aboutsummaryrefslogtreecommitdiffstats
path: root/models/fixtures
Commit message (Collapse)AuthorAgeFilesLines
* Fix comment permissions (#28213)Lunny Xiao2023-11-252-1/+10
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Add unit tests for action runner token (#27670)Nanguan Lin2023-10-191-0/+35
| | | In case the behavior of the register token changes.
* Test more templates for if they contain an error (#27367)Lunny Xiao2023-10-021-0/+20
|
* Allow get release download files and lfs files with oauth2 token format (#26430)Lunny Xiao2023-10-012-0/+27
| | | | Fix #26165 Fix #25257
* Fix more yaml lint errors (#27284)Lunny Xiao2023-09-2610-21/+20
| | | Fix #27268
* Fix review request number and add more tests (#27104)Nanguan Lin2023-09-216-2/+72
| | | | | | | | | | | | | | | | | | | | | fix #27019 ## testfixture yml 1. add issue20(a pr issue) in repo 23, org 17 2. add user15 to team 9 3. add four reviews about issue20 ## test case add two tests that are described with code comments the code before pr #26784 failed the first test <img width="479" alt="image" src="https://github.com/go-gitea/gitea/assets/70063547/1d9b5787-11b4-4c4d-931f-6a9869547f35"> current code failed the second test(as mentioned in #27019) <img width="484" alt="image" src="https://github.com/go-gitea/gitea/assets/70063547/05608055-7587-43d1-bae1-92c688270819"> Any advice is appreciated. --------- Co-authored-by: CaiCandong <50507092+CaiCandong@users.noreply.github.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Replace 'userxx' with 'orgxx' in all test files when the user type is org ↵Nanguan Lin2023-09-144-47/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#27052) Currently 'userxx' and 'orgxx' are both used as username in test files when the user type is org, which is confusing. This PR replaces all 'userxx' with 'orgxx' when the user type is org(`user.type==1`). Some non-trivial changes 1. Rename `user3` dir to `org3` in `tests/git-repositories-meta` 2. Change `end` in `issue reference` because 'org3' is one char shorter than 'user3' ![ksnip_20230913-112819](https://github.com/go-gitea/gitea/assets/70063547/442988c5-4cf4-49b8-aa01-4dd6bf0ca954) 3. Change the search result number of `user/repo2` because `user3/repo21` can't be searched now ![ksnip_20230913-112931](https://github.com/go-gitea/gitea/assets/70063547/d9ebeba4-479f-4110-9a85-825efbc981fd) 4. Change the first org name getting from API because the result is ordered by alphabet asc and now `org 17` is before `org25` ![JW8U7NIO(J$H _YCRB36H)T](https://github.com/go-gitea/gitea/assets/70063547/f55a685c-cf24-40e5-a87f-3a2327319548) ![)KFD411O4I8RB5ZOH7E0 Z3](https://github.com/go-gitea/gitea/assets/70063547/a0dc3299-249c-46f6-91cb-d15d4ee88dd5) Other modifications are just find all and replace all. Unit tests with SQLite are all passed. --------- Co-authored-by: caicandong <1290147055@qq.com>
* Fix context cache bug & enable context cache for dashabord commits' authors ↵Lunny Xiao2023-09-111-2/+2
| | | | | | | | | | | (#26991) Unfortunately, when a system setting hasn't been stored in the database, it cannot be cached. Meanwhile, this PR also uses context cache for push email avatar display which should avoid to read user table via email address again and again. According to my local test, this should reduce dashboard elapsed time from 150ms -> 80ms .
