compare/create PR produces a 404

[philfry]

• Gitea version (or commit ref): 1.7.3
• Git version: 2.21.0
• Operating system: CentOS 7
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

when trying to create a PR gitea shows a 404.
Happens both on

• clicking on the "compare" button
• using the api https://myserver.example/api/v1/repos/myowner/myrepo/pulls

No relevant entries in the log files.

After downgrading to 1.7.2 everything works fine again.

Screenshots

[ptman]

My log which apparently is related to this issue and not #6225 : https://gist.github.com/ptman/f76b398d0503e5c50424c1ea8cbfafec .

The permissions should be correct. It worked nicely with 1.7.2. How can I check? I haven't been able to figure out a URL that would work. I mostly end up on the 404 page by following the URL that's returned via git command line, but also create new pull request takes me to the same 404 URL.

[zeripath]

OK so this issue is related to:

5c30817

Which was reverted by:

fe99c99

This bug report appears to be related to workflows for which original commit worked and its reversion breaks.

[zeripath]

Related bug reports are #3727, #5924

[zeripath]

OK @ptman,

I assume from your statements you're trying to try do a PR from a user's forked repository on to an organisation's private repository?

Is the user a member of a team in the organisation and is that repository in that team? Does that team have permission to read pull requests? Could you check whether the PR url works if you happen to be an admin?

Presumably the PR url is the same on v1.7.2 and v1.7.4? If not could you paste the differences?

[ptman]

Yes, the URL is exactly the same. The user is an admin and owners team in organisation. Should have all permissions.

[zeripath]

Just check that a) the user is in the team b) the repository is in the team and c) that the team has permission to read pull requests.

It's notable that there are two things that change between 1.7.2 and 1.7.4: the permission check, and possibly the URL.

If you tell me that the URL is the same on 1.7.2 then it must be the permission check.

[ptman]

Yes, I understood you the first time. My user is an admin according to site administration. There is only one team in the organisation. The default team called owners. My user is part of that team. That team has administrator access to the organisation.

The URL is the very same. It's shown in the logs. I sanitized it by renaming the organization to org etc., but didn't change the structure otherwise

[zeripath]

Hi @ptman, Sorry I think I got distracted with a few other things.

OK. So where did we get to?

• It's a 404, which means that my recent PR shouldn't fix this.
• The same url works in 1.7.2 but doesn't work in 1.7.4 - which implicates Issue 5924 fix compare button (#5929) #6098

The fact that it's 404 and #6098 is implicated places this at:

https://github.com/zeripath/gitea/blob/189b3341dcbab2b13feeea4117910c85d1f772f4/routers/repo/pull.go#L687-L691

You could confirm this by setting log to Trace.

[morph027]

Ran into the same with 1.7.5 (did the very loooooooong upgrade from Gogs this weekend, using all versions in between).

log level set to trace:

2019/04/13 17:29:39 [T] ParseCompareInfo[5]: cannot create/read pull requests
2019/04/13 17:29:39 [D] Template: status/404

Will check the downgrade to 1.7.2

[morph027]

(Dirty) Downgrade to 1.7.2 worked.... (without DB restore from 1.7.2)

[zeripath]

aha Thank you @morph027

Now before you suggest staying on 1.7.2 - there is a major security bug in Gogs and Gitea earlier than 1.7.6 so I think we need to fix this.

[zeripath]

OK so here's a good test. Your user who can't create a pull on 1.7.5 - can they create comments on a pull that they did not post? Because that's the same test that is being used from 1.7.4.