aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Reset locale on login (#17734)zeripath2021-11-203-0/+10
| | | | | | | | | When logging in reset the user's locale to ensure that it matches their preferred locale. Fix #15612 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Extract constant names out for the ReverseProxy and Basic authentication ↵zeripath2021-11-205-5/+11
| | | | | | | | | methods (#17735) In order to reduce load on the GC extract out the constant names of the Basic and ReverseProxy methods. As mentioned in https://github.com/go-gitea/gitea/pull/15119#discussion_r730352176 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Enable show more files in diff for git <2.31 (#17733)zeripath2021-11-204-32/+253
| | | | | | | | | | | | | Unfortunately due to a misread on my behalf I missed that git diff only learned --skip-to in version 2.31.0. Thus this functionality was not working on older versions of git. This PR adds a handler that simply allows for us to skip reading the diffs until we find the correct file to skip to. Fix #17731 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Make a.add-code-comment click handler an event handler (#17737)zeripath2021-11-201-1/+1
| | | | | | | | | Instead of directly attaching the add-code-comment on click handler to the a.add-code-comment elements - make this an event handler on the document instead. Fix #17736 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Use `hostmatcher` to replace `matchlist`, improve security (#17605)wxiaoguang2021-11-2033-292/+376
| | | | | Use hostmacher to replace matchlist. And we introduce a better DialContext to do a full host/IP check, otherwise the attackers can still bypass the allow/block list by a 302 redirection.
* Make SSL cipher suite configurable (#17440)zeripath2021-11-209-54/+266
|
* Fix correct usage of teams (#17732)Gusted2021-11-202-2/+8
| | | | | | | - `.Teams` isn't a field on the User type, thus using the seperate loaded teams. - Add a space between `PathEscape` and argument. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [skip ci] Updated translations via CrowdinGiteaBot2021-11-202-0/+55
|
* Better builtin avatar generator (#17707)wxiaoguang2021-11-2019-376/+417
| | | | | | | This PR fixes the builtin avatar generator. 1. The random background color makes some images very dirty. So now we only use white background for avatars. 2. We use left-right mirror avatars to satisfy #14799 3. Fix a small padding error in the algorithm
* Add settings to allow different SMTP envelope from address (#17479)zeripath2021-11-194-10/+43
| | | | | | | | | | | * Add settings to allow different SMTP envelope from address Sometimes it may be advisable to hide or alias the from address on an SMTP mail envelope. This PR adds two new options to the mailer to allow setting of an overriding from address. Fix #17477 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow Token API calls be authorized using the reverse-proxy header (#15119)Paweł Bogusławski2021-11-191-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * API calls authorized with HTTP header This mod allows API calls to be authorized with HTTP header when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled. Without it user authenticated by reverse proxy is able to access gitea UI but not API which is inconsistent. Author-Change-Id: IB#1107572 * Fixed API calls authorized with HTTP header Only reqBasicAuth is modified to allow reverse proxy auth as alternative and reqToken is left untouched. Fixes: dc952c063206d11504085ddea966f121e796a04c Author-Change-Id: IB#1107572 * Reverse proxy API auth separated in docs Related: https://github.com/go-gitea/gitea/pull/15119#discussion_r621322127 Author-Change-Id: IB#1107572 * Reverse proxy API auth separated in docs Related: https://github.com/go-gitea/gitea/pull/15119#discussion_r621322127 Author-Change-Id: IB#1107572 * Reverse proxy API auth separated Related: https://github.com/go-gitea/gitea/pull/15119#discussion_r621322127 Author-Change-Id: IB#1107572 * ReverseProxyAuth removed from swagger ReverseProxyAuth removed from swagger as in upstream's suggestion. Related: https://github.com/go-gitea/gitea/pull/15119#pullrequestreview-692180940 Author-Change-Id: IB#1107572 * ReverseProxyAuth API authorization fixed Related: https://github.com/go-gitea/gitea/pull/15119#issuecomment-868465099 Author-Change-Id: IB#1107572 * ReverseProxyAuth API authorization fixed Related: https://github.com/go-gitea/gitea/pull/15119#issuecomment-868465099 Author-Change-Id: IB#1107572
* Move attachment into models/repo/ (#17650)Lunny Xiao2021-11-1939-408/+471
| | | | | | | * Move attachment into models/repo/ * Fix test * Fix bug
* Use a standalone struct name for Organization (#17632)Lunny Xiao2021-11-1943-259/+335
| | | | | | | | | | | | | | | | | | | | | * Use a standalone struct name for Organization * recover unnecessary change * make the code readable * Fix template failure * Fix template failure * Move HasMemberWithUserID to org * Fix test * Remove unnecessary user type check * Fix test Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Prevent double sanitize (#16386)KN4CK3R2021-11-193-64/+48
| | | | | | | | * Prevent double sanitize. * Use SanitizeReaderToWriter. At the moment `actualRender` uses `SanitizeReader` to sanitize the output. But `SanitizeReader` gets called in `markup.render` too so the output gets sanitized twice. I moved the `SanitizeReader` call into `RenderRaw` because this method does not use `markup.render`. I would like to remove the `RenderRaw`/`RenderRawString` methods too because they are only called from tests, the fuzzer and the `/markup/raw` api endpoint. This endpoint is not in use so I think we could remove them. If we really in the future need a method to render markdown without PostProcessing we could achieve this with a more flexible `renderer.NeedPostProcess` method.
