{"record":{"id":"9fcba4754c020f7f","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-9fcba4","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/NeedMyActionCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class NeedMyActionCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null)\n\t\t\treturn getCriteria(user).matches(request);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new NeedUserActionCriteria(user);\n\t}\n\t\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.NeedMyAction);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/NeedMyActionCriteria.java#L10-L46","documentation":"NeedMyActionCriteria.getPredicate() builds a DB predicate via NeedUserActionCriteria for the current user (pull requests awaiting the user's action). With no authenticated user, User.get() is null and the criteria throws NotAcceptableException 'Please login to perform this query'.","triggerScenarios":"Executing a pull request query containing 'need my action' (or similar wait-for-me criterion) on the DB evaluation path while unauthenticated.","commonSituations":"Anonymous visitors landing on 'my waiting' dashboards, REST clients missing auth tokens, shared query URLs containing user-relative criteria.","solutions":["Authenticate the request (login or token) before running the query.","Rewrite the query to reference a specific user instead of 'me'.","Redirect anonymous users to the login page when the query contains user-relative criteria."],"exampleFix":"// before\ncurl https://onedev/~api/pull-requests?query=\"wait for\" is \"me\"\n// after\ncurl -H \"Authorization: Bearer <token>\" https://onedev/~api/pull-requests?query=\"wait for\" is \"me\"","handlingStrategy":"validation","validationCode":"if (!isAuthenticated()) redirect('/login'); // before querying 'need my action'","typeGuard":"function isLoggedIn() { return User.get() != null; }","tryCatchPattern":"try { prs = query(\"need my action\"); } catch (NotAcceptableException e) { promptLogin(); }","preventionTips":["Always send Authorization headers for 'me'-based API queries.","Redirect guests to login when default queries are user-relative.","Use explicit usernames in CI/cron scripts."],"tags":["onedev","query","authentication","pull-request"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}