aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix the bug: deploy key with write access can not push (#19010) (#19182)zeripath2022-03-2311-64/+78
| | | | | | | | | Backport #19010 Use DeployKeyID to replace the IsDeployKey, then CanWriteCode uses the DeployKeyID to check the write permission. Fix #19009 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Try to prevent autolinking of displaynames by email readers (#19169) (#19183)zeripath2022-03-238-22/+38
| | | | | | | | | | | | | | | Backport #19169 Unfortunately many email readers will (helpfully) detect url or url-like names and automatically create links to them, even in HTML emails. This is not ideal when usernames can have dots in them. This PR tries to prevent this behaviour by sticking ZWJ characters between dots and also set the meta tag to prevent format detection. Not every email template has been changed in this way - just the activation emails but it may be that we should be setting the above meta tag in all of our emails too. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Clean paths when looking in Storage (#19124) (#19179)zeripath2022-03-234-56/+46
| | | | | | | | | | | | | | | | Backport #19124 * Clean paths when looking in Storage Ensure paths are clean for minio aswell as local storage. Use url.Path not RequestURI/EscapedPath in storageHandler. Signed-off-by: Andrew Thornton <art27@cantab.net> * Apply suggestions from code review Co-authored-by: Lauris BH <lauris@nix.lv>
* Cleanup protected branches when deleting users & teams (#19158) (#19174)Norwin2022-03-233-2/+103
| | | | | | | | | | | | | | | | * Clean up protected_branches when deleting user fixes #19094 * Clean up protected_branches when deleting teams * fix issue Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Ensure that setting.LocalURL always has a trailing slash (#19171) (#19177)zeripath2022-03-231-1/+4
| | | | | | | | | Backport #19171 Fix #19166 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use the new/choose link for New Issue on project page (#19172) (#19176)zeripath2022-03-233-5/+12
| | | | | | | | | | | | | Backport #19172 Extend issues/new/choose to pass the project id and change New Issue link on project page to use new/choose Fix #19170 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use IterateBufferSize whilst querying repositories during adoption check ↵zeripath2022-03-221-0/+7
| | | | | | | | | | | | | | | (#19140) (#19160) Backport #19140 The adoption page checks directories to see if they are repositories by querying the db on a per user basis. This can lead to problems if a user has a large number of repositories or putative repositories. This PR changes the buffering to check the db in IterataeBufferSize batches instead. Fix #19137 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Ensure isSSH is set whenever DISABLE_HTTP_GIT is set (#19028) (#19146)zeripath2022-03-211-12/+19
| | | | | | | | | Backport #19028 When DISABLE_HTTP_GIT is set we should always show the SSH button Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Use custom favicon when viewing static files if it exists (#19130) (#19152)Abheek Dhawan2022-03-201-0/+5
| | | | | | | Redirect `/favicon.ico` to `/assets/img/favicon.png`. Fix #19109 Co-authored-by: zeripath <art27@cantab.net>
* Fix NPE /repos/issues/search when not signed in (#19154) (#19155)Gusted2022-03-201-5/+10
| | | | | | - Backport #19154 - Don't panic when on `/repos/issues/search?{created,assigned,mentioned,review_requested}=true` when client didn't pass any authentication. - Resolves #19115
* Fix wrong scopes caused by empty scope input (#19029) (#19145)zeripath2022-03-211-1/+13
| | | | Backport #19029 Fix #18972 Gitea prepends requested openid scope with + after updating authentication source
* Fix the editor height in review box (#19003) (#19147)zeripath2022-03-202-1/+9
| | | | | | | Backport #19003 Fix the height problem in https://github.com/go-gitea/gitea/pull/18862#issuecomment-1059329539 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Do not send notification emails to inactive users (#19131) (#19139)zeripath2022-03-194-5/+17
| | | | | | | | | | | | Backport #19131 Backport #19142 Emails should not be sent to inactive users except for Activate and ResetPassword messages. Fix #18950 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Bump to build with go1.18 (#19120 et al) (#19127)techknowlogick2022-03-1916-338/+1053
