theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

IgnoredByMeCriteria.getPredicate() delegates to IgnoredByUserCriteria for the current user to build a DB predicate for pull requests the user ignored. For an anonymous session User.get() is null and the criteria throws NotAcceptableException 'Please login to perform this query'.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/IgnoredByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class IgnoredByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new IgnoredByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(IgnoredByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the request before executing the query.
  2. Rewrite the query with an explicit username instead of 'me'.
  3. Configure the client/dashboard to use a login-safe default query for anonymous visitors.

Example fix

// before
GET /~api/pull-requests?query="ignored" is "me"  (no auth)
// after
GET /~api/pull-requests?query="ignored" is "alice"  (or add Authorization header)
Defensive patterns

Strategy: validation

Validate before calling

if (User.get() == null && query.contains("ignored by me")) redirect("/login");

Type guard

function userRequired() { return User.get() != null; }

Try / catch

try { runQuery(q); } catch (NotAcceptableException e) { if (e.getMessage().contains("login")) showLoginPrompt(); else throw e; }

Prevention

When it happens

Trigger: Running a pull request query with the 'ignored by me' criterion through the query parser/DB evaluation path without authentication.

Common situations: Guest users opening a shared query URL containing '~ignored by me', API integrations omitting credentials, dashboards with user-relative default queries served anonymously.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/acdeeb455ccddc1f. Report an issue: GitHub.