape(commitID)
278278
}
279279
return result
280280
}

‎modules/context/repo.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -743,9 +743,9 @@ func RepoAssignment(ctx *Context) (cancel context.CancelFunc) {
743743

744744
if ctx.FormString("go-get") == "1" {
745745
ctx.Data["GoGetImport"] = ComposeGoGetImport(owner.Name, repo.Name)
746-
prefix := repo.HTMLURL() + "/src/branch/" + util.PathEscapeSegments(ctx.Repo.BranchName)
747-
ctx.Data["GoDocDirectory"] = prefix + "{/dir}"
748-
ctx.Data["GoDocFile"] = prefix + "{/dir}/{file}#L{line}"
746+
fullURLPrefix := repo.HTMLURL() + "/src/branch/" + util.PathEscapeSegments(ctx.Repo.BranchName)
747+
ctx.Data["GoDocDirectory"] = fullURLPrefix + "{/dir}"
748+
ctx.Data["GoDocFile"] = fullURLPrefix + "{/dir}/{file}#L{line}"
749749
}
750750
return cancel
751751
}

‎routers/web/repo/actions/actions.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func List(ctx *context.Context) {
7070
}
7171

7272
ctx.Data["workflows"] = workflows
73-
ctx.Data["RepoLink"] = ctx.Repo.Repository.HTMLURL()
73+
ctx.Data["RepoLink"] = ctx.Repo.Repository.Link()
7474

7575
page := ctx.FormInt("page")
7676
if page <= 0 {

‎routers/web/repo/issue.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ func MustAllowUserComment(ctx *context.Context) {
100100

101101
if issue.IsLocked && !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) && !ctx.Doer.IsAdmin {
102102
ctx.Flash.Error(ctx.Tr("repo.issues.comment_on_locked"))
103-
ctx.Redirect(issue.HTMLURL())
103+
ctx.Redirect(issue.Link())
104104
return
105105
}
106106
}
@@ -927,7 +927,7 @@ func NewIssueChooseTemplate(ctx *context.Context) {
927927

928928
if len(issueTemplates) == 0 {
929929
// The "issues/new" and "issues/new/choose" share the same query parameters "project" and "milestone", if no template here, just redirect to the "issues/new" page with these parameters.
930-
ctx.Redirect(fmt.Sprintf("%s/issues/new?%s", ctx.Repo.Repository.HTMLURL(), ctx.Req.URL.RawQuery), http.StatusSeeOther)
930+
ctx.Redirect(fmt.Sprintf("%s/issues/new?%s", ctx.Repo.Repository.Link(), ctx.Req.URL.RawQuery), http.StatusSeeOther)
931931
return
932932
}
933933

@@ -950,11 +950,11 @@ func DeleteIssue(ctx *context.Context) {
950950
}
951951

952952
if issue.IsPull {
953-
ctx.Redirect(fmt.Sprintf("%s/pulls", ctx.Repo.Repository.HTMLURL()), http.StatusSeeOther)
953+
ctx.Redirect(fmt.Sprintf("%s/pulls", ctx.Repo.Repository.Link()), http.StatusSeeOther)
954954
return
955955
}
956956

957-
ctx.Redirect(fmt.Sprintf("%s/issues", ctx.Repo.Repository.HTMLURL()), http.StatusSeeOther)
957+
ctx.Redirect(fmt.Sprintf("%s/issues", ctx.Repo.Repository.Link()), http.StatusSeeOther)
958958
}
959959

960960
// ValidateRepoMetas check and returns repository's meta information
@@ -1425,7 +1425,7 @@ func ViewIssue(ctx *context.Context) {
14251425
return
14261426
}
14271427
// Add link to the issue of the already running stopwatch
1428-
ctx.Data["OtherStopwatchURL"] = otherIssue.HTMLURL()
1428+
ctx.Data["OtherStopwatchURL"] = otherIssue.Link()
14291429
}
14301430
}
14311431
ctx.Data["CanUseTimetracker"] = ctx.Repo.CanUseTimetracker(issue, ctx.Doer)
@@ -2658,7 +2658,7 @@ func NewComment(ctx *context.Context) {
26582658

