summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [skip ci] Updated translations via CrowdinGusted2022-06-201-0/+10
|
* Disable federation by default (#20045)Gusted2022-06-205-26/+39
|
* Respond with a 401 on git push when password isn't changed yet (#20026)Wim2022-06-191-0/+5
| | | | | | | | | | If the user-agent starts with git and user must change password but hasn't return a 401 with the message. It must be a 401, git doesn't seem to show the contents of the error message when we return a 403 Fixes #19090
* Alter hook_task TEXT fields to LONGTEXT (#20038)Wim2022-06-193-3/+31
| | | | | | | | | | | Mysql TEXT has a limit of 64KB, change this to LONGTEXT in mysql only so we can have bigger hook payloads. Postgresql has unlimited TEXT - https://www.postgresql.org/docs/current/datatype-character.html Sqlite has unlimited TEXT - https://www.sqlitetutorial.net/sqlite-data-types/#:~:text=The%20maximum%20length%20of%20TEXT,SQLite%20supports%20various%20character%20encodings. Same issue as #16656 but for hook_task Fixes #10252, #19679, #3561
* Simplify and fix migration 216 (#20035)zeripath2022-06-191-21/+0
| | | | | | | | | | There appears to be a strange bug whereby the comment_id index can sometimes be missed or missing from the action table despite the sync2 that should create it in the earlier part of this migration. However, looking through the code for Sync2 there is no need for this pre-code to exist and Sync2 should drop/create the indices as necessary. I think therefore we should simplify the migration to simply be Sync2. Signed-off-by: Andrew Thornton <art27@cantab.net>
* use quoted regexp instead of git fixed-value (#20029)wxiaoguang2022-06-192-2/+9
|
* fix delete pull head ref for DeleteIssue (#20032)a10121127962022-06-194-3/+19
| | | | | | | | | | | | | * fix delete pull head ref for DeleteIssue fix #19655 Signed-off-by: a1012112796 <1012112796@qq.com> * add different help message for delete pull request Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: 6543 <6543@obermui.de>
* User keypairs and HTTP signatures for ActivityPub federation using go-ap ↵Anthony Wang2022-06-1920-5/+762
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#19133) * go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master * activitypub: implement /api/v1/activitypub/user/{username} (#14186) Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: add the public key to Person (#14186) Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: go-fed conformant Clock instance Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: signing http client Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: implement the ReqSignature middleware Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: hack_16834 Signed-off-by: Loïc Dachary <loic@dachary.org> * Fix CI checks-backend errors with go mod tidy Signed-off-by: Anthony Wang <ta180m@pm.me> * Change 2021 to 2022, properly format package imports Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt and make generate-swagger Signed-off-by: Anthony Wang <ta180m@pm.me> * Use Gitea JSON library, add assert for pkp Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt again, fix err var redeclaration Signed-off-by: Anthony Wang <ta180m@pm.me> * Remove LogSQL from ActivityPub person test Signed-off-by: Anthony Wang <ta180m@pm.me> * Assert if json.Unmarshal succeeds Signed-off-by: Anthony Wang <ta180m@pm.me> * Cleanup, handle invalid usernames for ActivityPub person GET request Signed-off-by: Anthony Wang <ta180m@pm.me> * Rename hack_16834 to user_settings Signed-off-by: Anthony Wang <ta180m@pm.me> * Use the httplib module instead of http for GET requests * Clean up whitespace with make fmt * Use time.RFC1123 and make the http.Client proxy-aware * Check if digest algo is supported in setting module * Clean up some variable declarations * Remove unneeded copy * Use system timezone instead of setting.DefaultUILocation * Use named constant for httpsigExpirationTime * Make pubKey IRI #main-key instead of /#main-key * Move /#main-key to #main-key in tests * Implemented Webfinger endpoint. * Add visible check. * Add user profile as alias. * Add actor IRI and remote interaction URL to WebFinger response * fmt * Fix lint errors * Use go-ap instead of go-fed * Run go mod tidy to fix missing modules in go.mod and go.sum * make fmt * Convert remaining code to go-ap * Clean up go.sum * Fix JSON unmarshall error * Fix CI errors by adding @context to Person() and making sure types match * Correctly decode JSON in api_activitypub_person_test.go * Force CI rerun * Fix TestActivityPubPersonInbox segfault * Fix lint error * Use @mariusor's suggestions for idiomatic go-ap usage * Correctly add inbox/outbox IRIs to person * Code cleanup * Remove another LogSQL from ActivityPub person test * Move httpsig algos slice to an init() function * Add actor IRI and remote interaction URL to WebFinger response * Update TestWebFinger to check for ActivityPub IRI in aliases * make fmt * Force CI rerun * WebFinger: Add CORS header and fix Href -> Template for remote interactions