Skip to content

Fix WebAuthn error checking (#36219)#36235

Merged
silverwind merged 3 commits intogo-gitea:release/v1.25from
silverwind:backport-36219
Jan 6, 2026
Merged

Fix WebAuthn error checking (#36219)#36235
silverwind merged 3 commits intogo-gitea:release/v1.25from
silverwind:backport-36219

Conversation

@silverwind
Copy link
Copy Markdown
Member

@silverwind silverwind commented Dec 23, 2025

Backport of #36219
Fixes: #36216

Now detectWebAuthnSupport returns the error type and lets the caller decide whether they call webAuthnError and show the error. It no longer shows the error during page load when the user has not even interacted with the feature.

The bug affects all users on HTTP, so I think a quick fix release for this might be good.

@silverwind
Fix WebAuthn error checking (go-gitea#36219)
5a0564b 
Fixes: go-gitea#36216

Now `detectWebAuthnSupport` returns the error type and lets the caller
decide whether they call `webAuthnError` and show the error. It no
longer shows the error during page load when the user has not even
interacted with the feature.

The bug affects all users on HTTP, so I think a quick fix release for
this might be good.
@GiteaBot GiteaBot added this to the 1.25.4 milestone Dec 23, 2025
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 23, 2025
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Dec 24, 2025
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Dec 24, 2025
@lafriks
Copy link
Copy Markdown
Member

lafriks commented Dec 24, 2025

Merge conflict

@wxiaoguang
Copy link
Copy Markdown
Contributor

wxiaoguang commented Dec 24, 2025

Is it safe to backport so many unnecessary reafctoring changes?

Can the backport be as simple as reverting the last change?

@wxiaoguang wxiaoguang marked this pull request as draft December 24, 2025 07:48
@silverwind
Copy link
Copy Markdown
Member Author

silverwind commented Dec 24, 2025

This is definitely neccessary because all instances that use HTTP or old browsers will see the error on the login page.

Reverting to the old code would only partially work because if window.PublicKeyCredential is undefined, the wrong error would still be shown.

I have sufficiently tested this to believe this is correct.

@wxiaoguang wxiaoguang marked this pull request as ready for review December 24, 2025 14:12
@silverwind silverwind added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Dec 24, 2025
@silverwind silverwind enabled auto-merge (squash) December 24, 2025 14:29
@lunny
Copy link
Copy Markdown
Member

lunny commented Dec 26, 2025

Please resolve the conflict.

@GiteaBot
Copy link
Copy Markdown
Collaborator

GiteaBot commented Dec 27, 2025

@silverwind please fix the merge conflicts. 🍵

@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Dec 27, 2025
@wxiaoguang
Merge branch 'release/v1.25' into backport-36219
74c19c0 
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
@wxiaoguang
Copy link
Copy Markdown
Contributor

wxiaoguang commented Jan 6, 2026

OK, I resolved the conflicts.

@silverwind silverwind merged commit 39e83bd into go-gitea:release/v1.25 Jan 6, 2026
26 checks passed
@wxiaoguang wxiaoguang deleted the backport-36219 branch January 6, 2026 04:58
chudnyi pushed a commit to integratop/helm-gitea-mirror that referenced this pull request Mar 25, 2026
@lunny
chore(deps): update dependency go-gitea/gitea to v1.25.4 (#1012)
19bc25f 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [go-gitea/gitea](https://github.com/go-gitea/gitea) | patch | `1.25.3` -> `1.25.4` |

---

### Release Notes

<details>
<summary>go-gitea/gitea (go-gitea/gitea)</summary>

### [`v1.25.4`](https://github.com/go-gitea/gitea/releases/tag/v1.25.4)

[Compare Source](go-gitea/gitea@v1.25.3...v1.25.4)