* Fix verifyCommits error when push a new branch (#26664)CaiCandong2023-08-303-4/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | > ### Description > If a new branch is pushed, and the repository has a rule that would require signed commits for the new branch, the commit is rejected with a 500 error regardless of whether it's signed. > > When pushing a new branch, the "old" commit is the empty ID (0000000000000000000000000000000000000000). verifyCommits has no provision for this and passes an invalid commit range to git rev-list. Prior to 1.19 this wasn't an issue because only pre-existing individual branches could be protected. > > I was able to reproduce with [try.gitea.io/CraigTest/test](https://try.gitea.io/CraigTest/test), which is set up with a blanket rule to require commits on all branches. Fix #25565 Very thanks to @Craig-Holmquist-NTI for reporting the bug and suggesting an valid solution! --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow to archive labels (#26478)puni98692023-08-141-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Archived labels This adds the structure to allow for archived labels. Archived labels are, just like closed milestones or projects, a medium to hide information without deleting it. It is especially useful if there are outdated labels that should no longer be used without deleting the label entirely. ## Changes 1. UI and API have been equipped with the support to mark a label as archived 2. The time when a label has been archived will be stored in the DB ## Outsourced for the future There's no special handling for archived labels at the moment. This will be done in the future. ## Screenshots ![image](https://github.com/go-gitea/gitea/assets/80308335/208f95cd-42e4-4ed7-9a1f-cd2050a645d4) ![image](https://github.com/go-gitea/gitea/assets/80308335/746428e0-40bb-45b3-b992-85602feb371d) Part of https://github.com/go-gitea/gitea/issues/25237 --------- Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* fix generated source URL on rendered files (#26364)Earl Warren2023-08-081-0/+12
| | | | | | | | | | | | | | | - The permalink and 'Reference in New issue' URL of an renderable file (those where you can see the source and a rendered version of it, such as markdown) doesn't contain `?display=source`. This leads the issue that the URL doesn't have any effect, as by default the rendered version is shown and thus not the source. - Add `?display=source` to the permalink URL and to 'Reference in New Issue' if it's renderable file. - Add integration testing. Refs: https://codeberg.org/forgejo/forgejo/pulls/1088 Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: Giteabot <teabot@gitea.io>
* Fix access check for org-level project (#26182)Zettat1232023-07-291-0/+6
| | | | | | | | Fix #25934 Add `ignoreGlobal` parameter to `reqUnitAccess` and only check global disabled units when `ignoreGlobal` is true. So the org-level projects and user-level projects won't be affected by global disabled `repo.projects` unit.
* Add commits dropdown in PR files view and allow commit by commit review (#25528)sebastian-sauer2023-07-285-1/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This PR adds a new dropdown to select a commit or a commit range (shift-click like github) of a Pull Request. After selection of a commit only the changes of this commit will be shown. When selecting a range of commits the diff of this range is shown. This allows to review a PR commit by commit or by viewing only commit ranges. The "Show changes since your last review" mechanism github uses is implemented, too. When reviewing a single commit or a commit range the "Viewed" functionality is disabled. ## Screenshots ### The commit dropdown ![image](https://github.com/go-gitea/gitea/assets/51889757/0db3ae62-1272-436c-be64-4730c5d611e3) ### Selecting a commit range ![image](https://github.com/go-gitea/gitea/assets/51889757/ad81eedb-8437-42b0-8073-2d940c25fe8f) ### Show changes of a single commit only ![image](https://github.com/go-gitea/gitea/assets/51889757/6b1a113b-73ef-4ecc-adf6-bc2340bb8f97) ### Show changes of a commit range ![image](https://github.com/go-gitea/gitea/assets/51889757/6401b358-cd66-4c09-8baa-6cf6177f23a7) Fixes https://github.com/go-gitea/gitea/issues/20989 Fixes https://github.com/go-gitea/gitea/issues/19263 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* Fix incorrect oldest sort in project list (#25806)yp053272023-07-111-0/+8
| | | | sort type `oldest` should be `Asc`. Added a test for this.
* Revert package access change from #23879 (#25707)KN4CK3R2023-07-095-1/+150
| | | | | | | | | | | | | | | | | | | | | Fixes (?) #25538 Fixes https://codeberg.org/forgejo/forgejo/issues/972 Regression #23879 #23879 introduced a change which prevents read access to packages if a user is not a member of an organization. That PR also contained a change which disallows package access if the team unit is configured with "no access" for packages. I don't think this change makes sense (at the moment). It may be relevant for private orgs. But for public or limited orgs that's useless because an unauthorized user would have more access rights than the team member. This PR restores the old behaviour "If a user has read access for an owner, they can read packages". --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Fix bug of branches API with tests (#25578)Lunny Xiao2023-07-012-1/+50
| | | | | | | Fix #25558 Extract from #22743 This PR added a repository's check when creating/deleting branches via API. Mirror repository and archive repository cannot do that.