The CORS header is needed due to https://datatracker.ietf.org/doc/html/rfc7033#section-5 and fixes some Peertube <-> Gitea federation issues * make lint-backend * Make sure Person endpoint has Content-Type application/activity+json and includes PreferredUsername, URL, and Icon Setting the correct Content-Type is essential for federating with Mastodon * Use UTC instead of GMT * Rename pkey to pubKey * Make sure HTTP request Date in GMT * make fmt * dont drop err * Make sure API responses always refer to username in original case Copied from what I wrote on #19133 discussion: Handling username case is a very tricky issue and I've already encountered a Mastodon <-> Gitea federation bug due to Gitea considering Ta180m and ta180m to be the same user while Mastodon thinks they are two different users. I think the best way forward is for Gitea to only use the original case version of the username for federation so other AP software don't get confused. * Move httpsig algs constant slice to modules/setting/federation.go * Add new federation settings to app.example.ini and config-cheat-sheet * Return if marshalling error * Make sure Person IRIs are generated correctly This commit ensures that if the setting.AppURL is something like "http://127.0.0.1:42567" (like in the integration tests), a trailing slash will be added after that URL. * If httpsig verification fails, fix Host header and try again This fixes a very rare bug when Gitea and another AP server (confirmed to happen with Mastodon) are running on the same machine, Gitea fails to verify incoming HTTP signatures. This is because the other AP server creates the sig with the public Gitea domain as the Host. However, when Gitea receives the request, the Host header is instead localhost, so the signature verification fails. Manually changing the host header to the correct value and trying the veification again fixes the bug. * Revert "If httpsig verification fails, fix Host header and try again" This reverts commit f53e46c721a037c55facb9200106a6b491bf834c. The bug was actually caused by nginx messing up the Host header when reverse-proxying since I didn't have the line `proxy_set_header Host $host;` in my nginx config for Gitea. * Go back to using ap.IRI to generate inbox and outbox IRIs * use const for key values * Update routers/web/webfinger.go * Use ctx.JSON in Person response to make code cleaner * Revert "Use ctx.JSON in Person response to make code cleaner" This doesn't work because the ctx.JSON() function already sends the response out and it's too late to edit the headers. This reverts commit 95aad988975be3393c76094864ed6ba962157e0c. * Use activitypub.ActivityStreamsContentType for Person response Content Type * Limit maximum ActivityPub request and response sizes to a configurable setting * Move setting key constants to models/user/setting_keys.go * Fix failing ActivityPubPerson integration test by checking the correct field for username * Add a warning about changing settings that can break federation * Add better comments * Don't multiply Federation.MaxSize by 1<<20 twice * Add more better comments * Fix failing ActivityPubMissingPerson test We now use ctx.ContextUser so the message printed out when a user does not exist is slightly different * make generate-swagger For some reason I didn't realize that /templates/swagger/v1_json.tmpl was machine-generated by make generate-swagger... I've been editing it by hand for three months! 🤦 * Move getting the RFC 2616 time to a separate function * More code cleanup * Update go-ap to fix empty liked collection and removed unneeded HTTP headers * go mod tidy * Add ed25519 to httpsig algorithms * Use go-ap/jsonld to add @context and marshal JSON * Change Gitea user agent from the default to Gitea/Version * Use ctx.ServerError and remove all remote interaction code from webfinger.go
* Backtick table name in generic orphan check (#20019)Gusted2022-06-191-2/+2
|
* Update document to clarify that ALLOWED_DOMAINS/BLOCKED_DOMAINS support ↵wxiaoguang2022-06-182-2/+4
| | | | wildcard (#20016)
* Return 404 when tag is broken (#20017)Wim2022-06-181-0/+4
| | | Fixes #19979
* Dump should only copy regular files and symlink regular files (#20015)v1.18.0-devwxiaoguang2022-06-181-3/+18
|
* [skip ci] Updated translations via Crowdinzeripath2022-06-182-0/+300
|
* [skip ci] Updated translations via Crowdinzeripath2022-06-181-0/+153
|
* Add fgprof pprof profiler (#20005)zeripath2022-06-183-0/+7
| | | | | | | | | | | | | | | | | | | | | fgprof is a sampling Go profiler that allows you to analyze On-CPU as well as Off-CPU (e.g. I/O) time together. Go's builtin sampling CPU profiler can only show On-CPU time, but it's better than fgprof at that. Go also includes tracing profilers that can analyze I/O, but they can't be combined with the CPU profiler. fgprof is designed for analyzing applications with mixed I/O and CPU workloads. This kind of profiling is also known as wall-clock profiling. Whilst fgprof can cause significant STW latencies in applications with a lot of goroutines (> 1-10k), these latencies only occur if the profile is requested - it doesn't cause a delay by simply being available. The fgprof profile is mounted on `http://localhost:6060/debug/fgprof?seconds=3` Signed-off-by: Andrew Thornton <art27@cantab.net>
