Commit `15961c4783`

15961c47839f73ebaeaa1f97c575ce86107e3b3b

parent: 191da4bb52

Verified · cmc ci/build: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-04 01:44 UTC

web: a failed form action's reason rides a one-shot cookie, not the URL

Action handlers redirected back with ?e=<message>, so the reason
survived a reload, landed in history and bookmarks, and every page
that could show one read the query string. setFlash queues the message
in a short-lived HttpOnly cookie on the redirect and takeFlash reads
and clears it where the page renders. The merge request form keeps its
prefill in the query and the account page keeps ?m= for its success
note.

Closes #119

Layout: unified · split

internal/httpd/account.go +3 −5

 		Notice  string
 		Message string
 	}{s.baseFor(u), "account", keys, pgp, emails, s.cfg.SiteHost(),
-		r.URL.Query().Get("e"), r.URL.Query().Get("m")})
+		s.takeFlash(w, r), r.URL.Query().Get("m")})
 }
 // accountSubmit routes the account forms to their commands. Everything
 func (s *Server) accountSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 	back := func(msg, note string) {
 		q := ""
-		switch {
+		if note != "" {
-		case msg != "":
-			q = "?e=" + url.QueryEscape(msg)
-		case note != "":
 			q = "?m=" + url.QueryEscape(note)
 		}
+		s.setFlash(w, msg)
 		http.Redirect(w, r, "/settings"+q, http.StatusSeeOther)
 	}

internal/httpd/builds.go +1 −1

	@@ -45,7 +45,7 @@ func (s Server) builds(w http.ResponseWriter, r http.Request) {
45	Jobs []jobView	45	Jobs []jobView
46	CanWrite bool	46	CanWrite bool
47	Notice string	47	Notice string
48	}{p, builds, jobs, s.canWriteRepo(r, p.Repo), r.URL.Query().Get("e")})	48	}{p, builds, jobs, s.canWriteRepo(r, p.Repo), s.takeFlash(w, r)})
49	}	49	}
50		50
51	func (s Server) build(w http.ResponseWriter, r http.Request) {	51	func (s Server) build(w http.ResponseWriter, r http.Request) {

internal/httpd/flash.go added +44

@@ -0,0 +1,44 @@
	1	package httpd
	2
	3	import (
	4	"net/http"
	5	"net/url"
	6	)
	7
	8	// A form action that fails redirects back to the page it came from with
	9	// the reason. The reason used to ride the URL as ?e=, so it survived a
	10	// reload and landed in history and bookmarks. It rides a one-shot cookie
	11	// now: set on the redirect, read and cleared by the page that renders it
	12	// (#119).
	13	const flashCookie = "gitbay_notice"
	14
	15	// setFlash queues msg for the next page render. An empty msg sets
	16	// nothing.
	17	func (s *Server) setFlash(w http.ResponseWriter, msg string) {
	18	if msg == "" {
	19	return
	20	}
	21	if len(msg) > 300 {
	22	msg = msg[:300]
	23	}
	24	http.SetCookie(w, &http.Cookie{
	25	Name: flashCookie, Value: url.QueryEscape(msg), Path: "/",
	26	HttpOnly: true, SameSite: http.SameSiteLaxMode,
	27	Secure: s.cfg.HTTP.TLS != "off",
	28	MaxAge: 60,
	29	})
	30	}
	31
	32	// takeFlash returns the queued message, if any, and clears it.
	33	func (s Server) takeFlash(w http.ResponseWriter, r http.Request) string {
	34	c, err := r.Cookie(flashCookie)
	35	if err != nil \|\| c.Value == "" {
	36	return ""
	37	}
	38	http.SetCookie(w, &http.Cookie{Name: flashCookie, Value: "", Path: "/", MaxAge: -1})
	39	msg, err := url.QueryUnescape(c.Value)
	40	if err != nil {
	41	return ""
	42	}
	43	return msg
	44	}

