From 2b36bdd4902aa7ee93e15eee961d6a8a4a26e81c Mon Sep 17 00:00:00 2001 From: zeripath Date: Sat, 12 Jan 2019 19:24:47 +0000 Subject: [PATCH] Do not display the raw OpenID error in the UI (#5705) * Do not display the raw OpenID error in the UI If there are no `WHITELIST_URIS` or `BLACKLIST_URIS` set in the openid section of the app.ini, it is possible that gitea can leak sensitive information about the local network through the error provided by the UI. This PR hides the error information and logs it. Fix #4973 Signed-off-by: Andrew Thornton * Update auth_openid.go Place error log within the `err != nil` branch. --- routers/user/auth_openid.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/routers/user/auth_openid.go b/routers/user/auth_openid.go index 2c5c36a3b..b0e9092c7 100644 --- a/routers/user/auth_openid.go +++ b/routers/user/auth_openid.go @@ -115,7 +115,8 @@ func SignInOpenIDPost(ctx *context.Context, form auth.SignInOpenIDForm) { redirectTo := setting.AppURL + "user/login/openid" url, err := openid.RedirectURL(id, redirectTo, setting.AppURL) if err != nil { - ctx.RenderWithErr(err.Error(), tplSignInOpenID, &form) + log.Error(1, "Error in OpenID redirect URL: %s, %v", redirectTo, err.Error()) + ctx.RenderWithErr(fmt.Sprintf("Unable to find OpenID provider in %s", redirectTo), tplSignInOpenID, &form) return }