From 303fc7490d9ecf3c8ee0f012877ee8c853680b5d Mon Sep 17 00:00:00 2001
From: PineBale <272794187+PineBale@users.noreply.github.com>
Date: Wed, 22 Apr 2026 14:15:06 +0800
Subject: [PATCH 1/4] l

---
 routers/web/shared/user/block.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routers/web/shared/user/block.go b/routers/web/shared/user/block.go
index 8a2357623f195..fdd3a995b92d5 100644
--- a/routers/web/shared/user/block.go
+++ b/routers/web/shared/user/block.go
@@ -37,7 +37,7 @@ func BlockedUsersPost(ctx *context.Context, blocker *user_model.User) {
 
 	blockee, err := user_model.GetUserByName(ctx, form.Blockee)
 	if err != nil {
-		ctx.ServerError("GetUserByName", nil)
+		ctx.ServerError("GetUserByName", err)
 		return
 	}
 

From 6fa7f2aa45294794986e2224a4e5b8b433b46d7c Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 22 Apr 2026 15:36:08 +0800
Subject: [PATCH 2/4] fix

---
 models/user/block.go              |  2 +-
 routers/web/org/block.go          | 12 +-----
 routers/web/shared/user/block.go  | 72 ++++++++++++++++++-------------
 routers/web/user/setting/block.go |  7 +--
 4 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/models/user/block.go b/models/user/block.go
index f4afd47d0f70d..03f984a8fdf4a 100644
--- a/models/user/block.go
+++ b/models/user/block.go
@@ -90,7 +90,7 @@ func GetBlocking(ctx context.Context, blockerID, blockeeID int64) (*Blocking, er
 		return nil, err
 	}
 	if len(blocks) == 0 {
-		return nil, nil //nolint:nilnil // return nil to indicate that the object does not exist
+		return nil, util.NewNotExistErrorf("blocking record doesn't exist")
 	}
 	return blocks[0], nil
 }
diff --git a/routers/web/org/block.go b/routers/web/org/block.go
index 60f722dd3926c..e728e4dce5a51 100644
--- a/routers/web/org/block.go
+++ b/routers/web/org/block.go
@@ -34,15 +34,5 @@ func BlockedUsers(ctx *context.Context) {
 }
 
 func BlockedUsersPost(ctx *context.Context) {
-	if _, err := shared_user.RenderUserOrgHeader(ctx); err != nil {
-		ctx.ServerError("RenderUserOrgHeader", err)
-		return
-	}
-
-	shared_user.BlockedUsersPost(ctx, ctx.ContextUser)
-	if ctx.Written() {
-		return
-	}
-
-	ctx.Redirect(ctx.ContextUser.OrganisationLink() + "/settings/blocked_users")
+	shared_user.BlockedUsersPost(ctx, ctx.ContextUser, ctx.ContextUser.OrganisationLink()+"/settings/blocked_users")
 }
diff --git a/routers/web/shared/user/block.go b/routers/web/shared/user/block.go
index fdd3a995b92d5..599d71c89e618 100644
--- a/routers/web/shared/user/block.go
+++ b/routers/web/shared/user/block.go
@@ -7,6 +7,8 @@ import (
 	"errors"
 
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/services/context"
 	"code.gitea.io/gitea/services/forms"
@@ -28,49 +30,57 @@ func BlockedUsers(ctx *context.Context, blocker *user_model.User) {
 	ctx.Data["UserBlocks"] = blocks
 }
 
-func BlockedUsersPost(ctx *context.Context, blocker *user_model.User) {
-	form := web.GetForm(ctx).(*forms.BlockUserForm)
-	if ctx.HasError() {
-		ctx.ServerError("FormValidation", nil)
-		return
-	}
-
+func blockedUsersPost(ctx *context.Context, form *forms.BlockUserForm, blocker *user_model.User) error {
 	blockee, err := user_model.GetUserByName(ctx, form.Blockee)
 	if err != nil {
-		ctx.ServerError("GetUserByName", err)
-		return
+		return err
 	}
 
