#1891 attempt to fix expected invalid CSRF token

- Remove unused config settings `[picture] service`

modules/bindata/bindata.go

@@ -282,7 +282,7 @@ func (fi bindataFileInfo) Sys() interface{} {
 	return nil
 }
 
-var _confAppIni = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\xb4\x5a\x5b\x6f\xe3\x48\x76\x7e\xe7\xaf\xa8\xf1\x64\xd2\xdd\x81\x2e\x96\xdd\x76\xf7\x78\xd7\x9b\x91\x25\xca\xd6\xb6\x6e\x43\x4a\xdd\xd3\xd3\x30\x68\x5a\x2c\x49\x1c\x53\xa4\x9a\x45\xda\xed\x41\x10\xec\x20\x0f\x01\xf2\x9a\x20\x79\x09\x82\xe4\x21\x08\xb0\xb9\x20\x8b\xbc\xec\x26\xc8\xd3\x20\xef\x3d\xff\x61\x31\x9b\xfc\x8b\x7c\xe7\x54\x51\xa2\xdc\x1e\x27\x0b\x24\x73\xb1\x78\xa9\x3a\x55\x75\xea\x9c\xf3\x7d\xe7\x14\x3f\x16\x03\xfb\xa5\xed\x08\xfe\xd3\x1f\xb6\xbb\x9d\xd7\x62\x7c\xd6\x75\x45\xa7\xdb\xb3\xad\x8f\xc5\xa8\x67\x37\x5d\x5b\xf4\x9b\x2f\x6c\xd1\x3a\x6b\x0e\x4e\x6d\x57\x0c\x07\xa2\x35\x74\x1c\xdb\x1d\x0d\x07\xed\xee\xe0\x54\xb4\x26\xee\x78\xd8\xc7\xc3\x41\xa7\x7b\xaa\x7b\x5a\x3f\x12\xcd\xd5\x4a\xc4\xfe\x52\x8a\x6c\xe1\x67\x42\x2d\x92\x1b\x25\x92\x58\xc8\x6b\x99\xde\x8a\x95\x3f\xc7\x8b\x30\x8b\xa4\xd5\x1c\x8d\xbc\x41\xb3\x6f\x8b\x63\x71\x9a\xcc\xd5\x11\xfe\x8a\xd3\x30\x13\xae\x4c\xaf\xc3\xa9\x84\xa4\xd6\xc2\x8f\xd1\x1c\xcf\xc2\x99\xb8\x4d\x72\x91\xe6\xb1\x88\x92\xa9\x1f\x45\xb7\x96\x33\x19\x78\x13\x17\xb3\x3f\x16\xf3\x30\x43\x6b\x3b\xcc\x16\x32\x15\x3b\x81\xbc\xde\xa9\x88\x9d\x55\x9a\x04\x3b\x22\xc1\x83\x4c\xaa\x0c\x4f\x02\x39\xf3\xf3\x08\xb2\x94\x6e\xc3\x12\xb0\x74\x9a\x00\xee\x2d\xeb\x4d\x2a\x57\x89\x0a\xb3\x24\xbd\x3d\xb7\x9c\xe1\x70\x2c\x8e\x2d\xb7\xe5\x74\x47\x63\x6f\xfc\x7a\x44\xcd\x2e\x7d\xb5\xc0\x48\x6d\x23\xa9\x39\x70\xbb\x62\xba\xf0\x53\x25\x33\x8b\x6e\x3c\xa8\xca\x71\x6d\x74\x14\x68\xd6\x49\xd2\xa9\x34\xeb\x8e\xe5\x8d\xd8\x88\x17\x59\x22\x2e\xa5\x58\xa5\xe1\xb5\x9f\x49\xab\x33\x74\x5a\xb6\x37\x72\xba\x2f\x9b\x63\x1a\x66\xe6\x47\x8a\xd6\x7f\x1a\x25\x97\x7e\x24\x96\xfe\xbb\x70\x99\x2f\xc5\x34\x95\x7e\x16\x42\x95\x51\xb8\x84\x4e\x92\x59\x59\xe2\x0a\x4b\xcf\x95\x4c\x2b\xa2\xda\x10\x4b\xe9\xc7\x4a\xc4\x89\x6e\x69\xf5\x9b\x5f\x78\