{"record":{"id":"66fc858263f904e7","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-66fc85","errorCode":null,"errorMessage":"\"Please login to perform this query\"","messagePattern":"\"Please login to perform this query\"","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/RequestedForChangesByMeCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class RequestedForChangesByMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null)\n\t\t\treturn getCriteria(user).matches(request);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new RequestedForChangesByUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.RequestedForChangesByMe);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/RequestedForChangesByMeCriteria.java#L10-L46","documentation":"RequestedForChangesByMeCriteria builds a JPA predicate from the current thread-bound user (User.get()). When there is no authenticated user (anonymous), it cannot resolve 'me' and throws NotAcceptableException with a localized 'Please login to perform this query' message during query evaluation.","triggerScenarios":"Executing/evaluating a pull request query containing 'requested for changes by me' while unauthenticated — e.g. REST/GraphQL query calls without a session or access token, or rendering a saved query for anonymous visitors.","commonSituations":"API scripts missing authorization headers; saved queries shared with anonymous users; expired sessions where the UI still submits a *ByMe query.","solutions":["Authenticate the request (login session or personal access token) before running the query.","Replace 'requested for changes by me' with 'requested for changes by <username>' in queries executed anonymously or by services.","Hide/remove *ByMe queries from dashboards accessible to anonymous users.","For REST calls, add the Authorization header with a valid OneDev access token."],"exampleFix":"// before\nGET /~api/query?query=requested for changes by me   // no auth -> 405\n// after\ncurl -H \"Authorization: Bearer <token>\" '/~api/query?query=requested for changes by me'","handlingStrategy":"try-catch","validationCode":"if (SecurityUtils.getUser() == null && query.contains(\"requested for changes by me\"))\n    throw new NotAcceptableException(\"Login required for 'by me' queries\");","typeGuard":"boolean canEvaluateByMeCriteria() { return SecurityUtils.getUser() != null; }","tryCatchPattern":"try {\n    result = queryService.query(query);\n} catch (NotAcceptableException e) {\n    if (e.getMessage().contains(\"Please login\"))\n        promptAuthentication(); // or rewrite query with explicit user\n    else throw e;\n}","preventionTips":["Always attach an access token to API query calls","Rewrite *ByMe queries to explicit-user form in service code","Hide *ByMe saved queries from anonymous users"],"tags":["authentication","onedev","query"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}