 	switch form.Action {
 	case "block":
-		if err := user_service.BlockUser(ctx, ctx.Doer, blocker, blockee, form.Note); err != nil {
-			if errors.Is(err, user_model.ErrCanNotBlock) || errors.Is(err, user_model.ErrBlockOrganization) {
-				ctx.Flash.Error(ctx.Tr("user.block.block.failure", err.Error()))
-			} else {
-				ctx.ServerError("BlockUser", err)
-				return
-			}
+		err = user_service.BlockUser(ctx, ctx.Doer, blocker, blockee, form.Note)
+		if errors.Is(err, util.ErrInvalidArgument) {
+			return util.ErrorWrapTranslatable(err, "user.block.block.failure", err.Error())
 		}
+		return err
 	case "unblock":
-		if err := user_service.UnblockUser(ctx, ctx.Doer, blocker, blockee); err != nil {
-			if errors.Is(err, user_model.ErrCanNotUnblock) || errors.Is(err, user_model.ErrBlockOrganization) {
-				ctx.Flash.Error(ctx.Tr("user.block.unblock.failure", err.Error()))
-			} else {
-				ctx.ServerError("UnblockUser", err)
-				return
-			}
+		err = user_service.UnblockUser(ctx, ctx.Doer, blocker, blockee)
+		if errors.Is(err, util.ErrInvalidArgument) {
+			return util.ErrorWrapTranslatable(err, "user.block.unblock.failure", err.Error())
 		}
+		return err
 	case "note":
 		block, err := user_model.GetBlocking(ctx, blocker.ID, blockee.ID)
 		if err != nil {
-			ctx.ServerError("GetBlocking", err)
-			return
-		}
-		if block != nil {
-			if err := user_model.UpdateBlockingNote(ctx, block.ID, form.Note); err != nil {
-				ctx.ServerError("UpdateBlockingNote", err)
-				return
-			}
+			return err
 		}
+		return user_model.UpdateBlockingNote(ctx, block.ID, form.Note)
+	}
+	setting.PanicInDevOrTesting("Unknown action: %q", form.Action)
+	return errors.New("unknown action")
+}
+
+func BlockedUsersPost(ctx *context.Context, blocker *user_model.User, redirect string) {
+	// TODO: can refactor to "form-fetch-action" in the future
+	flashErrorRedirect := func(msg any) {
+		ctx.Flash.Error(msg)
+		ctx.Redirect(redirect)
+	}
+
+	if ctx.HasError() {
+		flashErrorRedirect(ctx.GetErrMsg())
+		return
+	}
+
+	form := web.GetForm(ctx).(*forms.BlockUserForm)
+	err := blockedUsersPost(ctx, form, blocker)
+	if err == nil {
+		ctx.Redirect(redirect)
+	} else if errTr := util.ErrorAsTranslatable(err); errTr != nil {
+		flashErrorRedirect(errTr.Translate(ctx.Locale))
+	} else if errors.Is(err, util.ErrNotExist) {
+		flashErrorRedirect(ctx.Locale.Tr("error.not_found"))
+	} else {
+		ctx.ServerError("BlockedUsersPost", err)
 	}
 }
diff --git a/routers/web/user/setting/block.go b/routers/web/user/setting/block.go
index 3a1625ccf9bc9..1376c0417d0ec 100644
--- a/routers/web/user/setting/block.go
+++ b/routers/web/user/setting/block.go
@@ -29,10 +29,5 @@ func BlockedUsers(ctx *context.Context) {
 }
 
 func BlockedUsersPost(ctx *context.Context) {
-	shared_user.BlockedUsersPost(ctx, ctx.Doer)
-	if ctx.Written() {
-		return
-	}
-
-	ctx.Redirect(setting.AppSubURL + "/user/settings/blocked_users")
+	shared_user.BlockedUsersPost(ctx, ctx.Doer, setting.AppSubURL+"/user/settings/blocked_users")
 }

From dfbdef1b686ff28ee8b956c05d70568bac80c56d Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 22 Apr 2026 15:42:04 +0800
Subject: [PATCH 3/4] use form-fetch-action

---
 routers/web/shared/user/block.go         | 14 ++++----------
 templates/shared/user/blocked_users.tmpl | 18 +++++++++---------
 2 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/routers/web/shared/user/block.go b/routers/web/shared/user/block.go
index 599d71c89e618..beb8832da174e 100644
--- a/routers/web/shared/user/block.go
+++ b/routers/web/shared/user/block.go
@@ -61,25 +61,19 @@ func blockedUsersPost(ctx *context.Context, form *forms.BlockUserForm, blocker *
 }
 
 func BlockedUsersPost(ctx *context.Context, blocker *user_model.User, redirect string) {
-	// TODO: can refactor to "form-fetch-action" in the future
-	flashErrorRedirect := func(msg any) {
-		ctx.Flash.Error(msg)
-		ctx.Redirect(redirect)
-	}
-
 	if ctx.HasError() {
-		flashErrorRedirect(ctx.GetErrMsg())
+		ctx.JSONError(ctx.GetErrMsg())
 		return
 	}
 
