Since 1.15.0, downloading a release attachment using Basic auth redirect to login

[kenji21]

• Gitea version (or commit ref): 1.15.0
• Git version: 2.20.1
• Operating system: Debian 10 (running from systemd)
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No (needs a private repo)
• Log gist:

Sep  1 12:37:04 gitea gitea[25215]: 2021/09/01 12:37:04 Started GET /:owner/:repo/releases/download/:tag/some.zip for REDACTED_IP:0
Sep  1 12:37:04 gitea gitea[25215]: 2021/09/01 12:37:04 Completed GET /:owner/:repo/releases/download/:tag/some.zip 302 Found in 349.553µs
Sep  1 12:37:04 gitea gitea[25215]: 2021/09/01 12:37:04 Started GET /user/login for REDACTED_IP:0
Sep  1 12:37:04 gitea gitea[25215]: 2021/09/01 12:37:04 Completed GET /user/login 200 OK in 4.64655ms

Description

We used to download release zip (using ansible), since 1.15.0, using curl, curl --netrc --location https://instance/:owner/:repo/releases/download/:tag/some.zip redirects to /user/login instead of the attachment

so we have the html page instead of the zip content

Note that getting a file from the repo, for exemple curl --netrc --location https://instance/:owner/:repo/raw/branch/develop/Jenkinsfile works well, so definitively not a auth error
Didn't get this issue with 1.14.6 (nor with previous versions)

[kenji21]

Tried to downgrade to 1.14.6, but, log shows it isn't a good idea:

Downgrading database version from '189' to '178' is not supported and may result in loss of data integrity.
If you really know what you're doing, execute `UPDATE version SET version=178 WHERE id=1;

[zeripath]

Ah, so we now no longer allow BASIC authentication to get to UI urls. Whilst #15987 added support for raw - no one has reported that releases also need to allow BASIC authentication.

A workaround is to use api paths for these.

As this change was not intended to be breaking I suspect we should add another PR like #15987.

[zeripath]

Please could you confirm which urls you need to be able to access through BASIC auth

[kenji21]

All files that are uploaded on a release (we only upload one zip, often named build.zip or dist.zip, but maybe other users upload more files/kind of files), so I think only of: https://instance/:owner/:repo/releases/download/:tag/build.zip

[kenji21]

❤️

1.15.1 deployed, I can confirm this bug is fixed