| | | | | | | | | | | | | | | | | Backport #19120 Backport #19099 Backport #18874 Backport #18420 Backport #19128 Backport #18270 Bump to build with go1.18 Co-authored-by: techknowlogick <techknowlogick@gitea.io> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Jelle Hulter <jellehulter@gmail.com>
* Make migrations SKIP_TLS_VERIFY apply to git too (#19132) (#19141)zeripath2022-03-193-32/+39
| | | | | | | | | | Backport #19132 Make SKIP_TLS_VERIFY apply to git data migrations too through adding the `-c http.sslVerify=false` option to the git clone command. Fix #18998 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Do not send activation email if manual confirm is set (#19119) (#19122)zeripath2022-03-192-0/+8
| | | | | | | | | | | Backport #19119 If the mailer is configured then even if Manual confirm is set an activation email is still being sent because `handleUserCreated` is not checking for this case. Fix #17263 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Update golang.org/x/crypto (#19097) (#19098)Gusted2022-03-193-59/+3
| | | | | | | | | | | | Backport #19097 * Update golang.org/x/crypto (#19097) - Backport #19097 * Fix deprecation notice * Backport workaround removal
* Handle email address not exist (#19089) (#19121)Lunny Xiao2022-03-197-28/+40
| | | | | | | | | Backport #19089 * Handle email address not exist. (#19089) * Fix lint about strings.Title Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Update json-iterator (#18644) (#19100)Gusted2022-03-152-3/+5
| | | - Backport #18644
* Changelog v1.16.4 (#19081)v1.16.465432022-03-141-0/+22
|
* Restrict email address validation (#17688) (#19085)65432022-03-149-14/+111
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix lfs bug (#19072) (#19080)65432022-03-143-3/+82
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor mirror code & fix `StartToMirror` (#18904) (#19075)Gusted2022-03-141-13/+17
| | | - Backport #18904.
* Update the webauthn_credential_id_sequence in Postgres (#19048) (#19060)zeripath2022-03-132-2/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #19048 There is (yet) another problem with v210 in that Postgres will silently allow preset ID insertions ... but it will not update the sequence value. This PR simply adds a little step to the end of the v210 migration to update the sequence number. Users who have already migrated who find that they cannot insert new webauthn_credentials into the DB can either run: ```bash gitea doctor recreate-table webauthn_credential ``` or ```bash SELECT setval('webauthn_credential_id_seq', COALESCE((SELECT MAX(id)+1 FROM `webauthn_credential`), 1), false) ``` which will fix the bad sequence. Fix #19012 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Prevent 500 when there is an error during new auth source post (#19041) (#19059)zeripath2022-03-133-5/+5
| | | | | | | Backport #19041 Fix #19036 Signed-off-by: Andrew Thornton <art27@cantab.net>
* If rendering has failed due to a net.OpError stop rendering (attempt 2) ↵zeripath2022-03-101-1/+1
| | | | | | | | | | | | | | | | | (#19049) (#19056) Backport #19049 Unfortunately #18642 does not work because a `*net.OpError` does not implement the `Is` interface to make `errors.Is` work correctly - thus leading to the irritating conclusion that a `*net.OpError` is not a `*net.OpError`. Here we keep the `errors.Is` because presumably this will be fixed at some point in the golang main source code but also we add a simply type cast to also check. Fix #18629 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix flag validation (#19046) (#19051)Norwin2022-03-101-1/+1
| | | | Regression from #5785
* Improve SyncMirrors logging (#19045) (#19050)zeripath2022-03-104-43/+57
| | | | | | | | | | Backport #19045 Yet another issue has come up where the logging from SyncMirrors does not provide enough context. This PR adds more context to these logging events. Related #19038 Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix pam authorization (#19040) (#19047)65432022-03-101-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Backport #19040 The PAM module has previously only checked the results of the authentication module. However, in normal PAM practice most users will expect account module authorization to also be checked. Without doing this check in almost every configuration expired accounts and accounts with expired passwords will still be able to login. This is likely to represent a significant gotcha in most configurations and cause most users configurations to be potentially insecure. Therefore we should add in the account authorization check. ## :warning: **BREAKING** :warning: Users of the PAM module who rely on account modules not being checked will need to change their PAM configuration. However, as it is likely that the vast majority of users of PAM will be expecting account authorization to be checked in addition to authentication we should make this breaking change to make the default behaviour correct for the majority. --- I suggest we backport this despite the BREAKING nature because of the surprising nature of this. Thanks to @ysf for bringing this to our attention. Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: ysf <34326+ysf@users.noreply.github.com>
* Ignore missing comment for user notifications (#18954) (#19043)zeripath2022-03-102-4/+5
|
* Set `rel="nofollow noindex"` on new issue links (#19023) (#19042)zeripath2022-03-091-1/+1
| | | | | | | Backport #19023 Fix #19018 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Upgrading binding package (#19034) (#19035)Lunny Xiao2022-03-092-4/+5
| | | | | Backport #19034 Fix #18855
* Don't show context cancelled errors in attribute reader (#19006) (#19027)zeripath2022-03-081-1/+3
| | | | | | | | | | Backport #19006 Fix #18997 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix update hint bug (#19002)Lunny Xiao2022-03-041-1/+1
|
* Fix potential assignee query for repo (#18994) (#18999)Otto Richter (fnetX)2022-03-052-1/+19
| | | | | | | | | * Fix potential assignee query for repo * Add tests for `GetRepoAssignees` - As per https://github.com/go-gitea/gitea/pull/18994#issuecomment-1058506640 Co-authored-by: Gusted <williamzijl7@hotmail.com>
* allow overwrite artifacts for github releases (#18987) (#18988)65432022-03-031-1/+2
|
* Changelog for v1.16.3 (#18966)v1.16.3Lunny Xiao2022-03-031-0/+29
| | | | | | | | | | | | | | * Changelog for v1.16.3 * Update CHANGELOG.md * Apply suggestions from code review * Apply suggestions from code review Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <williamzijl7@hotmail.com>
* git backend ignore replace objects (#18979) (#18980)65432022-03-021-0/+2
| | | Co-authored-by: zeripath <art27@cantab.net>
* Set max text height to prevent overflow (#18862) (#18977)Otto Richter (fnetX)2022-03-021-1/+1
| | | | | | | | | | | | | | Sets a max height for review text boxes to prevent a very annoying bug where users cannot access the "submit" button. Before: ![image](https://user-images.githubusercontent.com/12700993/155253001-e1dab086-aaf3-4338-889d-6a861728274a.png) After: ![image](https://user-images.githubusercontent.com/12700993/155253144-5b9a3547-9582-412f-867f-41a45a14a0fe.png) Interestingly, I don't see this bug on Firefox. Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Fix problem when self-assign notification (#18797) (#18976)Otto Richter (fnetX)2022-03-021-1/+1
| | | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* backport fix of #18973 (#18974)65432022-03-021-1/+1
|
* Refactor admin user filter query parameters (#18965) (#18975)Otto Richter (fnetX)2022-03-024-11/+14
| | | | | | Only pass `status_filter` on admin page Use a more general method to pass query parameters, remove hard-coded keys Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Accounts with WebAuthn only (no TOTP) now exist ... fix code to handle that ↵65432022-03-022-16/+45
| | | | case (#18897) (#18964)
* Send 404 on `/{org}.gpg` (#18959) (#18962)Gusted2022-03-011-2/+10
|
* Fix admin user list pagination (#18957) (#18960)Otto Richter (fnetX)2022-03-012-0/+10
|
* Fix lfs management setting (#18947)Lunny Xiao2022-03-011-4/+4
|
* Backport locales from master (#18944)65432022-02-288-153/+264
| | | | | | | | | | | | | | | * update * clean * clean2 * clean2 * clean-next * cleanup * finish cleanup
* Fix login with email panic when email is not exist (#18942)Lunny Xiao2022-02-281-1/+1
| | | Co-authored-by: 6543 <6543@obermui.de>
* Adjust error for already locked db and prevent level db lock on malformed ↵zeripath2022-02-281-6/+42
| | | | | | | | | | | | | connstr (#18923) (#18938) Backport #18923 This PR adjusts the error returned when there is failure to lock the level db, and permits a connections to the same leveldb where there is a different connection string. Reference #18921 Reference #18917 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Update go-org to v1.6.1 (#18932) (#18933)Gusted2022-02-272-6/+4
| | | Backport #18932
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-11 07:26:47 +0000