summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* refactor auth interface to return error when verify failure (#22119)Lunny Xiao2022-12-2815-79/+111
| | | | | | | | | | | | | | | | | | | | | | | | | This PR changed the Auth interface signature from `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User` to `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)`. There is a new return argument `error` which means the verification condition matched but verify process failed, we should stop the auth process. Before this PR, when return a `nil` user, we don't know the reason why it returned `nil`. If the match condition is not satisfied or it verified failure? For these two different results, we should have different handler. If the match condition is not satisfied, we should try next auth method and if there is no more auth method, it's an anonymous user. If the condition matched but verify failed, the auth process should be stop and return immediately. This will fix #20563 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Jason Song <i@wolfogre.com>
* Add option to prohibit fork if user reached maximum limit of repositories ↵Xinyu Zhou2022-12-279-2/+53
| | | | | | | | | | | | | | | | | | (#21848) If user has reached the maximum limit of repositories: - Before - disallow create - allow fork without limit - This patch: - disallow create - disallow fork - Add option `ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT` (Default **true**) : enable this allow user fork repositories without maximum number limit fixed https://github.com/go-gitea/gitea/issues/21847 Signed-off-by: Xinyu Zhou <i@sourcehut.net>
* Update standard copyright header to use a placeholder year (#22254)Yarden Shoham2022-12-271-1/+1
|
* Add the 'ui.user' section to the cheat sheet (#22249)Christian Ullrich2022-12-271-0/+4
| | | | | | The `ui.user` ini section with its single setting is not yet mentioned in the config cheat sheet. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use complete SHA to create and query commit status (#22244)Jason Song2022-12-2719-23/+68
| | | | | | | Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add more test directory to exclude dir of air, remove watching templates ↵Lunny Xiao2022-12-273-4/+7
| | | | | | | | | | | | | | from air include dir because gitea has internal mechanism (#22246) Since #20218 introduced internal watching template, template watching should be removed from `air`. This will prevent restart the whole server once the template files changed to speed up developing when using `make watch`. To ensure `make watch` will reuse template watching, this PR introduced a new ENV `GITEA_RUN_MODE` to make sure `make watch` will always run in a dev mode of Gitea so that template watching will open. This PR also added more exclude testdata directories.
* Remove deadcode (#22245)Gusted2022-12-274-187/+0
| | | | | | | | - Remove code that isn't being used. Found this is my stash from a few weeks ago, not sure how I found this in the first place. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove ReverseProxy authentication from the API (#22219)zeripath2022-12-271-9/+3
| | | | | | | | | | | | | | | | | | | Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace #22077 Close #22221 Close #22077 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix typo of Asia/Shanghai (#22242)Jason Song2022-12-261-1/+1
| | | As the title.
* Add Mermaid copy button, avoid unnecessary tooltip hide (#22225)silverwind2022-12-254-9/+23
| | | | | | | | | | | | | - Add Copy button to mermaid diagrams which copies their source. - Set tippy to not hide on click and avoid tooltip re-creation for temporary tooltips. This avoids hide and show when copying repo url. Popovers still hide the tooltip as usual. <img width="815" alt="Screenshot 2022-12-23 at 14 02 32" src="https://user-images.githubusercontent.com/115237/209341696-98e30953-f246-46d9-9157-2ececfd791c9.png"> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* [skip ci] Updated licenses and gitignoresLunny Xiao2022-12-257-0/+91
|
* Improve testing for pgsql empty repository (#22223)Lunny Xiao2022-12-231-1/+4
|
* JS refactors (#22227)silverwind2022-12-2435-89/+47
| | | | | | - Replace all default exports with named exports, except for Vue SFCs - Remove names from Vue SFCs, they are automatically inferred from the filename - Misc whitespace-related tweaks