x2d\xc7\x6e\x8e\xbb\xc3\x81\xd7\xeb\xf6\xbb\x34\xc1\x6a\x03\x23\x8c\xfc\x6c\xba\x10\xa4\x20\xf1\x36\x97\xb9\x14\x91\x8c\xe7\xd9\xa2\x82\x31\xaf\x58\xf1\xbe\x12\x91\x9f\x62\x13\x70\x81\xb1\x54\x78\x89\x9d\x1b\x4d\x7a\x3d\xcf\xb1\x3f\x9f\xd8\xee\xd8\xc3\xdf\x89\xed\xf5\xec\xc1\xe9\xf8\x0c\x62\x1b\xbb\xf8\x07\xba\xcc\xc3\x73\xc8\x1f\xe4\xcb\x4b\x4c\xac\x3c\xd5\x50\x2a\x6d\x19\x7e\x2a\xd9\x3a\x64\x20\xc2\x18\x16\x02\x55\xbd\x5b\x45\x09\x9e\x92\x91\x58\xf6\x17\xa3\xde\xd0\x81\x5a\x9a\xa7\xb0\x35\x6f\x30\xe9\x43\xfa\xde\xee\x96\xd0\x50\xa9\xfc\x87\xc5\xb1\x98\xae\xeb\x4e\xee\x08\x69\x6c\x0b\x59\xab\x37\x59\x42\x59\xea\x8e\x10\x7f\x9a\x85\xd7\x61\x76\x2b\x66\x52\x06\x56\xc7\xb6\xdb\x1e\xab\x73\xd8\x87\x1a\x8d\xc0\x03\xc8\x7b\xe9\x47\x50\x1f\xc4\x5d\xc0\x0a\x97\xb2\x3a\x4d\xb0\x94\x0b\xec\x44\xe6\x8b\xcc\x9f\x57\x68\x73\x02\x71\x79\x2b\x9a\x71\x90\x26\x61\x20\x7e\x82\x7e\x35\x9a\x49\x33\xc6\x58\xd7\x7e\x84\x67\xdc\x09\x9b\x06\xdd\xef\xc4\x18\x5d\xdb\x6f\x10\x2a\x1f\x6a\xdf\x11\x37\x61\x14\x89\x85\x7f\x4d\xae\x25\xd7\xf6\xac\xb2\xdb\x88\xac\xa5\x4f\xaa\x0b\xe3\x59\x72\x24\x16\x59\xb6\x52\x47\xf5\x3a\xcc\x5a\x46\x09\x4c\x43\xd5\xe6\x49\x32\x8f\x64\x0d\x8b\xac\xdf\xc8\xcb\x7a\xbe\x0a\x60\x79\xaa\xbe\xb7\xdb\x78\x5a\x6f\x34\xea\x6e\xbe\x5a\x25\x69\x56\x9d\x25\x69\xb5\xb4\x80\x6a\x18\x57\x5b\x8b\x34\xc1\xfd\xfe\xa7\xfc\xd2\x4c\xdf\x1a\x9f\xd9\x7d\x1b\x6a\xc0\x1e\x79\x7d\x7b\xdc\xf4\xc6\xcd\x53\xa8\xe2\xe2\xe3\xd9\xec\x60\xff\xe9\xfe\x05\x9b\x40\xcd\x0f\x96\x61\xbc\x6d\x08\x64\xa4\x0f\x6f\x19\x79\xf5\xf6\x8e\x1d\xec\x7e\x68\x4b\x0f\x8a\x70\xec\xd1\xf0\x41\x11\x71\x92\x21\xc6\x3c\x2c\x64\x30\x1c\x77\x5b\x77\x0d\xf0\x60\x4b\x4c\x92\xce\xfd\x38\xfc\x5a\xbb\xe5\x43\xb2\x86\xce\xe9\x07\xf3\xb1\xde\x2c\xfd\xf4\x2a\x48\x6e\x58\x43\x76\x4c\x9b\x8c\xed\x4d\x03\x58\x00\xfa\x5d\xc2\xdd\xaf\xe0\x13\x99\x8c\x15\xc4\x5b\xf6\xa0\x79\xd2\xb3\x3d\x44\x98\x36\x9c\x78\x60\x7b\x27\x70\xe9\x17\xa5\x70\xd1\x0b\x15\x47\x85\x69\xae\xb2\x64\x29\x26\x4e\xaf\xea\x4e\x69\x2f\x4b\xcb\x44\xe8\xe4\xb9\x91\x5f\x87\xf1\x95\x12\x37\x0b\x19\x43\xa1\x71\x20\xd3\x30