# Themes/components from GitLab gives error 500 when installing/updating

**URL:** https://meta.discourse.org/t/themes-components-from-gitlab-gives-error-500-when-installing-updating/243971
**Category:** Bug
**Created:** [November 2, 2022, 11:44am UTC](https://meta.discourse.org/t/themes-components-from-gitlab-gives-error-500-when-installing-updating/243971 "2022-11-02T11:44:35Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [November 2, 2022, 11:00pm UTC](https://meta.discourse.org/t/themes-components-from-gitlab-gives-error-500-when-installing-updating/243971/5 "2022-11-02T23:00:21Z")

</div>

Almost certainly because of the [SSRF protections](https://github.com/discourse/discourse/commit/68b4fe4cf876ba4838dfc797655a038d34d2b27f) fixes.

Gitlab is 301 redirecting a `git clone` for [https://gitlab.com/silentboatman/discourse-masonry-image-gallery](https://gitlab.com/silentboatman/discourse-masonry-image-gallery) to [https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/](https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/) (sic, ends with `.git/`) but git is called with `-c http.followRedirects=false` so it fails.

Entering [https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/](https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/) as the repository URL directly does not work because that is reverted back to [https://gitlab.com/silentboatman/discourse-masonry-image-gallery](https://gitlab.com/silentboatman/discourse-masonry-image-gallery) by `FinalDestination.resolve(@uri.to_s)` because, you won’t believe it, when requested outside of git, the redirection goes the other way around! Gitlab 302 redirects [https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/](https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/) to [https://gitlab.com/silentboatman/discourse-masonry-image-gallery](https://gitlab.com/silentboatman/discourse-masonry-image-gallery)

EDIT using `GIT_CURL_VERBOSE=1` I was able to see that Git appends `info/refs?service=git-upload-pack` when cloning, so

```plaintext
GET /silentboatman/discourse-masonry-image-gallery/info/refs?service=git-upload-pack HTTP/2

```

goes to

```plaintext
location: https://gitlab.com/silentboatman/discourse-masonry-image-gallery.git/info/refs?service=git-upload-pack

```

---

_[View the full topic](https://meta.discourse.org/t/themes-components-from-gitlab-gives-error-500-when-installing-updating/243971)._