26592659
if issue.IsLocked && !ctx.Repo.CanWriteIssuesOrPulls(issue.IsPull) && !ctx.Doer.IsAdmin {
26602660
ctx.Flash.Error(ctx.Tr("repo.issues.comment_on_locked"))
2661-
ctx.Redirect(issue.HTMLURL())
2661+
ctx.Redirect(issue.Link())
26622662
return
26632663
}
26642664

@@ -2669,7 +2669,7 @@ func NewComment(ctx *context.Context) {
26692669

26702670
if ctx.HasError() {
26712671
ctx.Flash.Error(ctx.Data["ErrorMsg"].(string))
2672-
ctx.Redirect(issue.HTMLURL())
2672+
ctx.Redirect(issue.Link())
26732673
return
26742674
}
26752675

‎routers/web/repo/issue_dependency.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ func AddDependency(ctx *context.Context) {
3434
}
3535

3636
// Redirect
37-
defer ctx.Redirect(issue.HTMLURL())
37+
defer ctx.Redirect(issue.Link())
3838

3939
// Dependency
4040
dep, err := issues_model.GetIssueByID(ctx, depID)
@@ -124,5 +124,5 @@ func RemoveDependency(ctx *context.Context) {
124124
}
125125

126126
// Redirect
127-
ctx.Redirect(issue.HTMLURL())
127+
ctx.Redirect(issue.Link())
128128
}

‎routers/web/repo/issue_lock.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@ func LockIssue(ctx *context.Context) {
2121

2222
if issue.IsLocked {
2323
ctx.Flash.Error(ctx.Tr("repo.issues.lock_duplicate"))
24-
ctx.Redirect(issue.HTMLURL())
24+
ctx.Redirect(issue.Link())
2525
return
2626
}
2727

2828
if !form.HasValidReason() {
2929
ctx.Flash.Error(ctx.Tr("repo.issues.lock.unknown_reason"))
30-
ctx.Redirect(issue.HTMLURL())
30+
ctx.Redirect(issue.Link())
3131
return
3232
}
3333

@@ -40,7 +40,7 @@ func LockIssue(ctx *context.Context) {
4040
return
4141
}
4242

43-
ctx.Redirect(issue.HTMLURL())
43+
ctx.Redirect(issue.Link())
4444
}
4545

4646
// UnlockIssue unlocks a previously locked issue.
@@ -52,7 +52,7 @@ func UnlockIssue(ctx *context.Context) {
5252

5353
if !issue.IsLocked {
5454
ctx.Flash.Error(ctx.Tr("repo.issues.unlock_error"))
55-
ctx.Redirect(issue.HTMLURL())
55+
ctx.Redirect(issue.Link())
5656
return
5757
}
5858

@@ -64,5 +64,5 @@ func UnlockIssue(ctx *context.Context) {
6464
return
6565
}
6666

67-
ctx.Redirect(issue.HTMLURL())
67+
ctx.Redirect(issue.Link())
6868
}

‎routers/web/repo/issue_stopwatch.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func IssueStopwatch(c *context.Context) {
4040
c.Flash.Success(c.Tr("repo.issues.tracker_auto_close"))
4141
}
4242

43-
url := issue.HTMLURL()
43+
url := issue.Link()
4444
c.Redirect(url, http.StatusSeeOther)
4545
}
4646

@@ -72,7 +72,7 @@ func CancelStopwatch(c *context.Context) {
7272
})
7373
}
7474

75-
url := issue.HTMLURL()
75+
url := issue.Link()
7676
c.Redirect(url, http.StatusSeeOther)
7777
}
7878

‎routers/web/repo/issue_timetrack.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func AddTimeManually(c *context.Context) {
2626
c.NotFound("CanUseTimetracker", nil)
2727
return
2828
}
29-
url := issue.HTMLURL()
29+
url := issue.Link()
3030

3131
if c.HasError() {
3232
c.Flash.Error(c.GetErrMsg())
@@ -83,5 +83,5 @@ func DeleteTime(c *context.Context) {
8383
}
8484

8585
c.Flash.Success(c.Tr("repo.issues.del_time_history", util.SecToTime(t.Time)))
86-
c.Redirect(issue.HTMLURL())
86+
c.Redirect(issue.Link())
8787
}

‎routers/web/repo/issue_watch.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,5 +52,5 @@ func IssueWatch(ctx *context.Context) {
5252
return
5353
}
5454