\x9e\x8b\xbe\x99\x11\xc4\x61\xb7\x31\xba\xbf\x5c\x61\x56\x88\xb0\x95\xa5\x3f\x8f\x11\xe7\x74\xd0\xf7\x20\xdd\x73\x5b\x64\x04\x2e\xc2\xa4\xf5\x06\xbb\x8a\x40\x77\x6e\x8d\x9c\xe1\x78\x08\xb3\xc0\xbc\xc8\x0a\xad\xf6\xb0\xdf\xec\x0e\x70\xc7\x71\x7b\x91\xa8\x8c\x43\x2b\xf5\xc7\xc3\x4f\x1e\x17\xed\x9f\x90\xbd\x7e\xf2\x58\x37\xc7\xcd\x27\x8f\xcf\xc6\xe3\x91\x37\x1a\x3a\xe3\x27\xaa\x6e\xf1\x4d\xb3\xdd\x46\xb8\xb7\xd6\x2f\x20\x60\x9f\xa2\x0d\x96\x4e\xc2\xc5\xe3\x76\xff\xcb\x27\xb4\x6e\x9e\x3b\x81\x8a\xb8\x49\xd2\x2b\xb2\xb7\xc7\x2a\x47\xa0\xc3\xaa\x5d\xf7\x4c\x68\xe3\x7f\x02\xdf\x86\x09\x28\x5a\x36\x5c\x42\x28\x8d\x3b\x35\x88\xeb\xc6\x62\x89\x99\x8a\xa9\xaf\xa0\x3c\x42\x9e\x20\x21\x93\x41\x18\x87\xee\x10\xbc\xa7\x1a\x99\xca\x6e\x78\x4d\x01\x80\x3a\x37\xa3\x0c\xc6\x41\x01\x3a\x8e\x6e\x0d\x72\xa5\x3c\xae\xd6\x11\x04\x05\x92\x50\x88\x04\x92\x04\x45\x60\x89\xa9\xd1\xba\xf8\x65\xcd\xea\x0d\x5b\x4d\x84\xd8\x8d\xa2\x48\x97\x50\xd0\x5a\x89\x77\xf5\x03\x50\xd2\x51\x82\x07\x9a\x01\x28\x72\xec\x36\x6f\x2e\x0d\xe3\x5f\xfb\x61\x44\xaf\xad\x76\xd7\x65\x33\xa2\x66\x1b\xd3\x79\xb5\x90\x0c\x9e\x70\x4e\x71\x99\x87\x51\x06\xdb\Line truncated
+var _confAppIni = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\xb4\x5a\x5b\x6f\x23\x47\x76\x7e\xef\x5f\x51\x96\xe3\xcc\x4c\xc0\x8b\x28\x8d\x34\x63\xd9\xda\x98\x22\x9b\x12\x77\x78\x73\x37\x39\xe3\xf1\x40\x68\xb5\xd8\x45\xb2\xad\x66\x37\xdd\xd5\x2d\x8d\x8c\x20\x58\x23\x0f\x01\xf2\x9a\x20\x79\x09\x82\xe4\x21\x08\xb0\xb9\x20\x8b\xbc\xec\x26\xc8\x93\x91\xf7\xf1\x7f\x58\x78\x93\x7f\x91\xef\x9c\xaa\x26\x9b\x1a\x59\xc9\x02\x89\x2f\x62\x5f\xaa\x4e\x55\x9d\x3a\xe7\x7c\xdf\x39\xd5\x1f\x8a\x81\xfd\xd2\x76\x04\xff\xe9\x0f\xdb\xdd\xce\x6b\x31\x3e\xeb\xba\xa2\xd3\xed\xd9\xd6\x87\x62\xd4\xb3\x9b\xae\x2d\xfa\xcd\x17\xb6\x68\x9d\x35\x07\xa7\xb6\x2b\x86\x03\xd1\x1a\x3a\x8e\xed\x8e\x86\x83\x76\x77\x70\x2a\x5a\x13\x77\x3c\xec\xe3\xe1\xa0\xd3\x3d\xd5\x3d\xad\x4f\x44\x73\xb5\x12\xb1\xbf\x94\x22\x5b\xf8\x99\x50\x8b\xe4\x46\x89\x24\x16\xf2\x5a\xa6\xb7\x62\xe5\xcf\xf1\x22\xcc\x22\x69\x35\x47\x23\x6f\xd0\xec\xdb\xe2\x58\x9c