* Added comment for changing issue ref (#17672)Gusted2021-11-194-1/+41
| | | | | * Added comment for changing issue ref - Add a comment when someone changes the ref(erence?) of a issue.
* Remove unused `user` paramater (#17723)Gusted2021-11-191-3/+3
| | | | | As title
* Prepare and check test env during CI (#17725)wxiaoguang2021-11-193-14/+69
| | | | | | | | | | This PR should resolve the permission problems during CI, if the uid doesn't match, a more clear message is shown. * CI fails with unknown permission problems #17710 The new drone step dependencies: (root)prepare-test-env -> (gitea)build -> (gitea)test
* Fix bug when project board get open issue number (#17703)Lunny Xiao2021-11-191-1/+3
| | | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* perf: sent `data-path` once for each file (#17657)Gusted2021-11-195-11/+11
| | | | | | | | | | | | | | - Don't sent it with each line, instead send it at the top-element for each file. - Related: https://github.com/go-gitea/gitea/pull/17618#issuecomment-968192761 2.5K Additions: No-Patch: Unified: 2.14 MB (2.14 MB size) Split: 2.59 MB (2.59 MB size) Patch: Unified: 2.10 MB (2.10 MB size) (-1.8%) Split: 2.55 MB (2.55 MB size) (-1.5%)
* Prevent deadlock in TestPersistableChannelQueue (#17717)zeripath2021-11-191-0/+33
| | | | | | | | | | | | * Prevent deadlock in TestPersistableChannelQueue There is a potential deadlock in TestPersistableChannelQueue due to attempting to shutdown the test queue before it is ready. Signed-off-by: Andrew Thornton <art27@cantab.net> * prevent npe Signed-off-by: Andrew Thornton <art27@cantab.net>
* [skip ci] Updated translations via CrowdinGiteaBot2021-11-191-0/+2
|
* Move user/org deletion to services (#17673)KN4CK3R2021-11-1924-301/+382
|
* Refactor repo-legacy.js, remove messy global variables. Fix errors. (#17646)wxiaoguang2021-11-194-202/+199
| | | | | Refactor repo-legacy.js, remove messy global variables. Fix errors. Fix an error in Sortable Fix a incorrect call assignMenuAttributes from the template
* Fix Migrate Description (#17692)99rgosse2021-11-181-0/+1
| | | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add pagination to fork list (#17639)Gusted2021-11-182-2/+15
| | | | | - Resolves #14574 - Adds the necessary code to have pagination working in the forks list of a repo. The code is mostly in par with the stars/watcher implementation.
* Fix possible panic (#17694)Gusted2021-11-181-5/+4
| | | | | - The code will get the first and second character `link[{0,1]]`. However in a rare case the `link` could have 1 character and thus the `link[1]` will create a panic.