55-
ctx.Redirect(issue.HTMLURL())
55+
ctx.Redirect(issue.Link())
5656
}

‎routers/web/repo/pull_review.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func CreateCodeComment(ctx *context.Context) {
9898
renderConversation(ctx, comment)
9999
return
100100
}
101-
ctx.Redirect(comment.HTMLURL())
101+
ctx.Redirect(comment.Link())
102102
}
103103

104104
// UpdateResolveConversation add or remove an Conversation resolved mark

‎routers/web/repo/release.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ func LatestRelease(ctx *context.Context) {
295295
return
296296
}
297297

298-
ctx.Redirect(release.HTMLURL())
298+
ctx.Redirect(release.Link())
299299
}
300300

301301
// NewRelease render creating or edit release page

‎routers/web/repo/repo.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,7 @@ func acceptOrRejectRepoTransfer(ctx *context.Context, accept bool) error {
344344
ctx.Flash.Success(ctx.Tr("repo.settings.transfer.rejected"))
345345
}
346346

347-
ctx.Redirect(ctx.Repo.Repository.HTMLURL())
347+
ctx.Redirect(ctx.Repo.Repository.Link())
348348
return nil
349349
}
350350

‎routers/web/repo/search.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func Search(ctx *context.Context) {
5454
ctx.Data["CodeIndexerUnavailable"] = !code_indexer.IsAvailable()
5555
}
5656

57-
ctx.Data["SourcePath"] = ctx.Repo.Repository.HTMLURL()
57+
ctx.Data["SourcePath"] = ctx.Repo.Repository.Link()
5858
ctx.Data["SearchResults"] = searchResults
5959
ctx.Data["SearchResultLanguages"] = searchResultLanguages
6060

‎routers/web/repo/view.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,7 @@ func renderReadmeFile(ctx *context.Context, readmeFile *namedBlob, readmeTreelin
318318

319319
if fInfo.isLFSFile {
320320
filenameBase64 := base64.RawURLEncoding.EncodeToString([]byte(readmeFile.name))
321-
ctx.Data["RawFileLink"] = fmt.Sprintf("%s.git/info/lfs/objects/%s/%s", ctx.Repo.Repository.HTMLURL(), url.PathEscape(fInfo.lfsMeta.Oid), url.PathEscape(filenameBase64))
321+
ctx.Data["RawFileLink"] = fmt.Sprintf("%s.git/info/lfs/objects/%s/%s", ctx.Repo.Repository.Link(), url.PathEscape(fInfo.lfsMeta.Oid), url.PathEscape(filenameBase64))
322322
}
323323

324324
if !fInfo.isTextFile {
@@ -738,7 +738,7 @@ func Home(ctx *context.Context) {
738738
}
739739

740740
ctx.Data["EnableFeed"] = true
741-
ctx.Data["FeedURL"] = ctx.Repo.Repository.HTMLURL()
741+
ctx.Data["FeedURL"] = ctx.Repo.Repository.Link()
742742
}
743743

744744
checkHomeCodeViewable(ctx)

‎routers/web/user/package.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -376,7 +376,7 @@ func PackageSettingsPost(ctx *context.Context) {
376376
ctx.Flash.Success(ctx.Tr("packages.settings.delete.success"))
377377
}
378378

379-
ctx.Redirect(ctx.Package.Owner.HTMLURL() + "/-/packages")
379+
ctx.Redirect(ctx.Package.Owner.HomeLink() + "/-/packages")
380380
return
381381
}
382382
}

‎routers/web/user/profile.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func Profile(ctx *context.Context) {
4747
}
4848

4949
// advertise feed via meta tag
50-
ctx.Data["FeedURL"] = ctx.ContextUser.HTMLURL()
50+
ctx.Data["FeedURL"] = ctx.ContextUser.HomeLink()
5151

5252
// Show OpenID URIs
5353
openIDs, err := user_model.GetUserOpenIDs(ctx.ContextUser.ID)

‎services/actions/commit_status.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ func CreateCommitStatus(ctx context.Context, job *actions_model.ActionRunJob) er
5959
Creator: creator,
6060
CommitStatus: &git_model.CommitStatus{
6161
SHA: sha,
62-
TargetURL: run.HTMLURL(),
62+
TargetURL: run.Link(),
6363
Description: "",
6464
Context: ctxname,
6565
CreatorID: payload.Pusher.ID,

0 commit comments

Comments
 (0)