summaryrefslogtreecommitdiffstats
path: root/src/main
Commit message (Collapse)AuthorAgeFilesLines
...
* | Add Czech localeJan Breuer2017-02-155-0/+854
| |
* | Merge pull request #1192 from mystygage/listBranchForRepositoryJames Moger2017-02-081-0/+4
|\ \ | | | | | | List branches from only one repository if a repository name is given
| * | List branches from only one repository if a repository name is givenMarkus Fömpe2017-01-261-0/+4
| | | | | | | | | | | | | | | | | | e.g.: https://localhost:8443/rpc/?req=LIST_REPOSITORY_BRANCHES&name=repo.git Fix #1184
* | | New Setting "Default Language" when creating user.william2017-02-084-29/+71
| | |
* | | fix bug "get user default language null exception"william2017-01-251-1/+5
| | |
* | | Sending email (certificate zip file) based on locale that user selectedwilliam2017-01-246-5/+160
|/ /
* | Merge pull request #6 from fzs/sshAuthMethodsFlorian Zschocke2017-01-212-9/+52
|\ \ | | | | | | Set list of offered SSH authentication methods.
| * | Set list of offered SSH authentication methods.merged--sshAuthMethodsFlorian Zschocke2016-12-062-9/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make the SSH authentication methods used by the server configurable, so that for example password authentication can be turned off. For this, a `git.sshAuthenticationMethods` setting is added which is a space separated list of authentication method names. Only the methods listed will be enabled in the server. This is modeled after the option of the same name from sshd_config, but it does not offer listing multiple required methods. It leaves the door open, though, for a later extension to support such a multi-factor authentication. Since this also includes Kerberos authentication with GSS API, this obsoletes the `git.sshWithKrb5` property. The latter is removed. Instead, to enable Kerberos5 authentication, add the method name `gssapi-with-mic` to the authentication methods list.
* | | Update weblogic.xmlBala Raman2017-01-161-2/+2
| | | | | | | | | Update to web app 3.0 xsd
* | | Update to web.xml, fix to #1132Bala Raman2017-01-151-4/+4
| | | | | | | | | | | | | | | Update to web.xml, fix to #1132 Fixes to namespace to fix xml parse error, where strict validation required
* | | Merge pull request #1171 from pingunaut/usermanager-file-instantiationJames Moger2017-01-062-2/+25
|\ \ \ | | | | | | | | Update UserManager to support construction of IUserServices with IRuntimeManager as a constructor parameter
| * | | extracted methodMartin Spielmann2017-01-061-9/+20
| | | |
| * | | updated commentde4c9d2016-12-301-1/+1
| | | |
| * | | update user manager to support instantiation if IUserService with ↵de4c9d2016-12-302-2/+14
| | |/ | |/| | | | | | | IRuntimeManager as a parameter
* / | Update korean translation for gitblit new version.DONGSU, KIM2017-01-051-718/+759
|/ /
* | Fix typo in defaults.properties.Florian Zschocke2016-12-181-1/+1
| |
* | Merge pull request #1160 from fzs/sshLdapAuthenticatorFlorian Zschocke2016-12-189-286/+849
|\ \ | | | | | | LDAP SSH key manager
| * | Extend documentation in default.properties and LdapKeyManager.java.merged--sshLdapAuthenticatorFlorian Zschocke2016-12-062-2/+31
| | |
| * | The public key manager can disable writing keys, which hides commandsFlorian Zschocke2016-12-066-12/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some public key mangers may be read-only, i.e. not allow to add or delete keys, or to change the key comment or assigned permissions. In such a case the respective commands should not be available on the SSH shell and the SSH Keys panel should also not offer the possibility. The `IPublicKeyManager` gets three new methods, modelled after the `AuthenticationManager`: `supportsWritingKeys`, `supportsCommentChanges` and `supportsPermissionChanges`. They return true if a key manager allows for keys to be written or updated. For example the existing `FileKeyManager` will return true for all three since it allows to store and update keys in a file. The new `LdapKeyManager` returns false since it only accesses LDAP and can not add or update any keys in the directory. A future key manager might get keys from an LDAP directory but still keep comments and permissions for it in a local copy. If writing of keys is not supported: * the welcome shell does not suggest adding a key, * the `SshKeysDispatcher` does not offer the "add", "remove", "comment" and "permission" commands, and * the SSH keys panel hides the "delete" button in the key list, and the "Add Key" form. The hiding of the "Add key" form is not perfect since the surrounding div is still shown, but I don't know how to hide it and it didn't look too bad, either.
