mirror of
https://github.com/go-gitea/gitea.git
synced 2026-07-15 20:40:52 +09:00
Lovepreet Singh
65c5a5ff7b
Fixes #38217 ## Problem Turnstile CAPTCHA verification uses `http.DefaultClient`, so the request to `challenges.cloudflare.com` bypasses Gitea's configured HTTP proxy — unlike other outbound HTTP clients such as the update checker (`modules/updatechecker/update_checker.go`) and migrations. In deployments where egress is only permitted through the configured proxy, verification fails. ## Fix Build the client with `proxy.Proxy()` as the transport proxy, mirroring the update checker: ```go func httpClient() *http.Client { return &http.Client{ Transport: &http.Transport{ Proxy: proxy.Proxy(), }, } } ``` The client is built per call (rather than a package-level var) because `proxy.Proxy()` reads `setting.Proxy` when invoked; building it at request time ensures it reflects the loaded settings. When no proxy is configured, behavior is unchanged (`proxy.Proxy()` returns a no-op / `http.ProxyFromEnvironment`). --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package turnstile
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/test"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestHTTPClientHonorsProxy(t *testing.T) {
|
|
proxyURL, err := url.Parse("http://proxy.example.com:3128")
|
|
require.NoError(t, err)
|
|
|
|
defer test.MockVariableValue(&setting.Proxy.Enabled, true)()
|
|
defer test.MockVariableValue(&setting.Proxy.ProxyURL, proxyURL.String())()
|
|
defer test.MockVariableValue(&setting.Proxy.ProxyURLFixed, proxyURL)()
|
|
defer test.MockVariableValue(&setting.Proxy.ProxyHosts, []string{"**"})()
|
|
httpClient.Reset()
|
|
transport, ok := httpClient.Value().Transport.(*http.Transport)
|
|
require.True(t, ok)
|
|
require.NotNil(t, transport.Proxy)
|
|
|
|
// The Turnstile verification request must be routed through the configured proxy.
|
|
req := httptest.NewRequest(http.MethodPost, "https://any.example.com", nil)
|
|
got, err := transport.Proxy(req)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, got)
|
|
assert.Equal(t, proxyURL.String(), got.String())
|
|
}
|