diff options
| author | Norwin <noerw@users.noreply.github.com> | 2021-05-31 08:25:47 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-31 04:25:47 -0400 |
| commit | cb940c4312981893fdb54cbd0e07520546776b34 (patch) | |
| tree | 69ade3dd15712647ba04186008d3ffab203edf49 /modules/migrations/base | |
| parent | 256b1a35615487f27878422f877f25be3f066f54 (diff) | |
| download | gitea-cb940c4312981893fdb54cbd0e07520546776b34.tar.gz gitea-cb940c4312981893fdb54cbd0e07520546776b34.zip | |
Encrypt migration credentials at rest (#15895)
* encrypt migration credentials in task persistence
Not sure this is the best approach, we could encrypt the entire
`PayloadContent` instead. Also instead of clearing individual fields in
payload content, we could just delete the task once it has
(successfully) finished..?
* remove credentials of past migrations
* only run DB migration for completed tasks
* fix binding
* add omitempty
* never serialize unencrypted credentials
* fix import order
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Diffstat (limited to 'modules/migrations/base')
| -rw-r--r-- | modules/migrations/base/options.go | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/modules/migrations/base/options.go b/modules/migrations/base/options.go index f1d9f81e57..b12e1f94aa 100644 --- a/modules/migrations/base/options.go +++ b/modules/migrations/base/options.go @@ -11,10 +11,13 @@ import "code.gitea.io/gitea/modules/structs" // this is for internal usage by migrations module and func who interact with it type MigrateOptions struct { // required: true - CloneAddr string `json:"clone_addr" binding:"Required"` - AuthUsername string `json:"auth_username"` - AuthPassword string `json:"auth_password"` - AuthToken string `json:"auth_token"` + CloneAddr string `json:"clone_addr" binding:"Required"` + CloneAddrEncrypted string `json:"clone_addr_encrypted,omitempty"` + AuthUsername string `json:"auth_username"` + AuthPassword string `json:"-"` + AuthPasswordEncrypted string `json:"auth_password_encrypted,omitempty"` + AuthToken string `json:"-"` + AuthTokenEncrypted string `json:"auth_token_encrypted,omitempty"` // required: true UID int `json:"uid" binding:"Required"` // required: true |