aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Always enable caches (#28527)Lunny Xiao2023-12-1914-82/+31
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Improve ObjectFormat interface (#28496)Lunny Xiao2023-12-1939-168/+109
| | | | | | | | | | | | | | | | | | | | | | | The 4 functions are duplicated, especially as interface methods. I think we just need to keep `MustID` the only one and remove other 3. ``` MustID(b []byte) ObjectID MustIDFromString(s string) ObjectID NewID(b []byte) (ObjectID, error) NewIDFromString(s string) (ObjectID, error) ``` Introduced the new interfrace method `ComputeHash` which will replace the interface `HasherInterface`. Now we don't need to keep two interfaces. Reintroduced `git.NewIDFromString` and `git.MustIDFromString`. The new function will detect the hash length to decide which objectformat of it. If it's 40, then it's SHA1. If it's 64, then it's SHA256. This will be right if the commitID is a full one. So the parameter should be always a full commit id. @AdamMajer Please review.
* Fix duplicate ID when deleting repo (#28520)David Øvrelid2023-12-192-4/+4
| | | | | | | | There is an accessibility issue in the interface when attempting to delete a repository. When I click on "Delete repository," a dialog box appears, requiring confirmation to proceed with the repository deletion. However, when I press the "Repo name" label, the wrong input field gains focus. The focused field is located behind the dialog and is intended for renaming the repository.
* chore(api): support ignore password if login source type is LDAP for ↵Bo-Yi Wu2023-12-193-16/+24
| | | | | | | | | | | | creating user API (#28491) - Modify the `Password` field in `CreateUserOption` struct to remove the `Required` tag - Update the `v1_json.tmpl` template to include the `email` field and remove the `password` field --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* Update go dependencies (#28518)wxiaoguang2023-12-195-402/+273
| | | | | Update golang.org/x/crypto for CVE-2023-48795 and update other packages. `go-git` is not updated because it needs time to figure out why some tests fail.
* Bump google/go-github to v57 (#28514)Yevhen Pavlov2023-12-186-12/+13
|
* Only check online runner when detecting matching runners in workflows (#28286)yp053272023-12-183-4/+19
| | | | | | | | | | | Mentioned: [#28277](https://github.com/go-gitea/gitea/issues/28277#issuecomment-1831325276) We should only check online runner when detecting matching runners in workflows, as if runner is not online, the workflow will not run. ![image](https://github.com/go-gitea/gitea/assets/18380374/11855e9d-7241-4b7a-b8d7-49dbb94ba1c5)
* Add orphaned topic consistency check (#28507)Earl Warren2023-12-182-0/+16
| | | | | | | | | | | - If a topic has zero repository count, it means that none of the repositories are using that topic, that would make them 'useless' to keep. One caveat is that if that topic is going to be used in the future, it will be added again to the database, but simply with a new ID. Refs: https://codeberg.org/forgejo/forgejo/pulls/1964 Co-authored-by: Gusted <postmaster@gusted.xyz>
* Improve the prompt for "ssh-keygen sign" (#28509)wxiaoguang2023-12-181-1/+1
| | | | | Close #28505, ref: * https://github.com/go-gitea/gitea/pull/20112#issuecomment-1165423026 * https://github.com/go-gitea/gitea/issues/28505#issuecomment-1860048116
* [skip ci] Updated translations via CrowdinGiteaBot2023-12-181-2/+2
|
* Add option to disable ambiguous unicode characters detection (#28454)wxiaoguang2023-12-1717-147/+111
| | | | | | | | * Close #24483 * Close #28123 * Close #23682 * Close #23149 (maybe more)
* Adjust object format interface (#28469)Lunny Xiao2023-12-1754-202/+190
| | | | | | | - Remove `ObjectFormatID` - Remove function `ObjectFormatFromID`. - Use `Sha1ObjectFormat` directly but not a pointer because it's an empty struct. - Store `ObjectFormatName` in `repository` struct
* Remove duplicate option in admin screen and now-unused translation keys (#28492)The Magician2023-12-172-3/+0
| | | | | | | | | | | | | Resolves https://github.com/go-gitea/gitea/issues/28451. This change follows the recommendation by wxiaoguang to remove the "Disable Minimum Key Size Check" from the "Service Configuration" section of the UI, because this option belongs to the "SSH Configuration" section of the administration menu and already has a functioning indicator in that section of the UI. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* [skip ci] Updated translations via CrowdinGiteaBot2023-12-171-7/+24
|
* Initalize stroage for orphaned repository doctor (#28487)Earl Warren2023-12-161-0/+5
| | | | | | | | | | - When a repository is orphaned and has objects stored in any of the storages such as repository avatar or attachments the delete function would error, because the storage module wasn't initalized. - Add code to initialize the storage module. Refs: https://codeberg.org/forgejo/forgejo/pulls/1954 Co-authored-by: Gusted <postmaster@gusted.xyz>
* Update docs for DISABLE_QUERY_AUTH_TOKEN (#28485)Kyle D2023-12-151-0/+1
| | | | As described [here](https://github.com/go-gitea/gitea/pull/28390#issuecomment-1857553331).
