{"record":{"id":"35dbbea415252203","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-35dbbe","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/issue/CommentedByMeCriteria.java","lineNumber":36,"sourceCode":"import io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class CommentedByMeCriteria extends Criteria<Issue> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Issue, Issue> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tSubquery<IssueComment> commentQuery = query.subquery(IssueComment.class);\n\t\t\tRoot<IssueComment> comment = commentQuery.from(IssueComment.class);\n\t\t\tcommentQuery.select(comment);\n\t\t\tcommentQuery.where(builder.and(\n\t\t\t\t\tbuilder.equal(comment.get(IssueComment.PROP_ISSUE), from),\n\t\t\t\t\tbuilder.equal(comment.get(IssueComment.PROP_USER), User.get())));\n\t\t\treturn builder.exists(commentQuery);\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean matches(Issue issue) {\n\t\tif (User.get() != null)\n\t\t\treturn issue.getComments().stream().anyMatch(it->it.getUser().equals(User.get()));\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn IssueQuery.getRuleName(IssueQueryLexer.CommentedByMe);\n\t}\n\n}\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/issue/CommentedByMeCriteria.java#L18-L54","documentation":"CommentedByMeCriteria.getPredicate() builds a JPA EXISTS subquery checking whether the current user commented on an issue. Since 'me' depends on the authenticated user, it throws NotAcceptableException('Please login to perform this query') when User.get() is null.","triggerScenarios":"Executing an issue query containing '~commented by me~' through the DB predicate path with no authenticated user: anonymous REST/GraphQL call, background process, or server-side evaluation without a user bound.","commonSituations":"Integrations calling issue search without tokens; CI scripts querying issues anonymously; email/webhook handlers that forgot to set user context.","solutions":["Authenticate the request (session or personal access token) before running the query.","Set a user context for system-driven query execution.","Use '~commented by \"username\"~' instead of the user-relative operator when unauthenticated.","Catch NotAcceptableException and respond with an authentication prompt."],"exampleFix":"// before\nList<Issue> issues = issueQueryManager.find(null, \"~commented by me~\");\n\n// after\nif (User.get() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");\nList<Issue> issues = issueQueryManager.find(null, \"~commented by me~\");","handlingStrategy":"validation","validationCode":"if (User.get() == null) throw new NotAcceptableException(\"Please login to perform this query\");","typeGuard":"boolean ready = User.get() != null;","tryCatchPattern":"try { issues = issueQueryManager.find(null, query); } catch (NotAcceptableException e) { throw new UnauthorizedException(e.getMessage()); }","preventionTips":["Require authentication for endpoints exposing saved issue queries","Rewrite 'commented by me' with explicit usernames for automation","Set user context in webhook/email handlers before query execution"],"tags":["authentication","onedev","jpa-query"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}