"/api/packages/{username}/nuget" will always return http.StatusOK no matter whether doer has permission

[yp05327]

Description

Related to #22705 CI result: https://drone.gitea.io/go-gitea/gitea/68876

It seems that /api/packages/{ownername}/nuget will always return http.StatusOK no matter whether doer has permission.
Is it by design?

If it is by design, I think it will be a security problem which is same as #23150.
If I give an unexisted username, it will return Internal Server Error
If I give an existed Private username, it will return xml

Gitea Version

latest

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

build

Database

None

[yardenshoham]

@KN4CK3R

[KN4CK3R]

That's intended, see #21242

[yp05327]

So what we need to do is fixing the Internal Server Error.

[KN4CK3R]

Yes, that's because the 404 can't be rendered.

[yp05327]

emmm…
I think not only 404, but also the others which is not 2xx should also be handled.

[KN4CK3R]

I just wanted to say that the rendering of the error page causes the internal server error.