* Improve CLI code and descriptions (#28482)wxiaoguang2023-12-1512-37/+27
| | | | | | | | | | * Close #28444 * Actually, it doesn't need to use that trick because it looks like it is not necessary, no user really needs it * Remove the hidden (legacy) "doctor" subcommand and update documents * Fix "actions" usage ![image](https://github.com/go-gitea/gitea/assets/2114189/3c2b34a7-4f92-4a6c-96fd-9505e413d4ec)
* Remove unnecessary forgot password link in delete user section (#28355)yp053272023-12-151-1/+0
| | | | | | | | | Before: <img width="458" alt="image" src="https://github.com/go-gitea/gitea/assets/18380374/92815496-38cc-4bb9-9182-1509a72b07f6"> After: ![image](https://github.com/go-gitea/gitea/assets/18380374/d96ed908-47ad-44cc-a624-4c10fa8c8c86)
* Refactor SSH clone URL generation code (#28421)wxiaoguang2023-12-152-13/+42
| | | Refactor the code and add tests, keep the old logic.
* Polyfill SubmitEvent for PaleMoon (#28441)wxiaoguang2023-12-156-7/+31
|
* Fix Chinese translation of config cheat sheet[API] (#28472)CaiCandong2023-12-151-4/+5
|
* Add combined index for issue_user.uid and issue_id (#28080)sebastian-sauer2023-12-146-2/+100
| | | | | | | | fixes #27877 --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix documents for "custom/public/assets/" (#28465)wxiaoguang2023-12-145-8/+8
| | | Fix #28463
* Only use SHA256 feature when git >= 2.42 (#28466)wxiaoguang2023-12-144-12/+11
| | | And fix some comments
* Retry SSH key verification with additional CRLF if it failed (#28392)nekrondev2023-12-141-4/+9
| | | | | | | | | | Windows-based shells will add a CRLF when piping the token into ssh-keygen command resulting in verification error. This resolves #21527. --------- Co-authored-by: Heiko Besemann <heiko.besemann@qbeyond.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Abstract hash function usage (#28138)Adam Majer2023-12-13122-592/+945
| | | | | | Refactor Hash interfaces and centralize hash function. This will allow easier introduction of different hash function later on. This forms the "no-op" part of the SHA256 enablement patch.
* Add endpoint for not implemented Docker auth (#28457)KN4CK3R2023-12-132-1/+15
| | | | | | | | | | Recently Docker started to use the optional `POST /v2/token` endpoint which should respond with a `404 Not Found` status code instead of the current `405 Method Not Allowed`. > Note: Not all token servers implement oauth2. If the request to the endpoint returns 404 using the HTTP POST method, refer to Token Documentation for using the HTTP GET method supported by all token servers.
* docs: Update group membership fields to match application. (#28175)David Hulick2023-12-131-9/+9
| | | | | | | | Several fields in the "Verify group membership in LDAP" docs were confusingly titled when compared to the actual fields in the application, this change rectifies that by matching the docs to the fields already present in gitea. Signed-off-by: David Hulick <dave.hulick@gmail.com>
* [skip ci] Updated translations via CrowdinGiteaBot2023-12-131-0/+3
|
* Fix possible nil pointer access (#28428)KN4CK3R2023-12-124-28/+14
| | | | There could be a nil pointer exception if the file is not found because that specific error is suppressed but not handled.