* Simplify code for wrting SHA to name-rev (#17696)Gusted2021-11-181-17/+8
|
* Prevent NPE due to missing repo in regression in #17551 (#17697)zeripath2021-11-181-2/+14
|
* Move task from modules to services (#17680)Lunny Xiao2021-11-184-2/+2
|
* Move user functions into user.go (#17659)Lunny Xiao2021-11-1814-72/+101
| | | | | * Move user functions into user.go * Fix test
* Cleanup and use global style on popups (#17674)silverwind2021-11-1838-121/+129
| | | | | | | | | | | | | * Cleanup and use global style on popups - Fix typo 'poping' to 'popping' - Remove most inline 'data-variation' attributes - Initialize all popups with 'inverted tiny' variation * misc tweaks * rename to .tooltip, use jQuery Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Remove unnecessary variable assignments (#17695)Gusted2021-11-1832-72/+59
| | | | | | | | | | * Remove unnecessary variable assignments As title * enable ineffassign Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* [skip ci] Updated translations via CrowdinGiteaBot2021-11-1827-507/+124
|
* Fixed commit count. (#17698)KN4CK3R2021-11-178-32/+35
| | | | Added "Tag" label. Unified branch, tag and commit name.
* Add .gitattribute assisted language detection to blame, diff and render (#17590)zeripath2021-11-1713-95/+221
| | | | | | | Use check attribute code to check the assigned language of a file and send that in to chroma as a hint for the language of the file. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Return 400 but not 500 when request archive with wrong format (#17691)Lunny Xiao2021-11-174-9/+80
|
* Sanitize user-input on file name (#17666)Gusted2021-11-171-1/+2
| | | | | | | | | | | * Sanitize user-input on file name - Sanitize user-input before it get passed into the DOM. - Prevent things like "<iframe onload=alert(1)></iframe>" from being executed. This isn't a XSS attack as the server seems to be santizing the path as well. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Move some functions into services/repository (#17677)Lunny Xiao2021-11-1715-285/+283
|
* A better go code formatter, and now `make fmt` can run in Windows (#17684)wxiaoguang2021-11-17106-42/+731
| | | | * go build / format tools * re-format imports
* Fix bug when read mysql database max lifetime (#17682)Lunny Xiao2021-11-171-2/+2
|
* Move user follow and openid into models/user/ (#17613)Lunny Xiao2021-11-1717-143/+155
| | | | | | | | | | | | | | | | | | | | | | | * Move UserRedirect into models/user/ * Fix lint & test * Fix lint * Fix lint * remove nolint comment * Fix lint * Move user follow and openid into models/user * Ignore the lint * Ignore the lint * Fix test * ignore stutters lint on UserOpenID
* Enable bidichk (#17610)Gusted2021-11-171-0/+1
| | | | | | - https://github.com/breml/bidichk Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* fix migrations documents (#17679)Lunny Xiao2021-11-172-6/+6
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Update golangci-lint in Makefile (#17647)Gusted2021-11-171-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | * Update golangci-lint in Makefile - Partially resolvess #17596 - Download specific version(v1.43.0) by default. - If current installed version is older than the minium version, it will download the mininium required version. - Update the install script to avoid deprecated error `golangci/golangci-lint err this script is deprecated, please do not use it anymore. check https://github.com/goreleaser/godownloader/issues/207` * Simplify golangci-lint version check * Fix version conversion * Add version that's downloading Co-authored-by: zeripath <art27@cantab.net> * Consistency Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Set unit test timeout to 20 minutes (#17664)Lunny Xiao2021-11-161-1/+1
| | | | | | | | | | * Set unit test timeout to 15 minutes * Update Makefile Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Update for reverse proxying static resources (#17670)rstular2021-11-161-1/+1
| | | | | | Gitea fetches static resources from /assets, so nginx configuration has to be updated accordingly. Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* [skip ci] Updated translations via CrowdinGiteaBot2021-11-174-0/+7
|
* Allow admins to change user avatars (#17661)qwerty2872021-11-164-0/+72
| | | | | | | Adds the avatar change panel to the edit user page (bottom) and allows admins to change it this way Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Multiple Escaping Improvements (#17551)zeripath2021-11-16153-712/+891
| | | | | | | | | | | | | | There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move migrations into services and base into modules/migration (#17663)Lunny Xiao2021-11-1650-52/+51
| | | | | | | * Move migrtions into services and base into modules/migration * Fix imports * Fix lint
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-29 05:55:02 +0000