fix: opening dot files returns 403 error #580

New Issue

2026-06-07T18:15:23Z

jmiller commented

2026-06-07 18:15:23 +00:00

Problem

Viewing files that start with a dot (e.g., .gitignore, .env.example, .mokogitea/manifest.xml) in the web UI returns a 403 Forbidden error.

Root Cause

The nginx config has a rule that denies access to hidden files:

location ~ ^(?!/api/).*(/\.) {
    deny all;
    access_log off;
    log_not_found off;
}

This blocks all paths containing /. except /api/ routes. This was intended to protect .git/ directory access but it also blocks legitimate dot files viewed through the Gitea UI (e.g., /:owner/:repo/src/branch/main/.gitignore).

Fix

Update the nginx regex to exclude Gitea's file browsing routes (/src/, /raw/, /media/) in addition to /api/.

## Problem Viewing files that start with a dot (e.g., `.gitignore`, `.env.example`, `.mokogitea/manifest.xml`) in the web UI returns a 403 Forbidden error. ## Root Cause The nginx config has a rule that denies access to hidden files: ```nginx location ~ ^(?!/api/).*(/\.) { deny all; access_log off; log_not_found off; } ``` This blocks all paths containing `/.` except `/api/` routes. This was intended to protect `.git/` directory access but it also blocks legitimate dot files viewed through the Gitea UI (e.g., `/:owner/:repo/src/branch/main/.gitignore`). ## Fix Update the nginx regex to exclude Gitea's file browsing routes (`/src/`, `/raw/`, `/media/`) in addition to `/api/`.

jmiller commented

2026-06-07 18:15:29 +00:00

Branch created: feature/580-fix-opening-dot-files-returns-403-error

git fetch origin
git checkout feature/580-fix-opening-dot-files-returns-403-error

Branch created: [`feature/580-fix-opening-dot-files-returns-403-error`](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/src/branch/feature/580-fix-opening-dot-files-returns-403-error) ```bash git fetch origin git checkout feature/580-fix-opening-dot-files-returns-403-error ```

jmiller closed this issue

2026-06-07 18:18:10 +00:00

Sign in to join this conversation.

Priority -

Type -

Status —

Priority —

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-APP#580