* Don't show unnecessary citation JS error on UI (#28433)wxiaoguang2023-12-121-4/+11
| | | Fix #28226
* Do some missing checks (#28423)Lunny Xiao2023-12-123-3/+62
|
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-125-7/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
* [skip ci] Updated translations via CrowdinGiteaBot2023-12-1227-319/+87
|
* Let `curl` write the content to file (#28427)KN4CK3R2023-12-121-1/+1
|
* Improve doctor cli behavior (#28422)wxiaoguang2023-12-113-34/+66
| | | | | | 1. Do not sort the "checks" slice again and again when "Register", it just wastes CPU when the Gitea instance runs 2. If a check doesn't exist, tell the end user 3. Add some tests
* Second part of refactor `db.Find` (#28194)Lunny Xiao2023-12-1114-222/+149
| | | Continue of #27798 and move more functions to `db.Find` and `db.Count`.
* Fix commit status in repo list (#28412)yp053272023-12-112-2/+4
| | | | | | | | | | | | | | | Before: ![image](https://github.com/go-gitea/gitea/assets/18380374/00edf23a-aee1-4177-a12c-bd03ae14e65e) ![image](https://github.com/go-gitea/gitea/assets/18380374/0663e443-682c-4a68-b14e-a0fa0e4c3716) `TestOrg/testactions` does have commit status, but won't display in `All` After: ![image](https://github.com/go-gitea/gitea/assets/18380374/7231db29-9c4e-484f-afa2-87db19be19b8) Same to #26179.
* [skip ci] Updated licenses and gitignoresGiteaBot2023-12-111-0/+15
|
* Actually recover from a panic in cron task (#28409)Earl Warren2023-12-101-5/+7
| | | | | | | | | | | | | | - Currently there's code to recover gracefully from panics that happen within the execution of cron tasks. However this recover code wasn't being run, because `RunWithShutdownContext` also contains code to recover from any panic and then gracefully shutdown Forgejo. Because `RunWithShutdownContext` registers that code as last, that would get run first which in this case is not behavior that we want. - Move the recover code to inside the function, so that is run first before `RunWithShutdownContext`'s recover code (which is now a noop). Fixes: https://codeberg.org/forgejo/forgejo/issues/1910 Co-authored-by: Gusted <postmaster@gusted.xyz>
* Fix missing check (#28406)Lunny Xiao2023-12-102-4/+24
|
* Also sync DB branches on push if necessary (#28361)Lunny Xiao2023-12-099-73/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix #28056 This PR will check whether the repo has zero branch when pushing a branch. If that, it means this repository hasn't been synced. The reason caused that is after user upgrade from v1.20 -> v1.21, he just push branches without visit the repository user interface. Because all repositories routers will check whether a branches sync is necessary but push has not such check. For every repository, it has two states, synced or not synced. If there is zero branch for a repository, then it will be assumed as non-sync state. Otherwise, it's synced state. So if we think it's synced, we just need to update branch/insert new branch. Otherwise do a full sync. So that, for every push, there will be almost no extra load added. It's high performance than yours. For the implementation, we in fact will try to update the branch first, if updated success with affect records > 0, then all are done. Because that means the branch has been in the database. If no record is affected, that means the branch does not exist in database. So there are two possibilities. One is this is a new branch, then we just need to insert the record. Another is the branches haven't been synced, then we need to sync all the branches into database.