* [skip ci] Updated translations via Crowdinzeripath2022-06-181-0/+1
|
* Improve action table indices (#19472)zeripath2022-06-183-7/+88
|
* Add dbconsistency checks for Stopwatches (#20010)zeripath2022-06-181-0/+6
| | | | | | | | | | It appears possible that stopwatches can become orphaned or have been orphaned in the past. This PR adds Orphan checks for Stopwatches. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* fix push mirrors URL are no longer displayed on the UI (#20011)Mohamed Sekour2022-06-181-3/+0
| | | | | | | | | | * fix push mirrors URL are no longer displayed on the UI Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> * Update modules/templates/helper.go Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Empty log queue on flush and close (#19994)zeripath2022-06-181-0/+39
| | | | | | | | | | | | | | | | | | | * Empty log queue on flush and close It is possible for log events to remain in the buffer off the multichannelledlog and thus not be logged despite close or flush. This PR simply adds a function to empty the queue before closing or flushing. (Except when the logger is paused.) Reference #19982 Signed-off-by: Andrew Thornton <art27@cantab.net> * and do similar for ChannelledLog Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [skip ci] Updated translations via Crowdinzeripath2022-06-181-0/+51
|
* Stop spurious APIFormat stopwatches logs (#20008)zeripath2022-06-172-2/+6
| | | | | | | | | If there are dangling stopwatches with missing issues there will be repeated logging of Unable to APIFormat stopwatches. These are unhelpful and instead we should only log if the error is not an issue not exist error. And we should also prevent an error on missing issue in GetActiveStopwatch too Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix CountOrphanedLabels in orphan check (#20009)zeripath2022-06-171-1/+1
| | | | | | gitea doctor --run check-db-consistency is currently broken due to an incorrect and old use of Count() with a string. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Write Commit-Graphs in RepositoryDumper (#20004)zeripath2022-06-171-0/+5
| | | | | | When migrating git repositories we should ensure that the commit-graph is written. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de>
* Add fetch.writeCommitGraph to gitconfig (#20006)zeripath2022-06-171-0/+3
| | | | | | | Add fetch.writeCommitGraph to gitconfig to ensure that a commit-graph will be written on git fetch calls. Signed-off-by: Andrew Thornton <art27@cantab.net>
* move agit dependcy (#19998)Lunny Xiao2022-06-172-61/+29
|
* Fix a JS error in initRepoCommitLastCommitLoader's entryMap (#19996)wxiaoguang2022-06-171-1/+6
|
* gitconfig: set safe.directory = * (#19870)singuliere2022-06-171-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Allow git push to work when networked file systems with mixed ownership are used with Gitea docker images >= 1.16.6 or Gitea binaries running alongside git versions published after 04/2022. There are circumstances independent of Gitea (networked file systems with various permission systems) by which the git repositories managed by Gitea may have mixed owners. It is not a behavior that Gitea have control over nor is it a problem as long as the permissions for Gitea to operate are correct. Gitea instances have been operating under these conditions for a number of years. It is detected as a potential security risk ( see GHSA-vw2c-22j4-2fh2 ) by the most recent git versions. However, Gitea always runs git commands with a current directory matching the repository on which it operates. That makes Gitea immune from this security problem and it is safe to ignore the mixed owner permission check. This gitconfig modification is done on a file dedicated to the user exclusively used by Gitea. Fixes: #19455 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Fix Readme render bug (#19992)Lunny Xiao2022-06-171-1/+1
| | | | | Fix #19988 Co-authored-by: zeripath <art27@cantab.net>
* Delete duplicated update btn on pull request view page (#19993)Lunny Xiao2022-06-171-39/+1
| | | Fix #19987
* Use DisplayName() instead of FullName in Oauth provider (#19991)oGi4i2022-06-162-1/+20
| | | | | Use DisplayName() in Oauth as this provides a fallback if FullName is not set. Closes #19382
* fix permission check for delete tag (#19985)a10121127962022-06-167-1/+64
| | | | | | | fix #19970 by the way, fix some error response about protected tags. Signed-off-by: a1012112796 <1012112796@qq.com>
* [skip ci] Updated translations via Crowdinwxiaoguang2022-06-161-73/+86
|
* Remove legacy git code (ver < 2.0), fine tune markup tests (#19930)wxiaoguang2022-06-1619-227/+179