| * | Retrieve public SSH keys from LDAP.Florian Zschocke2016-11-294-37/+493
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new class `LdapPublicKeyManager` which retrieves public SSH keys from LDAP. The attribute can be configured with the new configuration option `realm.ldap.sshPublicKey`. The setting can be a simple attribute name, like `sshPublicKey`, or an attribute name and a prefix for the value, like `altSecurityIdentities:SshKey`, in which case attributes are selected that have the name `altSecurityIdentities` and whose values start with `SshKey:`.
| * | Extract LdapConnection into new class from LdapAuthProviderFlorian Zschocke2016-11-232-268/+295
| | | | | | | | | | | | | | | | | | | | | | | | Extract the inner class `LdapConnection` from the `LdapAuthProvider` into a separate class, so that it can be used from multiple classes that have to connect to an LDAP directory. The new class is placed into the new package `com.gitblit.ldap`, since it isn't specific to authentication.
* | | Remove duplicate import of class SecureRandomFlorian Zschocke2016-12-151-1/+0
| | | | | | | | | | | | | | | Fixes the build that was broken by cherry-picking commit 2be2c2, which resulted in an import collision on the `SecureRandom` class.
* | | Merge pull request #1167 from fzs/secureCookiesJames Moger2016-12-142-1/+16
|\ \ \ | | | | | | | | Secure cookies
| * | | Set secure session cookies when redirecting from HTTP to HTTPS.merged--secureCookiesFlorian Zschocke2016-12-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | So far for session cookies the secure property was only set when no HTTP port was opened. This changes to also set it when HTTP is redirected to the HTTPS port.
| * | | Set secure user cookies and only for HTTP.Florian Zschocke2016-12-101-0/+14
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | Mark the user authentication cookie to be only used for HTTP, making it inaccessible for JavaScript engines. If only HTTPS is used and no HTTP (i.e. also if HTTP is redirected to HTTPS) then mark the user cookie to be sent only over secure connections.
* | | Merge branch 'rcaa-master' into master.Florian Zschocke2016-12-1312-12/+103
|\ \ \
| * | | Introduce SecureRandom wrapper for properly seeded static instancesFlorian Zschocke2016-12-122-5/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce our own wrapper `SecureRandom` around `java.security.SecureRandom`. This a) makes sure that the PRNG is seeded on creation and not when random bytes are retrieved, and b) uses a static instance in the `UserModel` so that lags do not occur during operation due to potentially seeding getting blocked on Unix when reading from the system's entropy pool. To keep the random data still secure, the static instance will reseed all 24 hours, also a functionality of the wrapper class. This fixes #1063 and extends and closes PR #1116
| * | | changing Math.random to SecureRandomrcaa2016-12-111-1/+5
| | | |
| * | | removing unecessary user cookie codeRodrigo Andrade2016-08-157-8/+8
| | | |
| * | | removing duplicated code for cookie genaration and adding random bytes to ↵Rodrigo Andrade2016-08-155-4/+8
| | | | | | | | | | | | | | | | generate user cookies
* | | | Merge branch 'fixMentionsInTickets-985'Florian Zschocke2016-12-124-6/+15
|\ \ \ \