internal/httpd/issueactions.go +1 −7

 import (
 	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 	"gitbay.org/gitbay/internal/store"
 func (s *Server) issueRedirect(w http.ResponseWriter, r *http.Request, msg string) {
 	dest := fmt.Sprintf("/%s/%s/issues/%s",
 		r.PathValue("owner"), r.PathValue("repo"), r.PathValue("n"))
-	if msg != "" {
+	s.setFlash(w, msg)
-		if len(msg) > 300 {
-			msg = msg[:300]
-		}
-		dest += "?e=" + url.QueryEscape(msg)
-	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }

internal/httpd/mractions.go +5 −14

 func (s *Server) mrRedirect(w http.ResponseWriter, r *http.Request, msg string) {
 	dest := fmt.Sprintf("/%s/%s/mrs/%s",
 		r.PathValue("owner"), r.PathValue("repo"), r.PathValue("n"))
-	if msg != "" {
+	s.setFlash(w, msg)
-		if len(msg) > 300 {
-			msg = msg[:300]
-		}
-		dest += "?e=" + url.QueryEscape(msg)
-	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }
 func (s *Server) mrDiffRedirect(w http.ResponseWriter, r *http.Request, msg string) {
 	dest := fmt.Sprintf("/%s/%s/mrs/%s?view=diff",
 		r.PathValue("owner"), r.PathValue("repo"), r.PathValue("n"))
-	if msg != "" {
+	s.setFlash(w, msg)
-		if len(msg) > 300 {
-			msg = msg[:300]
-		}
-		dest += "&e=" + url.QueryEscape(msg)
-	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }
 	s.render(w, "mrnew.html", mrNewPage{
 		repoPage: p, Branches: branches,
 		Source: q.Get("source"), Target: target,
-		Title: q.Get("title"), Body: q.Get("body"), Notice: q.Get("e"),
+		Title: q.Get("title"), Body: q.Get("body"), Notice: s.takeFlash(w, r),
 	})
 }
 	body := strings.TrimSpace(r.FormValue("body"))
 	back := func(msg string) {
-		q := url.Values{"source": {source}, "target": {target}, "title": {title}, "body": {body}, "e": {msg}}
+		q := url.Values{"source": {source}, "target": {target}, "title": {title}, "body": {body}}
+		s.setFlash(w, msg)
 		http.Redirect(w, r, fmt.Sprintf("/%s/mrs/new?%s", p.Repo.Path(), q.Encode()), http.StatusSeeOther)
 	}
 	if source == "" || title == "" {

internal/httpd/orgweb.go +2 −6

 import (
 	"net/http"
-	"net/url"
 	"strings"
 	"gitbay.org/gitbay/internal/store"
 func (s *Server) orgSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 	owner := r.PathValue("owner")
 	back := func(msg string) {
-		dest := "/" + owner
+		s.setFlash(w, msg)
-		if msg != "" {
+		http.Redirect(w, r, "/"+owner, http.StatusSeeOther)
-			dest += "?e=" + url.QueryEscape(msg)
-		}
-		http.Redirect(w, r, dest, http.StatusSeeOther)
 	}
 	field := r.FormValue("field")
 	team := strings.TrimSpace(r.FormValue("team"))

internal/httpd/releaseactions.go +1 −7

 import (
 	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 	"gitbay.org/gitbay/internal/store"
 func (s *Server) backTo(w http.ResponseWriter, r *http.Request, page, msg string) {
 	dest := fmt.Sprintf("/%s/%s/%s", r.PathValue("owner"), r.PathValue("repo"), page)
-	if msg != "" {
+	s.setFlash(w, msg)
-		if len(msg) > 300 {
-			msg = msg[:300]
-		}
-		dest += "?e=" + url.QueryEscape(msg)
-	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }

internal/httpd/settings.go +2 −8

 import (
 	"fmt"
 	"net/http"
-	"net/url"
 	"strings"
 	"gitbay.org/gitbay/internal/gitutil"
 	s.render(w, "settings.html", settingsPage{
 		repoPage: p, Topics: topics, Branches: branches,
 		DepsEnabled: depsErr == nil,
-		Notice:      r.URL.Query().Get("e"),
+		Notice:      s.takeFlash(w, r),
 	})
 }
 func (s *Server) settingsRedirect(w http.ResponseWriter, r *http.Request, msg string) {
 	dest := fmt.Sprintf("/%s/%s/settings", r.PathValue("owner"), r.PathValue("repo"))
-	if msg != "" {
+	s.setFlash(w, msg)
-		if len(msg) > 300 {
-			msg = msg[:300]
-		}
-		dest += "?e=" + url.QueryEscape(msg)
-	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }

internal/httpd/web.go +4 −4

	@@ -469,7 +469,7 @@ func (s Server) ownerPage(w http.ResponseWriter, r http.Request) {
469	Notice string	469	Notice string
470	}{s.baseFor(viewer), name, d.Kind, profile, aboutHTML(profile),	470	}{s.baseFor(viewer), name, d.Kind, profile, aboutHTML(profile),
471	d.Repos, d.Members, d.Orgs,	471	d.Repos, d.Members, d.Orgs,
472	weeks, activityTotal, teams, canAdmin, r.URL.Query().Get("e")})	472	weeks, activityTotal, teams, canAdmin, s.takeFlash(w, r)})
473	}	473	}
474		474
475	func (s Server) repoHome(w http.ResponseWriter, r http.Request) {	475	func (s Server) repoHome(w http.ResponseWriter, r http.Request) {
	@@ -665,7 +665,7 @@ func (s Server) releases(w http.ResponseWriter, r http.Request) {
665	FreeTags []string	665	FreeTags []string
666	CanWrite bool	666	CanWrite bool
667	Notice string	667	Notice string
668	}{p, views, freeTags, s.canWriteRepo(r, p.Repo), r.URL.Query().Get("e")})	668	}{p, views, freeTags, s.canWriteRepo(r, p.Repo), s.takeFlash(w, r)})
669	}	669	}
670		670
671	// releaseAsset streams one uploaded asset. Tags containing '/' are not	671	// releaseAsset streams one uploaded asset. Tags containing '/' are not
	@@ -1640,7 +1640,7 @@ func (s Server) issue(w http.ResponseWriter, r http.Request) {
1640	LabelColors map[string]template.CSS	1640	LabelColors map[string]template.CSS
1641	}{p, iss, md(iss.Body, iss.BodyFormat), renderComments(comments, md),	1641	}{p, iss, md(iss.Body, iss.BodyFormat), renderComments(comments, md),
1642	s.canEditItem(r, p.Repo, iss.Author), s.canWriteRepo(r, p.Repo),	1642	s.canEditItem(r, p.Repo, iss.Author), s.canWriteRepo(r, p.Repo),
1643	milestones, r.URL.Query().Get("e"), s.labelColors(p.Repo.ID)})	1643	milestones, s.takeFlash(w, r), s.labelColors(p.Repo.ID)})
1644	}	1644	}
1645		1645
1646	// canEditItem: the author or anyone with write access may edit.	1646	// canEditItem: the author or anyone with write access may edit.
	@@ -1817,7 +1817,7 @@ func (s Server) mr(w http.ResponseWriter, r http.Request) {
1817	Stacked []store.MR	1817	Stacked []store.MR
1818	}{p, m, view, md(m.Body, m.BodyFormat), checks, combined, renderComments(comments, md),	1818	}{p, m, view, md(m.Body, m.BodyFormat), checks, combined, renderComments(comments, md),
1819	reviews, files, diffTruncated, stat, commits, commitsTotal, branches, s.canEditItem(r, p.Repo, m.Author),	1819	reviews, files, diffTruncated, stat, commits, commitsTotal, branches, s.canEditItem(r, p.Repo, m.Author),
1820	canWrite, unresolved, r.URL.Query().Get("e"), detachedThreads, stackedOn, stacked})	1820	canWrite, unresolved, s.takeFlash(w, r), detachedThreads, stackedOn, stacked})
1821	}	1821	}
1822		1822
1823	func (s Server) refs(w http.ResponseWriter, r http.Request) {	1823	func (s Server) refs(w http.ResponseWriter, r http.Request) {

Commit 15961c4783

Commit `15961c4783`