| | | | | | | | | | | | | | | | | | | | | | | | * clean git support for ver < 2.0 * fine tune tests for markup (which requires git module) * remove unnecessary comments * try to fix tests * try test again * use const for GitVersionRequired instead of var * try to fix integration test * Refactor CheckAttributeReader to make a *git.Repository version * update document for commit signing with Gitea's internal gitconfig * update document for commit signing with Gitea's internal gitconfig Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [skip ci] Updated translations via CrowdinGusted2022-06-161-2/+86
|
* Don't prevent overflow on y-as (#19978)Gusted2022-06-161-0/+4
| | | | | | | | | | | | | | | | | | - Fomantic tries to prevent overflowing on the `y/x`-as by default on stackable menu's on mobile screens. We already solve this issue by forcing overflow on x as and hide it on y as(due to some issues with other menu's), since https://github.com/go-gitea/gitea/pull/19486. - However this edge case does require a y-overflow to show the dropdown, because you cannot easily adjust this with CSS, once you're fiddling with overflow's (https://stackoverflow.com/a/6433475). However interesting behavior is noted https://css-tricks.com/popping-hidden-overflow/ when you remove the position: relative, it will suddenly work again. Well because this is the only solution without redesigning dropdowns, I think we can live with the side-effect of the dropdown items being full-width instead "relative" width to their parent. - Resolves #19976 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [skip ci] Updated translations via Crowdina10121127962022-06-161-1/+10
|
* fix `go to file` link for mirror repository (#19983)a10121127962022-06-161-1/+1
| | | | | | the `BaseRepo` not always exit, should use `Repository`. Signed-off-by: a1012112796 <1012112796@qq.com>
* Don't buffer doctor logger (#19982)Gusted2022-06-161-1/+1
| | | | | | | | | - We don't need to buffer the logger with a thousand capacity. It's not a high-throughput logger, this also caused issue whereby the logger can't keep up with repeated messages being send(somehow they are lost in the queue?). - Resolves #19969 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow render HTML with css/js external links (#19017)Lunny Xiao2022-06-1617-93/+248
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Allow render HTML with css/js external links * Fix bug because of filename escape chars * Fix lint * Update docs about new configuration item * Fix bug of render HTML in sub directory * Add CSP head for displaying iframe in rendering file * Fix test * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Some improvements * some improvement * revert change in SanitizerDisabled of external renderer * Add sandbox for iframe and support allow-scripts and allow-same-origin * refactor * fix * fix lint * fine tune * use single option RENDER_CONTENT_MODE, use sandbox=allow-scripts * fine tune CSP * Apply suggestions from code review Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use correct count for `NumOpenIssues` (#19980)Gusted2022-06-161-1/+7
| | | | | | - Don't specify the field in `Count` instead use `Cols` for this. - Call `log.Error` when a error occur. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* In code search, get code unit accessible repos in one (main) query (#19764)Hugo Hoitink2022-06-165-113/+112
| | | | | | | | | | * When non-admin users use code search, get code unit accessible repos in one main query * Modified some comments to match the changes * Removed unnecessary check for Access Mode in Collaboration table Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* [skip ci] Updated translations via CrowdinGusted2022-06-151-0/+220
|
* Always try to fetch repo for mirrors (#19975)Gusted2022-06-151-2/+2
| | | | | | | - Always give a best-effort to fetching the repositories, if even that fails indeed give a disconnected mirror found error. - *Partially* resolves #19928 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Remove tab/TabName usage where it's not needed (#19973)Lauris BH2022-06-158-31/+28
| | | `tab` query argument and `TabName` in context is used only in profile so remove it from all other places where it's not used anymore.
* Fix cli command restore-repo: "units" should be parsed as StringSlice (#19953)wxiaoguang2022-06-152-5/+13
| | | | | | * Fix cli command restore-repo: "units" should be parsed as StringSlice because after #15790 it's read by c.StringSlice("units"). Before, the "units" were processed by strings.Split * Add checking for invalid unit names Co-authored-by: 6543 <6543@obermui.de>
* Uppercase first languages letters (#19965)AHOHNMYC2022-06-153-20/+20
|
* Move tests as seperate sub packages to reduce duplicated file names (#19951)Lunny Xiao2022-06-1527-899/+901
|
* Replace unstyled meter with progress (#19968)silverwind2022-06-154-8/+13
| | | | | | Replace the only `<meter>` element in use with a `<progress>` which is styled properly. Also slightly adjust colors on it for better contrast. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* [skip ci] Updated translations via Crowdinsinguliere2022-06-151-0/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 07:13:16 +0000