| * | | | Fix user mention regular expression and group replacement.merged--fixMentionsInTickets-985Florian Zschocke2016-12-104-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regular expression used for user mentions used to work only inside sentences. Also, since it tested for whitespace, the whitespace would get replaced, too, which would join lines together. Instead the new regex uses boundary matchers to match against word boundaires. As these are not capturing only the actual user mention can be captured and is then replaced. Also, this way the regex can ignore punctuation like in "@jim, look at this." Since Gibtlit now requires Java 7 we can use named capture groups. This makes the use of a centrally defined regular expression much safer. The (admittedly only) group to capture the user name is named "user" and can be referenced by this name. By using the name instead of a group number, the regex could be changed without the code using it breaking because the group number changed. A simple test is added for user mentions, which unfortunately has to deal with the full markdown replacement, too. Fixes #985
| * | | | Use REGEX_TICKET_MENTION instead of hardcoded regular expressionGlenn Matthys2016-12-103-3/+6
| | | | |
| * | | | Introduce new constant REGEX_TICKET_MENTIONGlenn Matthys2016-12-101-0/+6
| | |/ / | |/| |
* | | | Merge pull request #1152 from fzs/fixAdminRoleLDAPJames Moger2016-11-181-12/+32
|\ \ \ \ | | |_|/ | |/| | Set "can admin" permission on LDAP users and teams correctly
| * | | Set "can admin" permission on LDAP users and teams correctlymerged--fixAdminRoleLDAPFlorian Zschocke2016-11-181-12/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The canAdmin permission is set on a LDAP user, when the user is listed in `realm.ldap.admins` or is a member of a team listed in `realm.ldap.admins`. This leads to inconsistent and surprising behaviour on the EditUser page when clicking the "can admin" checkbox. Also, the "can admin" checkbox is disabled, but not checked, for teams that are listed as admin teams. The new behaviour implemented in this patch makes users and teams from LDAP match local ones. That means: * LDAP teams that are listed in `realm.ldap.admins` get the canAdmin property set if teams are maintained in LDAP. * LDAP users that are listed in `realm.ldap.admins` get the canAdmin property set if teams are maintained in LDAP. * LDAP users do not get the canAdmin property set, if they are only a member of a team listed in `realm.ldap.admins`. * The `supportsRoleChanges` method for users and teams of the `LdapAuthProvider` unconditially returns false if teams are maintained in LDAP, not only for users and teams listed in `realm.ldap.admins`. * Therefore, for all LDAP users and teams the "can admin" checkbox is always disabled if teams are maintained in LDAP.
* | | | Merge pull request #1147 from tomaswolf/disabled_pager_linksJames Moger2016-11-143-2/+29
|\ \ \ \ | | | | | | | | | | Fix disabled links in PagerPanel
| * | | | Fix disabled links in PagerPanelTom2016-10-313-2/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Disabled links in the PagerPanel (used on the LuceneSearchPage to page through search results) were only rendered as "disabled". The links themselves remained active, which gives strange effects when clicked. For instance it was possible to move to result pages -1, -2, and so on. Really disable the links. Add missing CSS rules to have correct styling as Wicket renders disabled links as spans, not anchors. Include the new CSS file in BasePage.html. And add the left/right arrows only if not on the first/last page.
* | | | | Merge pull request #1149 from fzs/fixLDAPbindingJames Moger2016-11-142-116/+299
|\ \ \ \ \ | |/ / / / |/| / / / | |/ / / Fix LDAP binding strategies
| * | | Update documentation for LDAP binding in default.properties.merged--fixLDAPbindingFlorian Zschocke2016-11-141-2/+15
| | | | | | | | | | | | | | | | | | | | Extend the comments for some realm.ldap.* properties to better explain use cases and requirements.