* Check primary keys for all tables and drop ForeignReference (#21721)Jason Song2022-12-2311-203/+55
| | | | | | | | | | | | | | | | | Some dbs require that all tables have primary keys, see - #16802 - #21086 We can add a test to keep it from being broken again. Edit: ~Added missing primary key for `ForeignReference`~ Dropped the `ForeignReference` table to satisfy the check, so it closes #21086. More context can be found in comments. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Hide file borders on sticky diff box (#22217)silverwind2022-12-231-0/+2
| | | | | | | | | | | | | Before: (1px border left and right when scrolled to a file) <img width="1143" alt="Screenshot 2022-12-22 at 15 37 54" src="https://user-images.githubusercontent.com/115237/209158082-c1a413b1-45b7-46b7-a71c-8e5a06324f43.png"> After: (no border) <img width="1149" alt="Screenshot 2022-12-22 at 15 39 01" src="https://user-images.githubusercontent.com/115237/209158086-9b00641f-2f41-4de1-9c08-22230c8a966a.png"> Layout in the box does not shift with the changes. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Test views of LFS files (#22196)Nick2022-12-2325-2/+174
|
* update docs latest to 1.17.4techknowlogick2022-12-221-1/+1
|
* Frontport 1.17.4 changelog (#22216)Lunny Xiao2022-12-221-0/+54
|
* Remove test session cache to reduce possible concurrent problem (#22199)Lunny Xiao2022-12-222-11/+2
|
* Upgrade hugo to 0.82 (#22209)silverwind2022-12-221-1/+1
| | | | | | | | | See https://github.com/go-gitea/gitea/pull/22206#issuecomment-1362523796. Apparently hugo 0.81.0 is a broken release in regards to checksums. https://github.com/gohugoio/hugo/releases/tag/v0.82.0 Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix container layer display overflow (#22208)Lauris BH2022-12-221-1/+1
| | | | | | | | | | Before: ![attels](https://user-images.githubusercontent.com/165205/209109653-6c690569-ddbe-4d8b-ab42-66b9a9c6a556.png) After: ![attels](https://user-images.githubusercontent.com/165205/209110521-8aa8fc1c-21c8-4280-9b39-ab560b6d95f4.png)
* Run hugo via `go run` and lock its version (#22206)silverwind2022-12-213-9/+7
| | | | | | | | | | - Don't rely on obscure docker images like `plugins/hugo` - Lock down `hugo` to same version the image had used - Remove unnecessary verbosity in `trans-copy` - Rename `trans-copy` to `trans-copy.sh` Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: John Olheiser <john+github@jolheiser.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Update bleve and zapx to fix unaligned atomic (#22031)zeripath2022-12-212-35/+32
| | | | | | | | | | | | There is an unaligned atomic field in zapx 15.3.5 which should have been fixed in a subsequent patch This bug causes issues on 32bit builds. Update bleve and zapx to account for this. Fix #21957 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow empty assignees on pull request edit (#22150)KN4CK3R2022-12-211-0/+5
| | | Fixes #22140
* Add Feed for Releases and Tags (#21696)Reo2022-12-216-2/+135
| | | | | | | | | Fixes #19091 Add Feed for Releases and Tags, can be accessed through `reponame/releases.rss`, `reponame/releases.atom`, `reponame/tags.rss`, and `reponame/tags.atom` Signed-off-by: Reo <reo_999@proton.me>
* fix: update libcurl in docs pipeline (#22203)John Olheiser2022-12-211-1/+2
| | | | | | updating libcurl fixes the mismatch between curl and libcurl Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Fixed colour transparency regex matching in project board sorting (#22091) ↵MisterCavespider2022-12-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#22092) As described in the linked issue (#22091), semi-transparent UI elements would result in JS errors due to the fact that the CSS `backgroundColor` element was being matched by the pattern `^rgb\((\d+),\s*(\d+),\s*(\d+)\)$`, which does not take the alpha channel into account. I changed the pattern to `^rgba?\((\d+),\s*(\d+),\s*(\d+).*\)$`. This new pattern accepts both `rgb` and `rgba` tuples, and ignores the alpha channel (that little `.*` at the end) from the sorting criteria. The reason why I chose to ignore alpha is because when it comes to kanban colour sorting, only the hue is important; the order of the panels should stay the same, even if some of them are transparent. Alternative solutions were discussed in the bug report and are included here for completeness: 1. Change the regex from ^rgb\((\d+),\s*(\d+),\s*(\d+)\)$ to ^rgba?\((\d+),\s*(\d+),\s*(\d+)(,\s*(\d+(\.\d+)?))?\)$ (alpha channel is a float or NaN on 5th group) and include the alpha channel in the sorting criteria. 2. Rethink on why you're reading colours out of the CSS in the first place, then reformat this sorting procedure. Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Mobile fix for Project view: Add delay to Sortable.js on mobile, to ensure ↵Nathaniel Sabanski2022-12-201-0/+4
