Do not display the raw OpenID error in the UI (#5705)

* Do not display the raw OpenID error in the UI If there are no `WHITELIST_URIS` or `BLACKLIST_URIS` set in the openid section of the app.ini, it is possible that gitea can leak sensitive information about the local network through the error provided by the UI. This PR hides the error information and logs it. Fix #4973 Signed-off-by: Andrew Thornton <[email protected]> * Update auth_openid.go Place error log within the `err != nil` branch.
go-gitea · Jan 12, 2019 · 2b36bdd · 2b36bdd
1 parent bf7a112
commit 2b36bdd
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/routers/user/auth_openid.go b/routers/user/auth_openid.go
@@ -115,7 +115,8 @@ func SignInOpenIDPost(ctx *context.Context, form auth.SignInOpenIDForm) {
  redirectTo := setting.AppURL + "user/login/openid"
  url, err := openid.RedirectURL(id, redirectTo, setting.AppURL)
  if err != nil {
- ctx.RenderWithErr(err.Error(), tplSignInOpenID, &form)
+ log.Error(1, "Error in OpenID redirect URL: %s, %v", redirectTo, err.Error())
+ ctx.RenderWithErr(fmt.Sprintf("Unable to find OpenID provider in %s", redirectTo), tplSignInOpenID, &form)
  return
  }