{"record":{"id":"5ca6c440e5826b70","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-5ca6c4","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/codecomment/CreatedByMeCriteria.java","lineNumber":29,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.CodeComment;\nimport io.onedev.server.model.User;\nimport io.onedev.server.security.SecurityUtils;\nimport io.onedev.server.util.ProjectScope;\n\npublic class CreatedByMeCriteria extends CreatedByCriteria {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<CodeComment, CodeComment> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tPath<?> attribute = from.get(CodeComment.PROP_USER);\n\t\t\treturn builder.equal(attribute, User.get());\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic User getUser() {\n\t\treturn SecurityUtils.getUser();\n\t}\n\n\t@Override\n\tpublic boolean matches(CodeComment comment) {\n\t\tif (User.get() != null)\n\t\t\treturn User.get().equals(comment.getUser());\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/codecomment/CreatedByMeCriteria.java#L11-L47","documentation":"CreatedByMeCriteria.getPredicate() builds a JPA predicate matching comments created by the current user. If there is no authenticated user (User.get() == null), it throws NotAcceptableException with the localized message \"Please login to perform this query\". The criteria fundamentally requires a user context to resolve 'me'.","triggerScenarios":"Executing a query containing the CreatedByMe criterion while unauthenticated — e.g. an anonymous HTTP request hitting a search endpoint, or server-side evaluation with no security context bound.","commonSituations":"Saved/shared query containing CreatedByMe executed via API without credentials; session expiry before running the search; calling the search from a scheduled job or webhook where no user is logged in.","solutions":["Authenticate before running the query (log in via UI or supply valid credentials/API token for REST calls).","Replace CreatedByMe with CreatedBy(\"<user name>\") in queries evaluated without a user session.","Guard the search flow: check SecurityUtils.getUser() != null before parsing/executing me-based queries.","Catch NotAcceptableException (HTTP 406) on the client and redirect to login."],"exampleFix":"// before\nvar query = CodeCommentQuery.parse(project, \"CreatedByMe\", true);\nvar result = query.getPredicate(...); // anonymous -> 406\n// after\nif (SecurityUtils.getUser() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");\nvar query = CodeCommentQuery.parse(project, \"CreatedByMe\", true);","handlingStrategy":"try-catch","validationCode":"// before executing a me-based query\nif (SecurityUtils.getUser() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");","typeGuard":"static boolean hasCurrentUser() {\n    return User.get() != null;\n}","tryCatchPattern":"try {\n    var predicate = new CreatedByMeCriteria().getPredicate(projectScope, query, from, builder);\n} catch (NotAcceptableException e) {\n    redirectToLogin(); // HTTP 406 -> prompt authentication\n}","preventionTips":["Require authentication on search endpoints that may contain me-based criteria.","Avoid CreatedByMe in saved queries evaluated by jobs or webhooks.","Check User.get() before parsing with withCurrentUserCriteria=true.","Handle 406 responses on REST clients by refreshing credentials."],"tags":["authentication","search-query","http-406"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}