* Remove stale since giteabot has similiar feature (#28401)Lunny Xiao2023-12-091-54/+0
| | | Replace #27447
* [skip ci] Updated translations via CrowdinGiteaBot2023-12-092-36/+43
|
* Improve text in Security settings (#28393)Panagiotis "Ivory" Vasilopoulos2023-12-083-7/+13
| | | | | | | | - en-US: Rename "Scratch Tokens" to "single-use recovery keys". Longer, but clearer. - Improve titles - TOTP: Improve description - TOTP: Inform user about Scratch Tokens to encourage TOTP usage - WebAuthn: Add loss of access warning
* Fix Docker meta action for releases (#28232)John Olheiser2023-12-072-3/+4
| | | | | | | | | | | | | | | | | Should fix #28229 and #28230 for next release. Assuming I'm reading the docs correctly for the docker meta action: https://github.com/docker/metadata-action#flavor-input https://github.com/docker/metadata-action#latest-tag 1. We want `latest=false` for the RCs. 2. `latest` should happen already due to `auto` mode, however there's an extra option for the `suffix` flavor. This PR is ready, but leaving it as draft to make sure someone double-checks my sleuth-work. Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Make gogit Repository.GetBranchNames consistent (#28348)Adam Majer2023-12-071-13/+28
|
* Remove GetByBean method because sometimes it's danger when query condition ↵Lunny Xiao2023-12-0728-174/+189
| | | | | | | | | | | | | | | | | | | | parameter is zero and also introduce new generic methods (#28220) The function `GetByBean` has an obvious defect that when the fields are empty values, it will be ignored. Then users will get a wrong result which is possibly used to make a security problem. To avoid the possibility, this PR removed function `GetByBean` and all references. And some new generic functions have been introduced to be used. The recommand usage like below. ```go // if query an object according id obj, err := db.GetByID[Object](ctx, id) // query with other conditions obj, err := db.Get[Object](ctx, builder.Eq{"a": a, "b":b}) ```
* Include public repos in doer's dashboard for issue search (#28304)Jason Song2023-12-077-221/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It will fix #28268 . <img width="1313" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/cb1e07d5-7a12-4691-a054-8278ba255bfc"> <img width="1318" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/4fd60820-97f1-4c2c-a233-d3671a5039e9"> ## :warning: BREAKING :warning: But need to give up some features: <img width="1312" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/281c0d51-0e7d-473f-bbed-216e2f645610"> However, such abandonment may fix #28055 . ## Backgroud When the user switches the dashboard context to an org, it means they want to search issues in the repos that belong to the org. However, when they switch to themselves, it means all repos they can access because they may have created an issue in a public repo that they don't own. <img width="286" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/182dcd5b-1c20-4725-93af-96e8dfae5b97"> It's a confusing design. Think about this: What does "In your repositories" mean when the user switches to an org? Repos belong to the user or the org? Whatever, it has been broken by #26012 and its following PRs. After the PR, it searches for issues in repos that the dashboard context user owns or has been explicitly granted access to, so it causes #28268. ## How to fix it It's not really difficult to fix it. Just extend the repo scope to search issues when the dashboard context user is the doer. Since the user may create issues or be mentioned in any public repo, we can just set `AllPublic` to true, which is already supported by indexers. The DB condition will also support it in this PR. But the real difficulty is how to count the search results grouped by repos. It's something like "search issues with this keyword and those filters, and return the total number and the top results. **Then, group all of them by repo and return the counts of each group.**" <img width="314" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/5206eb20-f8f5-49b9-b45a-1be2fcf679f4"> Before #26012, it was being done in the DB, but it caused the results to be incomplete (see the description of #26012). And to keep this, #26012 implement it in an inefficient way, just count the issues by repo one by one, so it cannot work when `AllPublic` is true because it's almost impossible to do this for all public repos. https://github.com/go-gitea/gitea/blob/1bfcdeef4cca0f5509476358e5931c13d37ed1ca/modules/indexer/issues/indexer.go#L318-L338 ## Give up unnecessary features We may can resovle `TODO: use "group by" of the indexer engines to implement it`, I'm sure it can be done with Elasticsearch, but IIRC, Bleve and Meilisearch don't support "group by". And the real question is, does it worth it? Why should we need to know the counts grouped by repos? Let me show you my search dashboard on gitea.com. <img width="1304" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/2bca2d46-6c71-4de1-94cb-0c9af27c62ff"> I never think the long repo list helps anything. And if we agree to abandon it, things will be much easier. That is this PR. ## TODO I know it's important to filter by repos when searching issues. However, it shouldn't be the way we have it now. It could be implemented like this. <img width="1316" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/99ee5f21-cbb5-4dfe-914d-cb796cb79fbe"> The indexers support it well now, but it requires some frontend work, which I'm not good at. So, I think someone could help do that in another PR and merge this one to fix the bug first. Or please block this PR and help to complete it. Finally, "Switch dashboard context" is also a design that needs improvement. In my opinion, it can be accomplished by adding filtering conditions instead of "switching".
* Issue fixes for RSS feed improvements (#28380)Panagiotis "Ivory" Vasilopoulos2023-12-072-4/+4
| | | | | | Follow-up for #28368 - Just replace button with an a-element with the button class - Remove useless link-action class from template/org/home.tmpl
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 06:09:09 +0000