Fix api uses in the web ui

[kolaente]

#4840 introduced some significant changes to the way the authentication for the api works. It broke some things where the web ui called the api, namely:

https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630

We have two possibilities to solve this:

• Either call the routes using an api token
• Accept using a cookie, but if using a cookie, some kind of crf token to validate the request

IMHO the first solution would be cleaner because if an attacker has a cookie he/she could easily use that to get a new api request token via the web ui, rendering the whole double-check useless. So we could save the hassle to implement the double check with cookie/crf token and use the mechanism which is already there.

[techknowlogick]

@kolaente a malicious user wouldn't need the cookie to be able to post to the API. They could create a form on a different domain that POSTs to the API, and because the user has the cookie the API would accept it, which is why the CSRF would be needed.

Option 2 would be better than 1 because the CSRF is shortlived and autogenerated, and an API token is long living, so I believe 2 is cleaner.

[zeripath]

OK The list above appears to map to the following urls:

• GET /api/v1/users/search?...

  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459

• GET /api/v1/repos/search?...

  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486
  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087

• GET /api/v1/topics/search?...

  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507

• POST /api/v1/repos/{owner}/{repo}/issues/{issue}/deadline

  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594

• GET /api/v1/repos/{owner}/{repo}/issues?q={query}

  • https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630

[zeripath]

Looking at the code, and following some rudimentary testing I'm not convinced that the GET urls are affected.

[kolaente]

@zeripath The issue search does not work when on a private repo, user search shouldn't work either, neither should topic search.

[lafriks]

I would prefer to stick to current behaviour to not use API for UI

[zeripath]

@lafriks I'm not sure I understand.

[lafriks]

I meant that we should create routes that would be called for getting data for UI and not call API routes

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[stale]

This issue has been automatically closed because of inactivity. You can re-open it if needed.