 	form := web.GetForm(ctx).(*forms.BlockUserForm)
 	err := blockedUsersPost(ctx, form, blocker)
 	if err == nil {
-		ctx.Redirect(redirect)
+		ctx.JSONRedirect(redirect)
 	} else if errTr := util.ErrorAsTranslatable(err); errTr != nil {
-		flashErrorRedirect(errTr.Translate(ctx.Locale))
+		ctx.JSONError(errTr.Translate(ctx.Locale))
 	} else if errors.Is(err, util.ErrNotExist) {
-		flashErrorRedirect(ctx.Locale.Tr("error.not_found"))
+		ctx.JSONError(ctx.Locale.Tr("error.not_found"))
 	} else {
 		ctx.ServerError("BlockedUsersPost", err)
 	}
diff --git a/templates/shared/user/blocked_users.tmpl b/templates/shared/user/blocked_users.tmpl
index 7a6a5a3afa452..0ec4e80ce2347 100644
--- a/templates/shared/user/blocked_users.tmpl
+++ b/templates/shared/user/blocked_users.tmpl
@@ -13,8 +13,8 @@
 	</ul>
 </div>
 <div class="ui segment">
-	<form class="ui form ignore-dirty" action="{{$.Link}}" method="post">
-		<input type="hidden" name="action" value="block" />
+	<form class="ui form form-fetch-action ignore-dirty" action="{{$.Link}}" method="post">
+		<input type="hidden" name="action" value="block">
 		<div id="search-user-box" class="field ui fluid search input">
 			<input class="prompt tw-mr-2" name="blockee" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" required>
 			<button class="ui red button">{{ctx.Locale.Tr "user.block.block"}}</button>
@@ -48,9 +48,9 @@
 				</div>
 				<div class="flex-item-trailing">
 					<button class="ui compact mini button show-modal" data-modal="#block-user-note-modal" data-modal-modal-blockee="{{.Blockee.Name}}" data-modal-modal-note="{{.Note}}">{{ctx.Locale.Tr "user.block.note.edit"}}</button>
-					<form action="{{$.Link}}" method="post">
-						<input type="hidden" name="action" value="unblock" />
-						<input type="hidden" name="blockee" value="{{.Blockee.Name}}" />
+					<form class="form-fetch-action" action="{{$.Link}}" method="post">
+						<input type="hidden" name="action" value="unblock">
+						<input type="hidden" name="blockee" value="{{.Blockee.Name}}">
 						<button class="ui compact mini button">{{ctx.Locale.Tr "user.block.unblock"}}</button>
 					</form>
 				</div>
@@ -63,12 +63,12 @@
 <div class="ui small modal" id="block-user-note-modal">
 	<div class="header">{{ctx.Locale.Tr "user.block.note.edit"}}</div>
 	<div class="content">
-		<form class="ui form" action="{{$.Link}}" method="post">
-			<input type="hidden" name="action" value="note" />
-			<input type="hidden" name="blockee" class="modal-blockee" />
+		<form class="ui form form-fetch-action" action="{{$.Link}}" method="post">
+			<input type="hidden" name="action" value="note">
+			<input type="hidden" name="blockee" class="modal-blockee">
 			<div class="field">
 				<label>{{ctx.Locale.Tr "user.block.note.title"}}</label>
-				<input name="note" class="modal-note" />
+				<input name="note" class="modal-note">
 				<p class="help">{{ctx.Locale.Tr "user.block.note.info"}}</p>
 			</div>
 			<div class="actions">

From 8c7018c3e98544573a17afb4ef0bb0c4d6db284e Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 22 Apr 2026 16:13:01 +0800
Subject: [PATCH 4/4] fix legacy code

---
 routers/api/v1/shared/block.go    | 16 +++++++---------
 routers/web/shared/user/header.go |  6 +++---
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/routers/api/v1/shared/block.go b/routers/api/v1/shared/block.go
index 5762c5abf1734..dfffe72bf0619 100644
--- a/routers/api/v1/shared/block.go
+++ b/routers/api/v1/shared/block.go
@@ -9,6 +9,7 @@ import (
 
 	user_model "code.gitea.io/gitea/models/user"
 	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers/api/v1/utils"
 	"code.gitea.io/gitea/services/context"
 	"code.gitea.io/gitea/services/convert"
@@ -48,17 +49,14 @@ func CheckUserBlock(ctx *context.APIContext, blocker *user_model.User) {
 		return
 	}
 
-	status := http.StatusNotFound
-	blocking, err := user_model.GetBlocking(ctx, blocker.ID, blockee.ID)
-	if err != nil {
+	_, err = user_model.GetBlocking(ctx, blocker.ID, blockee.ID)
+	if errors.Is(err, util.ErrNotExist) {
+		ctx.Status(http.StatusNotFound)
+	} else if err == nil {
+		ctx.Status(http.StatusNoContent)
+	} else {
 		ctx.APIErrorInternal(err)
-		return
 	}
-	if blocking != nil {
-		status = http.StatusNoContent
-	}
-
-	ctx.Status(status)
 }
 
 func BlockUser(ctx *context.APIContext, blocker *user_model.User) {
diff --git a/routers/web/shared/user/header.go b/routers/web/shared/user/header.go
index 2ba45fc5a7dd0..b1ff9db7a284b 100644
--- a/routers/web/shared/user/header.go
+++ b/routers/web/shared/user/header.go
@@ -4,6 +4,7 @@
 package user
 
 import (
+	"errors"
 	"net/url"
 
 	"code.gitea.io/gitea/models/db"
@@ -83,10 +84,9 @@ func prepareContextForProfileBigAvatar(ctx *context.Context) {
 	}
 
 	if ctx.Doer != nil {
-		if block, err := user_model.GetBlocking(ctx, ctx.Doer.ID, ctx.ContextUser.ID); err != nil {
+		ctx.Data["UserBlocking"], err = user_model.GetBlocking(ctx, ctx.Doer.ID, ctx.ContextUser.ID)
+		if err != nil && !errors.Is(err, util.ErrNotExist) {
 			ctx.ServerError("GetBlocking", err)
-		} else {
-			ctx.Data["UserBlocking"] = block
 		}
 	}
 }