| | | | | | | | | | | | | | | | | | | | scrolling is possible. (#22152) Mobile / touch devices currently get "hung up" on the sortable action, preventing any ability to visually scroll through the Project board to see issues. Solution: Sortable.js has a built-in fix using `delayOnTouchOnly` BEFORE https://user-images.githubusercontent.com/24665/208266817-6f2968b7-4788-4656-a941-f85b25fc59d5.mp4 AFTER https://user-images.githubusercontent.com/24665/208266822-3d327002-7a9d-41cf-9890-6d6b8dcb17be.mp4 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Normalize NuGet package version on upload (#22186)KN4CK3R2022-12-204-21/+36
| | | | | | | | Fixes #22178 After this change upload versions with different semver metadata are treated as the same version and trigger a duplicated version error. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Attempt to fix TestExportUserGPGKeys (#22159)zeripath2022-12-211-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | There are repeated failures with this test which appear related to failures in getTokenForLoggedInUser. It is difficult to further evaluate the cause of these failures as we do not get given further information. This PR will attempt to fix this. First it adds some extra logging and it uses the csrf cookie primarily for the csrf value. If the problem does not occur again with those changes we could merge, assume that it is fixed and hope that if it occurs in future the additional logging will be helpful. If not I will add more changes in attempt to fix. Fix #22105 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: delvh <dev.lh@web.de>
* Specify ID in `TestAPITeam` (#22192)Gusted2022-12-211-1/+1
| | | | | | | | | | - There have been [CI failures](https://codeberg.org/forgejo/forgejo/issues/111) in this specific test function. The code on itself looks good, the CI failures are likely caused by not specifying any field in `TeamUser`, which might have caused to unittest to return another `TeamUser` than the code expects. Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Repair LFS web rendering. (#22195)Nick2022-12-211-1/+1
| | | | | | | There was just a missing check. Fixes #22193. Signed-off-by: Nick Guenther <nick.guenther@polymtl.ca>
* Fix misc whitespace issues in install docs (#22189)Dan Church2022-12-203-48/+48
| | | | | | | | | | | | I ran into issues when copy-pasting the docker-compose.yml contents from https://docs.gitea.io/en-us/install-with-docker/ - specifically the part about adding PostgreSQL to the YAML file; I tried manually adding the diffs by removing the `+` at the beginning of lines, and the resulting YAML was unparsable. This forces the indentation to be consistent across all places where YAML is used. Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Update JS dependencies and eslint (#22190)silverwind2022-12-2014-1282/+1514
| | | | | | | - Update all JS dependencies to latest version - Enable unicorn/prefer-node-protocol and autofix issues - Regenerate SVGs - Add some comments to eslint rules - Tested build, Mermaid and Katex rendering
* Fix delete secret modal (#22187)Lunny Xiao2022-12-202-3/+23
| | | Fix #22181
* Secrets storage with SecretKey encrypted (#22142)Jason Song2022-12-2017-2/+468
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fork of #14483, but [gave up MasterKey](https://github.com/go-gitea/gitea/pull/14483#issuecomment-1350728557), and fixed some problems. Close #12065. Needed by #13539. Featrues: - Secrets for repo and org, not user yet. - Use SecretKey to encrypte/encrypt secrets. - Trim spaces of secret value. - Add a new locale ini block, to make it easy to support secrets for user. Snapshots: Repo level secrets: ![image](https://user-images.githubusercontent.com/9418365/207823319-b8a4903f-38ca-4af7-9d05-336a5af906f3.png) Rrg level secrets ![image](https://user-images.githubusercontent.com/9418365/207823371-8bd02e93-1928-40d1-8c76-f48b255ace36.png) Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Check for zero time instant in `TimeStamp.IsZero()` (#22171)Gusted2022-12-201-3/+8