\x26\x73\x75\x84\xbf\xe2\x34\xcc\x84\x2b\xd3\xeb\x70\x2a\x21\xa9\xb5\xf0\x63\x34\xc7\xb3\x70\x26\x6e\x93\x5c\xa4\x79\x2c\xa2\x64\xea\x47\xd1\xad\xe5\x4c\x06\xde\xc4\xc5\xec\x8f\xc5\x3c\xcc\xd0\xda\x0e\xb3\x85\x4c\xc5\x4e\x20\xaf\x77\x2a\x62\x67\x95\x26\xc1\x8e\x48\xf0\x20\x93\x2a\xc3\x93\x40\xce\xfc\x3c\x82\x2c\xa5\xdb\xb0\x04\x2c\x9d\x26\x80\x7b\xcb\x7a\x93\xca\x55\xa2\xc2\x2c\x49\x6f\xcf\x2d\x67\x38\x1c\x8b\x63\xcb\x6d\x39\xdd\xd1\xd8\x1b\xbf\x1e\x51\xb3\x4b\x5f\x2d\x30\x52\xdb\x48\x6a\x0e\xdc\xae\x98\x2e\xfc\x54\xc9\xcc\xa2\x1b\x0f\xaa\x72\x5c\x1b\x1d\x05\x9a\x75\x92\x74\x2a\xcd\xba\x63\x79\x23\x36\xe2\x45\x96\x88\x4b\x29\x56\x69\x78\xed\x67\xd2\xea\x0c\x9d\x96\xed\x8d\x9c\xee\xcb\xe6\x98\x86\x99\xf9\x91\xa2\xf5\x9f\x46\xc9\xa5\x1f\x89\xa5\xff\x36\x5c\xe6\x4b\x31\x4d\xa5\x9f\x85\x50\x65\x14\x2e\xa1\x93\x64\x56\x96\xb8\xc2\xd2\x73\x25\xd3\x8a\xa8\x36\xc4\x52\xfa\xb1\x12\x71\xa2\x5b\x5a\xfd\xe6\x17\x5e\xcb\xb1\x9b\xe3\xee\x70\xe0\xf5\xba\xfd\x2e\x4d\xb0\xda\xc0\x08\x23\x3f\x9b\x2e\x04\x29\x48\x7c\x9d\xcb\x5c\x8a\x48\xc6\xf3\x6c\x51\xc1\x98\x57\xac\x78\x5f\x89\xc8\x4f\xb1\x09\xb8\xc0\x58\x2a\xbc\xc4\xce\x8d\x26\xbd\x9e\xe7\xd8\x9f\x4f\x6c\x77\xec\xe1\xef\xc4\xf6\x7a\xf6\xe0\x74\x7c\x06\xb1\x8d\x5d\xfc\x03\x5d\xe6\xe1\x39\xe4\x0f\xf2\xe5\x25\x26\x56\x9e\x6a\x28\x95\xb6\x0c\x3f\x95\x6c\x1d\x32\x10\x61\x0c\x0b\x81\xaa\xde\xae\xa2\x04\x4f\xc9\x48\x2c\xfb\x8b\x51\x6f\xe8\x40\x2d\xcd\x53\xd8\x9a\x37\x98\xf4\x21\x7d\x6f\x77\x4b\x68\xa8\x54\xfe\xe3\xe2\x58\x4c\xd7\x75\x27\x77\x84\x34\xb6\x85\xac\xd5\x9b\x2c\xa1\x2c\x75\x47\x88\x3f\xcd\xc2\xeb\x30\xbb\x15\x33\x29\x03\xab\x63\xdb\x6d\x8f\xd5\x39\xec\x43\x8d\x46\xe0\x01\xe4\xbd\xf4\x23\xa8\x0f\xe2\x2e\x60\x85\x4b\x59\x9d\x26\x58\xca\x05\x76\x22\xf3\x45\xe6\xcf\x2b\xb4\x39\x81\xb8\xbc\x15\xcd\x38\x48\x93\x30\x10\x3f\x41\xbf\x1a\xcd\xa4\x19\x63\xac\x6b\x3f\xc2\x33\xee\x84\x4d\x83\xee\x77\x62\x8c\xae\xed\x37\x08\x95\x0f\xb5\xef\x88\x9b\x30\x8a\xc4\xc2\xbf\x26\xd7\x92\x6b\x7b\x56\xd9\x6d\x44\xd6\xd2\x27\xd5\x85\xf1\x2c\x39\x12\x8b\x2c\x5b\xa9\xa3\x7a\x1d\x66\x2d\xa3\x04\xa6\xa1\x6