Delete user account functionality broken.

[puni9869]

Description

Steps to repro.

1. Login to gitea
2. Go to settings.
3. Go to Accounts.
4. Go to Delete Your Account.
5. Now click on
   without entring password.
6. We get 500 error.

Gitea Version

1.21.0+dev-412-gce27de4d4

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

1.21.0+dev-412-gce27de4d4

Operating System

No response

How are you running Gitea?

locally and try.gitea.io

Database

None

[techknowlogick]

Could you share the logs you have?

[puni9869]

2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [I] router: completed GET /user/events for [::1]:50785, 200 OK in 12017.3ms @ events/events.go:18(events.Events)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd15-8: GET: /user/events
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21: POST: /user/settings/account/delete (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   POST /user/settings/account/delete for [::1]:50788
2023/07/28 23:08:41 ...ices/auth/session.go:51:SessionUser() [T] Session Authorization: Found user[1]
2023/07/28 23:08:41 models/user/user.go:910:GetUserByID() [I] [SQL] SELECT "id", "lower_name", "name", "full_name", "email", "keep_email_private", "email_notifications_preference", "passwd", "passwd_hash_algo", "must_change_password", "login_type", "login_source", "login_name", "type", "location", "website", "rands", "salt", "language", "description", "created_unix", "updated_unix", "last_login_unix", "last_repo_visibility", "max_repo_creation", "is_active", "is_admin", "is_restricted", "allow_git_hook", "allow_import_local", "allow_create_organization", "prohibit_login", "avatar", "avatar_email", "use_custom_avatar", "num_followers", "num_following", "num_stars", "num_repos", "num_teams", "num_members", "visibility", "repo_admin_change_team_access", "diff_view_style", "theme", "keep_activity_private" FROM "user" WHERE "id"=$1 LIMIT 1 [1] - 978.726µs
2023/07/28 23:08:41 ...ices/auth/session.go:67:SessionUser() [T] Session Authorization: Logged in user <User 1:git_tea>
2023/07/28 23:08:41 .../issues/stopwatch.go:149:HasUserStopwatch() [I] [SQL] SELECT * FROM "stopwatch" INNER JOIN "issue" ON issue.id = stopwatch.issue_id INNER JOIN "repository" ON repository.id = issue.repo_id WHERE (user_id = $1) LIMIT 1 [1] - 1.222911ms
2023/07/28 23:08:41 ...b727260d35/engine.go:1246:Get() [I] [SQL] SELECT "id", "lower_name", "name", "full_name", "email", "keep_email_private", "email_notifications_preference", "passwd", "passwd_hash_algo", "must_change_password", "login_type", "login_source", "login_name", "type", "location", "website", "rands", "salt", "language", "description", "created_unix", "updated_unix", "last_login_unix", "last_repo_visibility", "max_repo_creation", "is_active", "is_admin", "is_restricted", "allow_git_hook", "allow_import_local", "allow_create_organization", "prohibit_login", "avatar", "avatar_email", "use_custom_avatar", "num_followers", "num_following", "num_stars", "num_repos", "num_teams", "num_members", "visibility", "repo_admin_change_team_access", "diff_view_style", "theme", "keep_activity_private" FROM "user" WHERE "lower_name"=$1 LIMIT 1 [git_tea] - 951.543µs
2023/07/28 23:08:41 ...r/setting/account.go:244:DeleteAccount() [E] UserSignIn: user's password is invalid [uid: 1, name: git_tea]
2023/07/28 23:08:41 .../context_response.go:68:HTML() [D] Template: status/500
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [I] router: completed POST /user/settings/account/delete for [::1]:50788, 500 Internal Server Error in 31.0ms @ setting/account.go:234(setting.DeleteAccount)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21: POST: /user/settings/account/delete
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21-2: GET: /assets/css/index.css?v=1d8d90fd3 (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   GET /assets/css/index.css?v=1d8d90fd3 for [::1]:50788
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [T] router: completed GET /assets/css/index.css?v=1d8d90fd3 for [::1]:50788, 304 Not Modified in 0.2ms @ public/public.go:34(public.FileHandlerFunc)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21-2: GET: /assets/css/index.css?v=1d8d90fd3
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21-3: GET: /assets/css/theme-arc-green.css?v=1d8d90fd3 (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   GET /assets/css/theme-arc-green.css?v=1d8d90fd3 for [::1]:50784
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [T] router: completed GET /assets/css/theme-arc-green.css?v=1d8d90fd3 for [::1]:50784, 304 Not Modified in 0.3ms @ public/public.go:34(public.FileHandlerFunc)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21-3: GET: /assets/css/theme-arc-green.css?v=1d8d90fd3
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21-4: GET: /assets/img/logo.svg (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   GET /assets/img/logo.svg for [::1]:50784
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [T] router: completed GET /assets/img/logo.svg for [::1]:50784, 304 Not Modified in 0.5ms @ public/public.go:34(public.FileHandlerFunc)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21-4: GET: /assets/img/logo.svg
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21-5: GET: /assets/img/500.png (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   GET /assets/img/500.png for [::1]:50788
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [T] router: completed GET /assets/img/500.png for [::1]:50788, 304 Not Modified in 1.4ms @ public/public.go:34(public.FileHandlerFunc)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21-5: GET: /assets/img/500.png
2023/07/28 23:08:41 ...s/process/manager.go:188:Add() [T] Start 64c3fd21-6: GET: /assets/img/favicon.png (request)
2023/07/28 23:08:41 ...eb/routing/logger.go:47:func1() [T] router: started   GET /assets/img/favicon.png for [::1]:50788
2023/07/28 23:08:41 ...eb/routing/logger.go:102:func1() [T] router: completed GET /assets/img/favicon.png for [::1]:50788, 304 Not Modified in 0.7ms @ public/public.go:34(public.FileHandlerFunc)
2023/07/28 23:08:41 ...s/process/manager.go:231:remove() [T] Done 64c3fd21-6: GET: /assets/img/favicon.png
2023/07/28 23:08:49 ...ource/manager_run.go:46:Run() [T] Event source has no listeners
2023/07/28 23:08:49 ...ource/manager_run.go:56:Run() [T] Pausing the eventsource

2023/07/28 23:08:41 ...r/setting/account.go:244:DeleteAccount() [E] UserSignIn: user's password is invalid [uid: 1, name: git_tea]

[puni9869]

Its a simple check error UserSignIn: user's password is invalid

[lunny]

Its a simple check error UserSignIn: user's password is invalid

Yes, this password error should be displayed in the UI but not return 500

[lunny]

Caused by #25414 and we now need to check all possible errors come from https://github.com/go-gitea/gitea/blob/main/services/auth/source/db/authenticate.go#L46

[zyphlar]

Also consider the case that the user doesn't have a password, as in oauth2 users via github etc