| | | | | | | | | | | | | | | | | | - Currently, the 'IsZero' function for 'TimeStamp' just checks if the unix time is zero, which is not the behavior of 'Time.IsZero()', but Gitea is using this method in accordance with the behavior of 'Time.IsZero()'. - Adds a new condition to check for the zero time instant. - Fixes a bug where non-expiring GPG keys where shown as they expired on Jan 01, 0001. - Related https://codeberg.org/Codeberg/Community/issues/791 Before: ![image](https://user-images.githubusercontent.com/25481501/208509035-ecc5fa4a-3bd1-4fa3-beba-90875719163c.png) After: ![image](https://user-images.githubusercontent.com/25481501/208508950-3e7f6eeb-be83-432a-89a6-d738553dafe4.png)
* Fix heatmap first color being unused (#22157)silverwind2022-12-191-0/+7
| | | | | | | | | | | | | | | | | | | vue3-calendar-heatmap has the behaviour that the first and second colors are mapped to values null and 0, meaning the second color was not used as intended for values > 0. I think this is a behaviour change from previous vue2 version that was missed during the upgrade. This change makes first and second values the same, so the heatmap can now use one additional color for meaningful values. Before: <img width="710" alt="Screenshot 2022-12-18 at 09 17 58" src="https://user-images.githubusercontent.com/115237/208288347-df4973af-8ebd-4582-b828-bec948ffdf60.png"> After: <img width="709" alt="Screenshot 2022-12-18 at 09 18 15" src="https://user-images.githubusercontent.com/115237/208288350-e0b85aa2-6925-4a37-83d2-89e2518c91ce.png"> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add setting to disable the git apply step in test patch (#22130)zeripath2022-12-194-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For a long time Gitea has tested PR patches using a git apply --check method, and in fact prior to the introduction of a read-tree assisted three-way merge in #18004, this was the only way of checking patches. Since #18004, the git apply --check method has been a fallback method, only used when the read-tree three-way merge method has detected a conflict. The read-tree assisted three-way merge method is much faster and less resource intensive method of detecting conflicts. #18004 kept the git apply method around because it was thought possible that this fallback might be able to rectify conflicts that the read-tree three-way merge detected. I am not certain if this could ever be the case. Given the uncertainty here and the now relative stability of the read-tree method - this PR makes using this fallback optional and disables it by default. The hope is that users will not notice any significant difference in conflict detection and we will be able to remove the git apply fallback in future, and/or improve the read-tree three-way merge method to catch any conflicts that git apply method might have been able to fix. An additional benefit is that patch checking should be significantly less resource intensive and much quicker. (See https://github.com/go-gitea/gitea/issues/22083\#issuecomment-1347961737) Ref #22083 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Local storage should not store files as executable (#22162)zeripath2022-12-191-1/+2
| | | | | | | | | | The PR #21198 introduced a probable security vulnerability which resulted in making all storage files be marked as executable. This PR ensures that these are forcibly marked as non-executable. Fix #22161 Signed-off-by: Andrew Thornton <art27@cantab.net>
* [skip ci] Updated licenses and gitignoreszeripath2022-12-181-0/+44
|