a\xf3\x24\x99\x47\xb2\x86\x45\xd6\x6f\xe4\x65\x3d\x5f\x05\xb0\x3c\x55\xdf\xdb\x6d\x3c\xad\x37\x1a\x75\x37\x5f\xad\x92\x34\xab\xce\x92\xb4\x5a\x5a\x40\x35\x8c\xab\xad\x45\x9a\xe0\x7e\xff\x63\x7e\x69\xa6\x6f\x8d\xcf\xec\xbe\x0d\x35\x60\x8f\xbc\xbe\x3d\x6e\x7a\xe3\xe6\x29\x54\x71\xf1\xe1\x6c\x76\xb0\xff\x74\xff\x82\x4d\xa0\xe6\x07\xcb\x30\xde\x36\x04\x32\xd2\x87\xb7\x8c\xbc\x7a\x7b\xc7\x0e\x76\xdf\xb7\xa5\x07\x45\x38\xf6\x68\xf8\xa0\x88\x38\xc9\x10\x63\x1e\x16\x32\x18\x8e\xbb\xad\xbb\x06\x78\xb0\x25\x26\x49\xe7\x7e\x1c\x7e\xa3\xdd\xf2\x21\x59\x43\xe7\xf4\xbd\xf9\x58\x6f\x96\x7e\x7a\x15\x24\x37\xac\x21\x3b\xa6\x4d\xc6\xf6\xa6\x01\x2c\x00\xfd\x2e\xe1\xee\x57\xf0\x89\x4c\xc6\x0a\xe2\x2d\x7b\xd0\x3c\xe9\xd9\x1e\x22\x4c\x1b\x4e\x3c\xb0\xbd\x13\xb8\xf4\x8b\x52\xb8\xe8\x85\x8a\xa3\xc2\x34\x57\x59\xb2\x14\x13\xa7\x57\x75\xa7\xb4\x97\xa5\x65\x22\x74\xf2\xdc\xc8\xaf\xc3\xf8\x4a\x89\x9b\x85\x8c\xa1\xd0\x38\x90\x69\x18\xcf\x45\xdf\xcc\x08\xe2\xb0\xdb\x18\xdd\x5f\xae\x30\x2b\x44\xd8\xca\xd2\x9f\xc7\x88\x73\x3a\xe8\x7b\x90\xee\xb9\x2d\x32\x02\x17\x61\xd2\x7a\x83\x5d\x45\xa0\x3b\xb7\x46\xce\x70\x3c\x84\x59\x60\x5e\x64\x85\x56\x7b\xd8\x6f\x76\x07\xb8\xe3\xb8\xbd\x48\x54\xc6\xa1\x95\xfa\xe3\xe1\x47\x8f\x8b\xf6\x4f\xc8\x5e\x3f\x7a\xac\x9b\xe3\xe6\xa3\xc7\x67\xe3\xf1\xc8\x1b\x0d\x9d\xf1\x13\x55\xb7\xf8\xa6\xd9\x6e\x23\xdc\x5b\xeb\x17\x10\xb0\x4f\xd1\x06\x4b\x27\xe1\xe2\x71\xbb\xff\xe5\x13\x5a\x37\xcf\x9d\x40\x45\xdc\x24\xe9\x15\xd9\xdb\x63\x95\x23\xd0\x61\xd5\xae\x7b\x26\xb4\xf1\x3f\x81\x6f\xc3\x04\x14\x2d\x1b\x2e\x21\x94\xc6\x9d\x1a\xc4\x75\x63\xb1\xc4\x4c\xc5\xd4\x57\x50\x1e\x21\x4f\x90\x90\xc9\x20\x8c\x43\x77\x08\xde\x53\x8d\x4c\x65\x37\xbc\xa6\x00\x40\x9d\x9b\x51\x06\xe3\xa0\x00\x1d\x47\xb7\x06\xb9\x52\x1e\x57\xeb\x08\x82\x02\x49\x28\x44\x02\x49\x82\x22\xb0\xc4\xd4\x68\x5d\xfc\xb2\x66\xf5\x86\xad\x26\x42\xec\x46\x51\xa4\x4b\x28\x68\xad\xc4\xbb\xfa\x01\x28\xe9\x28\xc1\x03\xcd\x00\x14\x39\x76\x9b\x37\x97\x86\xf1\xaf\xfd\x30\xa2\xd7\x56\xbb\xeb\xb2\x19\x51\xb3\x8d\xe9\xbc\x5a\x48\x06\x4f\x38\xa7\xb8\xcc\xc3\x28\x83\xed\Line truncated
 