- SECURITY
  - Release attachments must belong to the intended repo ([#&#8203;36347](go-gitea/gitea#36347)) ([#&#8203;36375](go-gitea/gitea#36375))
  - Fix permission check on org project operations ([#&#8203;36318](go-gitea/gitea#36318)) ([#&#8203;36373](go-gitea/gitea#36373))
  - Clean watches when make a repository private and check permission when send release emails ([#&#8203;36319](go-gitea/gitea#36319)) ([#&#8203;36370](go-gitea/gitea#36370))
  - Add more check for stopwatch read or list ([#&#8203;36340](go-gitea/gitea#36340)) ([#&#8203;36368](go-gitea/gitea#36368))
  - Fix openid setting check ([#&#8203;36346](go-gitea/gitea#36346)) ([#&#8203;36361](go-gitea/gitea#36361))
  - Fix cancel auto merge bug ([#&#8203;36341](go-gitea/gitea#36341)) ([#&#8203;36356](go-gitea/gitea#36356))
  - Fix delete attachment check ([#&#8203;36320](go-gitea/gitea#36320)) ([#&#8203;36355](go-gitea/gitea#36355))
  - LFS locks must belong to the intended repo ([#&#8203;36344](go-gitea/gitea#36344)) ([#&#8203;36349](go-gitea/gitea#36349))
  - Fix bug on notification read ([#&#8203;36339](go-gitea/gitea#36339)) [#&#8203;36387](go-gitea/gitea#36387)

- ENHANCEMENTS
  - Add more routes to the "expensive" list ([#&#8203;36290](go-gitea/gitea#36290))
  - Make "commit statuses" API accept slashes in "ref" ([#&#8203;36264](go-gitea/gitea#36264)) ([#&#8203;36275](go-gitea/gitea#36275))

- BUGFIXES
  - Fix markdown newline handling during IME composition ([#&#8203;36421](go-gitea/gitea#36421)) [#&#8203;36424](go-gitea/gitea#36424)
  - Fix missing repository id when migrating release attachments ([#&#8203;36389](go-gitea/gitea#36389))
  - Fix bug when compare in the pull request ([#&#8203;36363](go-gitea/gitea#36363)) ([#&#8203;36372](go-gitea/gitea#36372))
  - Fix incorrect text content detection ([#&#8203;36364](go-gitea/gitea#36364)) ([#&#8203;36369](go-gitea/gitea#36369))
  - Fill missing `has_code` in repository api ([#&#8203;36338](go-gitea/gitea#36338)) ([#&#8203;36359](go-gitea/gitea#36359))
  - Fix notifications pagination query parameters ([#&#8203;36351](go-gitea/gitea#36351)) ([#&#8203;36358](go-gitea/gitea#36358))
  - Fix some trivial problems ([#&#8203;36336](go-gitea/gitea#36336)) ([#&#8203;36337](go-gitea/gitea#36337))
  - Prevent panic when GitLab release has more links than sources ([#&#8203;36295](go-gitea/gitea#36295)) ([#&#8203;36305](go-gitea/gitea#36305))
  - Fix stats bug when syncing release ([#&#8203;36285](go-gitea/gitea#36285)) ([#&#8203;36294](go-gitea/gitea#36294))
  - Always honor user's choice for "delete branch after merge" ([#&#8203;36281](go-gitea/gitea#36281)) ([#&#8203;36286](go-gitea/gitea#36286))
  - Use the requested host for LFS links ([#&#8203;36242](go-gitea/gitea#36242)) ([#&#8203;36258](go-gitea/gitea#36258))
  - Fix panic when get editor config file ([#&#8203;36241](go-gitea/gitea#36241)) ([#&#8203;36247](go-gitea/gitea#36247))
  - Fix regression in writing authorized principals ([#&#8203;36213](go-gitea/gitea#36213)) ([#&#8203;36218](go-gitea/gitea#36218))
  - Fix WebAuthn error checking ([#&#8203;36219](go-gitea/gitea#36219)) ([#&#8203;36235](go-gitea/gitea#36235))

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

</details>

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xOC4xIiwidXBkYXRlZEluVmVyIjoiNDEuMTguMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsia2luZC9kZXBlbmRlbmN5Il19-->

Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1012
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
Co-committed-by: Renovate Bot <renovate-bot@gitea.com>
@go-gitea go-gitea locked as resolved and limited conversation to collaborators Apr 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lunny lunny lunny approved these changes

@lafriks lafriks lafriks approved these changes

@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/frontend

Projects

None yet

Milestone

1.25.4

Development

Successfully merging this pull request may close these issues.

5 participants

@silverwind @lafriks @wxiaoguang @lunny @GiteaBot