* Ensure that plain files are rendered correctly even when containing ↵zeripath2022-12-174-23/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ambiguous characters (#22017) As recognised in #21841 the rendering of plain text files is somewhat incorrect when there are ambiguous characters as the html code is double escaped. In fact there are several more problems here. We have a residual isRenderedHTML which is actually simply escaping the file - not rendering it. This is badly named and gives the wrong impression. There is also unusual behaviour whether the file is called a Readme or not and there is no way to get to the source code if the file is called README. In reality what should happen is different depending on whether the file is being rendered a README at the bottom of the directory view or not. 1. If it is rendered as a README on a directory - it should simply be escaped and rendered as `<pre>` text. 2. If it is rendered as a file then it should be rendered as source code. This PR therefore does: 1. Rename IsRenderedHTML to IsPlainText 2. Readme files rendered at the bottom of the directory are rendered without line numbers 3. Otherwise plain text files are rendered as source code. Replace #21841 Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* verify nodeinfo response by schema (#22137)Meisam2022-12-175-0/+219
| | | | | | ... using [github.com/xeipuuv/gojsonschema](https://github.com/xeipuuv/gojsonschema) Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix margin and alignment in dashboard repolist (#22120)silverwind2022-12-172-4/+8
| | | | | | | | | | | | | | | | Seems this has recently regressed, previously, there was a significant whitespace between icon and text, but it seems to be gone, so I added the margin and also vertically aligned the icon because it was slightly misaligned. Before: <img width="419" alt="Screenshot 2022-12-13 at 20 03 51" src="https://user-images.githubusercontent.com/115237/207422938-7c45110c-f73e-4344-afc8-c072266d1f95.png"> After: <img width="419" alt="image" src="https://user-images.githubusercontent.com/115237/207447579-95525405-574d-4ca8-84ba-d8a9af50015a.png"> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Update username (#22147)Xinyu Zhou2022-12-161-1/+1
| | | update my email & username
* Do not list active repositories as unadopted (#22034)Christian Ullrich2022-12-161-1/+1
| | | | | | | | | | | | | | | | | This fixes a bug where, when searching unadopted repositories, active repositories will be listed as well. This is because the size of the array of repository names to check is larger by one than the `IterateBufferSize`. For an `IterateBufferSize` of 50, the original code will pass 51 repository names but set the query to `LIMIT 50`. If all repositories in the query are active (i.e. not unadopted) one of them will be omitted from the result. Due to the `ORDER BY` clause it will be the oldest (or least recently modified) one. Bug found in 1.17.3. Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add doctor command for full GC of LFS (#21978)zeripath2022-12-155-39/+245
| | | | | | | | | | | | | | The recent PR adding orphaned checks to the LFS storage is not sufficient to completely GC LFS, as it is possible for LFSMetaObjects to remain associated with repos but still need to be garbage collected. Imagine a situation where a branch is uploaded containing LFS files but that branch is later completely deleted. The LFSMetaObjects will remain associated with the Repository but the Repository will no longer contain any pointers to the object. This PR adds a second doctor command to perform a full GC. Signed-off-by: Andrew Thornton <art27@cantab.net>
* remove silentcode from MAINTAINERS (#22143)silentcodeg2022-12-151-1/+0
| | | Signed-off-by: silentcode <silentcode@senga.org>
* Fixed Project view .board-column height for tall screens. (#22108)Nathaniel Sabanski2022-12-141-1/+2
| | | | | | | | | | | | | | | | | This bug occurs because we are calculating `.board-column` height strictly off of `vh`, when the layout header is of static height. BEFORE https://user-images.githubusercontent.com/24665/206991060-372c24e3-986e-4fc6-9fc8-aab8b4ef09bb.mp4 AFTER https://user-images.githubusercontent.com/24665/206991070-91b7cbab-d807-4016-8696-e43bdaf8a7ff.mp4
* Correctly handle moved files in apply patch (#22118)zeripath2022-12-141-0/+3
| | | | | | | | | | | | | | | Moved files in a patch will result in git apply returning: ``` error: {filename}: No such file or directory ``` This wasn't handled by the git apply patch code. This PR adds handling for this. Fix #22083 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 07:13:50 +0000