 func confAppIniBytes() ([]byte, error) {
 	return bindataRead(
@@ -297,7 +297,7 @@ func confAppIni() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "conf/app.ini", size: 11189, mode: os.FileMode(420), modTime: time.Unix(1456792038, 0)}
+	info := bindataFileInfo{name: "conf/app.ini", size: 11095, mode: os.FileMode(420), modTime: time.Unix(1457034005, 0)}
 	a := &asset{bytes: bytes, info:  info}
 	return a, nil
 }

modules/middleware/auth.go

@@ -109,17 +109,11 @@ func Toggle(options *ToggleOptions) macaron.Handler {
 			}
 		}
 
-		// Try auto-signin when not signed in.
-		if !options.SignOutRequire && !ctx.IsSigned && !auth.IsAPIPath(ctx.Req.URL.Path) {
-			succeed, err := AutoSignIn(ctx)
-			if err != nil {
-				ctx.Handle(500, "AutoSignIn", err)
-				return
-			} else if succeed {
-				log.Trace("Auto-login succeed: %s", ctx.Session.Get("uname"))
-				ctx.Redirect(setting.AppSubUrl + ctx.Req.RequestURI)
-				return
-			}
+		// Auto-signin info is provided and has not signed in.
+		if !options.SignOutRequire && !ctx.IsSigned && !auth.IsAPIPath(ctx.Req.URL.Path) &&
+			len(ctx.GetCookie(setting.CookieUserName)) > 0 {
+			ctx.SetCookie("redirect_to", url.QueryEscape(setting.AppSubUrl+ctx.Req.RequestURI), 0, setting.AppSubUrl)
+			ctx.Redirect(setting.AppSubUrl + ctx.Req.RequestURI)
 		}
 
 		if options.AdminRequire {

modules/setting/setting.go

@@ -131,7 +131,6 @@ var (
 	}
 
 	// Picture settings
-	PictureService   string
 	AvatarUploadPath string
 	GravatarSource   string
 	DisableGravatar  bool
@@ -448,7 +447,6 @@ func NewContext() {
 	ThemeColorMetaTag = sec.Key("THEME_COLOR_META_TAG").MustString("#ff5343")
 
 	sec = Cfg.Section("picture")
-	PictureService = sec.Key("SERVICE").In("server", []string{"server"})
 	AvatarUploadPath = sec.Key("AVATAR_UPLOAD_PATH").MustString(path.Join(AppDataPath, "avatars"))
 	forcePathSeparator(AvatarUploadPath)
 	if !filepath.IsAbs(AvatarUploadPath) {