Deleted users lead to 500 responses on various time-related API endpoints

[danieldietsch]

Description

When a user deletes their account, they become a Ghost account.
Such a user may already have logged time on issues.

In such a case, the following web API endpoints return 500.

• GET /repos/{owner}/{repo}/issues/{index}/times
• GET /repos/{owner}/{repo}/times
  Other endpoints may also be affected, but our scripts did only ran into trouble here.

In particular not affected is GET /repos/{owner}/{repo}/times/{user} as long as user is not the id of a deleted user.

Gitea Version

1.17.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

We are running Gitea with docker from image: gitea/gitea:1.17.2. Gitea DB is mariadb:10.9.2. The web API is behind a traefik reverse proxy.

Database

MySQL

[lunny]

Have you tried to upgrade to 1.17.3 ?

[danieldietsch]

Yes, did it just now. Issue is still present.

[zeripath]

It would be very helpful to see the logs for these.

[danieldietsch]

I am sorry, we did not retain logs.
A easy workaround is removing the user in question manually from the DB (just delete all entries of the user from tracked_time).

But repro should be easy:

• Create new user
• Log time to some issue
• Delete user
• Query API for issue or repo in question with admin user