web: fix panic when download attachments (#5838)

gogs.go

@@ -16,7 +16,7 @@ import (
 	"gogs.io/gogs/internal/setting"
 )
 
-const Version = "0.11.95.1024"
+const Version = "0.11.96.1024"
 
 func init() {
 	setting.AppVer = Version

internal/cmd/web.go

@@ -7,6 +7,7 @@ package cmd
 import (
 	"crypto/tls"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -322,16 +323,16 @@ func runWeb(c *cli.Context) error {
 
 			fr, err := os.Open(attach.LocalPath())
 			if err != nil {
-				c.Handle(500, "Open", err)
+				c.ServerError("open attachment file", err)
 				return
 			}
 			defer fr.Close()
 
 			c.Header().Set("Cache-Control", "public,max-age=86400")
-			fmt.Println("attach.Name:", attach.Name)
 			c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name))
-			if err = repo.ServeData(c, attach.Name, fr); err != nil {
-				c.Handle(500, "ServeData", err)
+
+			if _, err = io.Copy(c.Resp, fr); err != nil {
+				c.ServerError("copy from file to response", err)
 				return
 			}
 		})

internal/context/context.go

@@ -167,13 +167,13 @@ func (c *Context) RenderWithErr(msg, tpl string, f interface{}) {
 }
 
 // Handle handles and logs error by given status.
-func (c *Context) Handle(status int, title string, err error) {
+func (c *Context) Handle(status int, msg string, err error) {
 	switch status {
 	case http.StatusNotFound:
 		c.Data["Title"] = "Page Not Found"
 	case http.StatusInternalServerError:
 		c.Data["Title"] = "Internal Server Error"
-		log.Error(3, "%s: %v", title, err)
+		log.Error(3, "%s: %v", msg, err)
 		if !setting.ProdMode || (c.IsLogged && c.User.IsAdmin) {
 			c.Data["ErrorMsg"] = err
 		}
@@ -187,23 +187,23 @@ func (c *Context) NotFound() {
 }
 
 // ServerError renders the 500 page.
-func (c *Context) ServerError(title string, err error) {
-	c.Handle(http.StatusInternalServerError, title, err)
+func (c *Context) ServerError(msg string, err error) {
+	c.Handle(http.StatusInternalServerError, msg, err)
 }
 
 // NotFoundOrServerError use error check function to determine if the error
 // is about not found. It responses with 404 status code for not found error,
 // or error context description for logging purpose of 500 server error.
-func (c *Context) NotFoundOrServerError(title string, errck func(error) bool, err error) {
+func (c *Context) NotFoundOrServerError(msg string, errck func(error) bool, err error) {
 	if errck(err) {
 		c.NotFound()
 		return
 	}
-	c.ServerError(title, err)
+	c.ServerError(msg, err)
 }
 
-func (c *Context) HandleText(status int, title string) {
-	c.PlainText(status, []byte(title))
+func (c *Context) HandleText(status int, msg string) {
+	c.PlainText(status, []byte(msg))
 }
 
 func (c *Context) ServeContent(name string, r io.ReadSeeker, params ...interface{}) {

internal/route/api/v1/repo/file.go

@@ -6,10 +6,10 @@ package repo
 
 import (
 	"github.com/gogs/git-module"
-	repo2 "gogs.io/gogs/internal/route/repo"
 
 	"gogs.io/gogs/internal/context"
 	"gogs.io/gogs/internal/db"
+	"gogs.io/gogs/internal/route/repo"
 )
 
 func GetRawFile(c *context.APIContext) {
@@ -28,7 +28,7 @@ func GetRawFile(c *context.APIContext) {
 		c.NotFoundOrServerError("GetBlobByPath", git.IsErrNotExist, err)
 		return
 	}
-	if err = repo2.ServeBlob(c.Context, blob); err != nil {
+	if err = repo.ServeBlob(c.Context, blob); err != nil {
 		c.ServerError("ServeBlob", err)
 	}
 }
@@ -42,7 +42,7 @@ func GetArchive(c *context.APIContext) {
 	}
 	c.Repo.GitRepo = gitRepo
 
-	repo2.Download(c.Context)
+	repo.Download(c.Context)
 }
 
 func GetEditorconfig(c *context.APIContext) {

internal/route/repo/download.go

@@ -17,9 +17,9 @@ import (
 	"gogs.io/gogs/internal/tool"
 )
 
-func ServeData(c *context.Context, name string, reader io.Reader) error {
+func serveData(c *context.Context, name string, r io.Reader) error {
 	buf := make([]byte, 1024)
-	n, _ := reader.Read(buf)
+	n, _ := r.Read(buf)
 	if n >= 0 {
 		buf = buf[:n]
 	}
@@ -38,8 +38,11 @@ func ServeData(c *context.Context, name string, reader io.Reader) error {
 	} else if !setting.Repository.EnableRawFileRenderMode || !c.QueryBool("render") {
 		c.Resp.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	}
-	c.Resp.Write(buf)
-	_, err = io.Copy(c.Resp, reader)
+
+	if _, err := c.Resp.Write(buf); err != nil {
+		return fmt.Errorf("write buffer to response: %v", err)
+	}
+	_, err = io.Copy(c.Resp, r)
 	return err
 }
 
@@ -49,7 +52,7 @@ func ServeBlob(c *context.Context, blob *git.Blob) error {
 		return err
 	}
 
-	return ServeData(c, path.Base(c.Repo.TreePath), dataRc)
+	return serveData(c, path.Base(c.Repo.TreePath), dataRc)
 }
 
 func SingleDownload(c *context.Context) {

templates/.VERSION

@@ -1 +1 @@
-0.11.95.1024
+0.11.96.1024