{"record":{"id":"8ea4cc781a30d346","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-8ea4cc","errorCode":null,"errorMessage":"\"Please login to perform this query\"","messagePattern":"\"Please login to perform this query\"","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/SubmittedByMeCriteria.java","lineNumber":29,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.security.SecurityUtils;\nimport io.onedev.server.util.ProjectScope;\n\npublic class SubmittedByMeCriteria extends SubmittedByCriteria {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tPath<?> attribute = from.get(PullRequest.PROP_SUBMITTER);\n\t\t\treturn builder.equal(attribute, User.get());\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic User getUser() {\n\t\treturn SecurityUtils.getUser();\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tif (User.get() != null)\n\t\t\treturn User.get().equals(request.getSubmitter());\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/SubmittedByMeCriteria.java#L11-L47","documentation":"SubmittedByMeCriteria.getPredicate resolves User.get() to compare against the submitter attribute; when no user is authenticated it throws NotAcceptableException with the localized 'Please login to perform this query' message instead of producing a predicate.","triggerScenarios":"Executing a pull request query containing 'submitted by me' while unauthenticated: anonymous dashboard access, REST/GraphQL query without token, or an expired session.","commonSituations":"CI scripts calling the query API without credentials; saved queries visible to anonymous users; cookies cleared mid-session so the UI still sends 'submitted by me'.","solutions":["Authenticate (login or supply a OneDev access token with the request).","Use the explicit form 'submitted by <username>' for anonymous or service contexts.","Restrict saved queries that use *ByMe to authenticated audiences.","Add Authorization: Bearer <token> to API query calls."],"exampleFix":"// before\ncurl 'https://onedev/~api/query?query=submitted by me'\n// after\ncurl -H \"Authorization: Bearer <token>\" 'https://onedev/~api/query?query=submitted by me'","handlingStrategy":"try-catch","validationCode":"if (query.contains(\"submitted by me\") && SecurityUtils.getUser() == null)\n    query = query.replace(\"submitted by me\", \"submitted by \" + configuredUsername);","typeGuard":"boolean requiresLogin(String query) { return query.contains(\"by me\"); }","tryCatchPattern":"try {\n    return queryService.query(prQuery);\n} catch (NotAcceptableException e) {\n    if (e.getMessage().contains(\"Please login\")) {\n        authenticate();\n        return queryService.query(prQuery); // retry once with auth\n    }\n    throw e;\n}","preventionTips":["Attach tokens to all non-interactive query calls","Prefer 'submitted by <user>' in scripts","Test saved queries as an anonymous user before publishing"],"tags":["authentication","onedev","query"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}