* Sync branches into databases (#22743)Lunny Xiao2023-06-292-15/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | Related #14180 Related #25233 Related #22639 Close #19786 Related #12763 This PR will change all the branches retrieve method from reading git data to read database to reduce git read operations. - [x] Sync git branches information into database when push git data - [x] Create a new table `Branch`, merge some columns of `DeletedBranch` into `Branch` table and drop the table `DeletedBranch`. - [x] Read `Branch` table when visit `code` -> `branch` page - [x] Read `Branch` table when list branch names in `code` page dropdown - [x] Read `Branch` table when list git ref compare page - [x] Provide a button in admin page to manually sync all branches. - [x] Sync branches if repository is not empty but database branches are empty when visiting pages with branches list - [x] Use `commit_time desc` as the default FindBranch order by to keep consistent as before and deleted branches will be always at the end. --------- Co-authored-by: Jason Song <i@wolfogre.com>
* Fix duplicate Reviewed-by trailers (#24796)Cory Todd2023-06-091-0/+27
| | | | | | | | | | | | | | Enable deduplication of unofficial reviews. When pull requests are configured to include all approvers, not just official ones, in the default merge messages it was possible to generate duplicated Reviewed-by lines for a single person. Add an option to find only distinct reviews for a given query. fixes #24795 --------- Signed-off-by: Cory Todd <cory.todd@canonical.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Implement actions artifacts (#22738)FuXiaoHei2023-05-194-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | Implement action artifacts server api. This change is used for supporting https://github.com/actions/upload-artifact and https://github.com/actions/download-artifact in gitea actions. It can run sample workflow from doc https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts. The api design is inspired by https://github.com/nektos/act/blob/master/pkg/artifacts/server.go and includes some changes from gitea internal structs and methods. Actions artifacts contains two parts: - Gitea server api and storage (this pr implement basic design without some complex cases supports) - Runner communicate with gitea server api (in comming) Old pr https://github.com/go-gitea/gitea/pull/22345 is outdated after actions merged. I create new pr from main branch. ![897f7694-3e0f-4f7c-bb4b-9936624ead45](https://user-images.githubusercontent.com/2142787/219382371-eb3cf810-e4e0-456b-a8ff-aecc2b1a1032.jpeg) Add artifacts list in actions workflow page.
* fix: release page for empty or non-existing target (#24470)oliverpool2023-05-101-0/+28
| | | | | | | | | | | | | | | Fixes #24145 To solve the bug, I added a "computed" `TargetBehind` field to the `Release` model, which indicates the target branch of a release. This is particularly useful if the target branch was deleted in the meantime (or is empty). I also did a micro-optimization in `calReleaseNumCommitsBehind`. Instead of checking that a branch exists and then call `GetBranchCommit`, I immediately call `GetBranchCommit` and handle the `git.ErrNotExist` error. This optimization is covered by the added unit test.
* Allow adding new files to an empty repo (#24164)wxiaoguang2023-04-193-1/+8
| | | ![image](https://user-images.githubusercontent.com/2114189/232561612-2bfcfd0a-fc04-47ba-965f-5d0bcea46c54.png)
* fix calReleaseNumCommitsBehind (#24148)oliverpool2023-04-184-1/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | `repoCtx.CommitsCount` is not reliably the commit count of the default branch (Repository.GetCommitsCount depends on what is currently displayed). For instance on the releases page the commit count is correct: https://codeberg.org/Codeberg/pages-server/releases ![2023-04-15-215027](https://user-images.githubusercontent.com/3864879/232250500-6c05dc00-7030-4ec9-87f1-18c7797d36bf.png) However it is not on the single page: https://codeberg.org/Codeberg/pages-server/releases/tag/v4.6.2 ![2023-04-15-215036](https://user-images.githubusercontent.com/3864879/232250503-620c8038-7c2c-45a1-b99d-cb994ef955a6.png) This PR fixes this by removing a "fast branch" which was using this field (I think this field should be removed, since it is a bit unpredictable - but this would mean a larger refactoring PR). _contributed in the context of @forgejo_ --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Support "." char as user name for User/Orgs in RSS/ATOM/GPG/KEYS path ... ↵65432023-04-072-0/+47
| | | | | | | (#23874) - close #22301 workaround for https://github.com/go-chi/chi/issues/781
* Improve permission check of packages (#23879)yp053272023-04-065-3/+32
| | | | | | | | | | | | At first, we have one unified team unit permission which is called `Team.Authorize` in DB. But since https://github.com/go-gitea/gitea/pull/17811, we allowed different units to have different permission. The old code is only designed for the old version. So after #17811, if org users have write permission of other units, but have no permission of packages, they can also get write permission of packages. Co-authored-by: delvh <dev.lh@web.de>
* Replace `repo.namedBlob` by `git.TreeEntry`. (#22898)Nick2023-03-151-1/+1
| | | | | | | | `namedBlob` turned out to be a poor imitation of a `TreeEntry`. Using the latter directly shortens this code. This partially undoes https://github.com/go-gitea/gitea/pull/23152/, which I found a merge conflict with, and also expands the test it added to cover the subtle README-in-a-subfolder case.
