theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

SubmittedByMeCriteria.getPredicate resolves User.get() to compare against the submitter attribute; when no user is authenticated it throws NotAcceptableException with the localized 'Please login to perform this query' message instead of producing a predicate.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/SubmittedByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.util.ProjectScope;

public class SubmittedByMeCriteria extends SubmittedByCriteria {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Path<?> attribute = from.get(PullRequest.PROP_SUBMITTER);
			return builder.equal(attribute, User.get());
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public User getUser() {
		return SecurityUtils.getUser();
	}

	@Override
	public boolean matches(PullRequest request) {
		if (User.get() != null)
			return User.get().equals(request.getSubmitter());
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate (login or supply a OneDev access token with the request).
  2. Use the explicit form 'submitted by <username>' for anonymous or service contexts.
  3. Restrict saved queries that use *ByMe to authenticated audiences.
  4. Add Authorization: Bearer <token> to API query calls.

Example fix

// before
curl 'https://onedev/~api/query?query=submitted by me'
// after
curl -H "Authorization: Bearer <token>" 'https://onedev/~api/query?query=submitted by me'
Defensive patterns

Strategy: try-catch

Validate before calling

if (query.contains("submitted by me") && SecurityUtils.getUser() == null)
    query = query.replace("submitted by me", "submitted by " + configuredUsername);

Type guard

boolean requiresLogin(String query) { return query.contains("by me"); }

Try / catch

try {
    return queryService.query(prQuery);
} catch (NotAcceptableException e) {
    if (e.getMessage().contains("Please login")) {
        authenticate();
        return queryService.query(prQuery); // retry once with auth
    }
    throw e;
}

Prevention

When it happens

Trigger: Executing a pull request query containing 'submitted by me' while unauthenticated: anonymous dashboard access, REST/GraphQL query without token, or an expired session.

Common situations: CI scripts calling the query API without credentials; saved queries visible to anonymous users; cookies cleared mid-session so the UI still sends 'submitted by me'.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/8ea4cc781a30d346. Report an issue: GitHub.