{"record":{"id":"4d6eccbb4cb16df6","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-4d6ecc","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/CommentedByMeCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class CommentedByMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null)\n\t\t\treturn getCriteria(user).matches(request);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new CommentedByUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.CommentedByMe);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/CommentedByMeCriteria.java#L10-L46","documentation":"CommentedByMeCriteria.getPredicate() builds a JPA predicate for pull requests the current user commented on. Because 'commented by me' is user-relative, an anonymous session (User.get() == null) makes the criteria throw NotAcceptableException 'Please login to perform this query' instead of producing a predicate.","triggerScenarios":"Evaluating a pull request query containing 'commented by me' against the database (getPredicate path) while the request has no authenticated user.","commonSituations":"Anonymous visitors opening a page whose default/URL-supplied query uses '~commented by me', REST query calls without auth headers, embedded query widgets rendered for guests.","solutions":["Log in before running the query (valid session or personal access token).","Replace 'me' with an explicit username criterion in the query string.","Guard the UI/API caller to fall back to a non-user-relative default query for anonymous users."],"exampleFix":"// before\nquery = 'commented by me'; // throws for guests\n// after\nquery = user != null ? 'commented by me' : 'commented by (\"alice\")';","handlingStrategy":"validation","validationCode":"boolean canRunUserQuery = User.get() != null || !queryString.contains(\"commented by me\");","typeGuard":"function isAuthenticated() { return User.get() !== null; }","tryCatchPattern":"try { runQuery(q); } catch (NotAcceptableException e) { fallbackToAnonymousDefaultQuery(); }","preventionTips":["Keep sessions alive in dashboards that embed 'me' queries.","Provide anonymous fallback queries without user-relative criteria.","Verify Authorization headers on REST clients."],"tags":["onedev","query","authentication","pull-request"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}