| * | | Clean up `LdapAuthProvider` to properly cover different LDAP search scenarios.Florian Zschocke2016-11-111-114/+284
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Gitblit allows in its configuration to set a "manager" user (and password) which can be used to search for the entry of a user wanting to log in. If they are both not set, an anonymous search is attempted. In the description below, when I say "...as manager", it is either as manager or anonymous. So far the behaviour of Gitblit, with respect to binding to and searching in LDAP, has been the following when a user logs in: **bind as manager** **search for the user** _bind as the user_ _search for the teams_ I'll call this code flow A. Later an additional configuration option had been added: `realm.ldap.bindpattern`. (PR gitblit/gitblit#162) It was meant to allow for not using a manager nor anonymous binds, by searching the directory as the user logging in. This is done in code flow B: **bind as manager** _bind as user_ _search for user_ _search for teams_ Both A and B are flawed, I think. In A, it looks like a mistake to me that the binding stays with the user after authentication. The problem that this causes is, that in LDAP server configurations where normal users are not allowed to read groups, the team information cannot be retrieved. I tried but failed to understand how B is supposed to work. There will always be a bind request as either anonymous or the manager DN when the LDAP connection is created. If neither is possible, the authentication process will fail and the user cannot log in. When synchronizing users and teams from LDAP, the following code flow is exercised: F: **bind as manager** **search for users** **search for teams** This patch fixes both code flows by introducing a new flow. C: **bind as manager** **search for user** _bind as user to authenticate_ **bind as manager** **search for teams** And it changes code flow B to the following code flow D: _bind as user_ _search for user_ _search for teams_ With code flows A, C, D and F the following usage (and authentication) scenarios are covered. They are described from the view of a Gitblit administrator's intent and his LDAP setup. * Users and team should be snychronized with LDAP This means anonymous or a fixed account must be able to read users and groups. => covered by C and F As the above allows for authentication and is required for synchronisation, all the others below do not cover synchronization. * No anonymous binding allowed and no special manager binding required This means that users must be able to read user an group entries. => covered by D * The user DN needs to be searched, e.g. because they are not all under the same parent DN. This means that anonymous or a fixed account must be able to read users. -- anonymous or the "manager" account can also read groups => covered by C -- anonymous or the "manager" account cannot read groups but a user can => covered by A I therefore believe that the new code will cover all common use cases. The implementation either directly binds as the user, when `bindpattern` is not empty, or it binds anonymous or against the manger DN to search for the user DN entry. If it directly bound against the user DN, the user is already authenticated. It will then only check that the user DN it found in the search is identical to the one it is currently bound against. If it was bound against a manager DN (or anonymously) it will bind against the found user DN to authenticate the user logging in, and will then rebind against the manager DN. When searching for groups in LDAP, if the search fails with a result code other than SUCCESS, the implementation will bind against the user DN, if it isn't already bound against it. It will then repeat the search for groups under the user authorization. This is to keep backwards compatible with the original behaviour A, in order to not break cases where the LDAP setup would deny a manager account to search for groups but allow it for normal users. To achieve this the implementation introduces an internal `LdapConnection` class that wraps the connection and keeps bind state, so that a rebind as a user is possible. This also fixes a resource leak where the connection was not closed in case that the initial bind as the manager account did not succeed. This commit would fix gitblit/gitblit#920
* | | Merge pull request #1144 from fzs/logSendFailedExceptionJames Moger2016-10-281-1/+16
|\ \ \ | | | | | | | | Improve logging when sending email fails.
| * | | Improve logging when sending email fails.merged-logSendFailedExceptionFlorian Zschocke2016-10-271-1/+16
| |/ /
* | | Merge pull request #1142 from fzs/merge-strategyJames Moger2016-10-2810-70/+351
|\ \ \ | | | | | | | | Merge strategy
| * | | Add merge type setting to repository page.merged--merge-strategyFlorian Zschocke2016-10-283-1/+10
| | | | | | | | | | | | | | | | The merge type is a per repository setting. Add it to the edit page.
| * | | Add integration strategy to merge tickes fast-forward or with commit.Florian Zschocke2016-10-287-69/+341
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the option to merge a ticket branch to the integration branch only when it can be fast-forwarded, or always with a merge commit, or by fast-foward if possible, otherwise with a merge commit. Adds a new property ticket.mergeType with the valid values FAST_FOWARD_ONLY, MERGE_ALWAYS and MERGE_IF_NECESSARY. Merging and canMerge were refactored to make use of a new IntegrationStrategy class for each type of strategy.
* | | Issue #1076: load commit cache in a background threadTom2016-10-273-78/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Make the CommitCache fully thread-safe. It was using a ConcurrentHashMap containing lists, but then handed out these lists. It also did multiple operations on that map that as a whole should be atomic. * Use isEmpty() instead of size() == 0. * Run the loading of the commit cache in a background daemon thread
* | | Spelling mistake fixlarsmaes2016-09-161-1/+1
| |/ |/| | | pushedNewBranch was wrongly spelled
* | Merge pull request #1110 from WilliamFromTW/masterJames Moger2016-08-052-714/+725
|\ \ | | | | | | 1.8.x tranditional chinese translation
| * | 1.8.x tranditional chinese translationwilliam2016-08-041-27/+21
| | |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 15:11:29 +0000