Panic when requesting team members API

[qwerty287]

Description

I tried to find the commit resposible for this, but I couldn't find it. I tried commit after April 2 and it always panics. Maybe it is database-related or something like this?

[625188bc-3] router: failed    GET /api/v1/teams/4/members for 10.42.0.72:47414, panic in 40.2ms @ org/team.go:347(org.GetTeamMembers), err=runtime error: index out of range [0] with length 0
...common/middleware.go:71:1() [E] [625188bc-4] PANIC: runtime error: index out of range [0] with length 0
        /usr/lib/go-1.17/src/runtime/panic.go:90 (0x43c474)
                goPanicIndex: panic(boundsError{x: int64(x), signed: true, y: y, code: boundsIndex})
        /home/nathan/projects/Go/gitea/gitea/routers/api/v1/org/team.go:392 (0x1f9186e)
                GetTeamMembers: members[i] = convert.ToUser(member, ctx.Doer)
        /home/nathan/projects/Go/gitea/gitea/modules/web/wrap_convert.go:60 (0x1e354d6)
                convertHandler.func5: t(ctx)
        /home/nathan/projects/Go/gitea/gitea/modules/web/wrap.go:41 (0x1e33a89)
                wrapInternal.func1: done, deferrable := handler(resp, req, others...)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/mux.go:442 (0x163b075)
                (*Mux).routeHTTP: h.ServeHTTP(w, r)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/modules/web/wrap.go:98 (0x1e3460b)
                MiddleAPI.func1.1: next.ServeHTTP(ctx.Resp, ctx.Req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/modules/web/wrap.go:98 (0x1e3460b)
                MiddleAPI.func1.1: next.ServeHTTP(ctx.Resp, ctx.Req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/modules/context/api.go:272 (0x1a29766)
                APIContexter.func1.1: next.ServeHTTP(ctx.Resp, ctx.Req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/routers/api/v1/api.go:1158 (0x1facaf3)
                securityHeaders.func1.1: next.ServeHTTP(resp, req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/mux.go:71 (0x1638eac)
                (*Mux).ServeHTTP: mx.handler.ServeHTTP(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/mux.go:314 (0x163a85b)
                (*Mux).Mount.func1: handler.ServeHTTP(w, r)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/mux.go:442 (0x163b075)
                (*Mux).routeHTTP: h.ServeHTTP(w, r)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/routers/common/middleware.go:79 (0x1e9dc22)
                Middlewares.func2.1: next.ServeHTTP(resp, req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/modules/web/routing/logger_manager.go:123 (0x1e2f7af)
                (*requestRecordsManager).handler.func1: next.ServeHTTP(w, req)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/middleware/strip.go:30 (0x1e99098)
                StripSlashes.func1: next.ServeHTTP(w, r)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/chi-middleware/[email protected]/middleware.go:37 (0x1e95956)
                ForwardedHeaders.func1.1: h.ServeHTTP(w, r)
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/projects/Go/gitea/gitea/routers/common/middleware.go:32 (0x1e9da72)
                Middlewares.func1.1: next.ServeHTTP(context.NewResponse(resp), req.WithContext(ctx))
        /usr/lib/go-1.17/src/net/http/server.go:2046 (0x8d68ae)
                HandlerFunc.ServeHTTP: f(w, r)
        /home/nathan/go/pkg/mod/github.com/go-chi/chi/[email protected]/mux.go:88 (0x1638e61)
                (*Mux).ServeHTTP: mx.handler.ServeHTTP(w, r)
        /home/nathan/projects/Go/gitea/gitea/modules/web/route.go:200 (0x1e32ecd)
                (*Route).ServeHTTP: r.R.ServeHTTP(w, req)
        /usr/lib/go-1.17/src/net/http/server.go:2878 (0x8d9e1a)
                serverHandler.ServeHTTP: handler.ServeHTTP(rw, req)
        /usr/lib/go-1.17/src/net/http/server.go:1929 (0x8d5987)
                (*conn).serve: serverHandler{c.server}.ServeHTTP(w, w.req)
        /usr/lib/go-1.17/src/runtime/asm_amd64.s:1581 (0x473b80)
                goexit: BYTE    $0x90   // NOP

(Can't reproduce on try.gitea.io because I can't use orgs there)

Gitea Version

almost latest main

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

compiled from source, from command line

Database

MySQL

[delvh]

On first glance, I think the responsible line for that is (as the stacktrace implies)

gitea/routers/api/v1/org/team.go

Line 392 in d906858

members[i] = convert.ToUser(member, ctx.Doer)

I think this line should rather be

members = append(members, convert.ToUser(member, ctx.Doer))

[delvh]

Either that, or

gitea/routers/api/v1/org/team.go

Line 390 in d906858

members := make([]*api.User, len(ctx.Org.Team.Members))

should rather be

	members := make([]*api.User, len(teamMembers))