This probably also needs a panic handler too.

My suspicion is that putting the return in a defer would be better:

e.g.

func TransferOwnership(doer *User, newOwnerName string, repo *Repository) (err error) {
   repoRenamed := false
   wikiRenamed := false
  
   defer func() {
       recErr := recover()

       if recErr != nil || err != nil {
          // handle moving stuff back
          // If there is an error moving stuff back this needs a clear log.Critical(...) so administrators know that they need to do something
      } ()
      ...
   }

Then you can just err = sess.Commit() and return err

Something like that.

This probably also needs a panic handler too.

My suspicion is that putting the return in a defer would be better:

e.g.

func TransferOwnership(doer *User, newOwnerName string, repo *Repository) (err error) {
   repoRenamed := false
   wikiRenamed := false
  
   defer func() {
       recErr := recover()

       if recErr != nil || err != nil {
          // handle moving stuff back
          // If there is an error moving stuff back this needs a clear log.Critical(...) so administrators know that they need to do something
      } ()
      ...
   }

Then you can just err = sess.Commit() and return err

Something like that.

It's running beyond on http router, and I think we have already recovery middleware there.

yes but if there is a panic after the initial rename has occurred but then you're not going to rename back unless you use a recover deferral scheme as I suggest above.

See lunny#14