* Fix missed migration in #22235 (#23482)Lunny Xiao2023-03-151-0/+4
| | | | Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Add user webhooks (#21563)KN4CK3R2023-03-101-1/+1
| | | | | | | Currently we can add webhooks for organizations but not for users. This PR adds the latter. You can access it from the current users settings. ![grafik](https://user-images.githubusercontent.com/1666336/197391408-15dfdc23-b476-4d0c-82f7-9bc9b065988f.png)
* Test renderReadmeFile (#23185)Nick2023-03-093-1/+20
| | | | | | | | | | | | | Add test coverage to the important features of [`routers.web.repo.renderReadmeFile`](https://github.com/go-gitea/gitea/blob/067b0c2664d127c552ccdfd264257caca4907a77/routers/web/repo/view.go#L273); namely that: - it can handle looking in docs/, .gitea/, and .github/ - it can handle choosing between multiple competing READMEs - it prefers the localized README to the markdown README to the plaintext README - it can handle broken symlinks when processing all the options - it uses the name of the symlink, not the name of the target of the symlink
* Add default owner team to privated_org and limited_org in unit test (#23109)yp053272023-03-042-2/+24
| | | | | | | | Related to https://github.com/go-gitea/gitea/pull/22705 's CI result [here](https://drone.gitea.io/go-gitea/gitea/68043/2/16) > IsOrganizationOwner() [E] [63f61849-7] Organization does not have owner team: 23
* Use correct README link to render the README (#23152)yp053272023-03-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | `renderReadmeFile` needs `readmeTreelink` as parameter but gets `treeLink`. The values of them look like as following: `treeLink`: `/{OwnerName}/{RepoName}/src/branch/{BranchName}` `readmeTreelink`: `/{OwnerName}/{RepoName}/src/branch/{BranchName}/{ReadmeFileName}` `path.Dir` in https://github.com/go-gitea/gitea/blob/8540fc45b11eff9a73753ca139f8ea5c38509bf5/routers/web/repo/view.go#L316 should convert `readmeTreelink` into `/{OwnerName}/{RepoName}/src/branch/{BranchName}` instead of the current `/{OwnerName}/{RepoName}/src/branch`. Fixes #23151 --------- Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Make CI use a dummy password hasher for all tests (#22983)zeripath2023-02-201-66/+66
| | | | | | | | | | | | | | | | During the recent hash algorithm change it became clear that the choice of password hash algorithm plays a role in the time taken for CI to run. Therefore as attempt to improve CI we should consider using a dummy hashing algorithm instead of a real hashing algorithm. This PR creates a dummy algorithm which is then set as the default hashing algorithm during tests that use the fixtures. This hopefully will cause a reduction in the time it takes for CI to run. --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use beforeCommit instead of baseCommit (#22949)Kyle D2023-02-201-0/+13
| | | | | | | | | | | | | | | | | Replaces: https://github.com/go-gitea/gitea/pull/22947 Fixes https://github.com/go-gitea/gitea/issues/22946 Probably related to https://github.com/go-gitea/gitea/issues/19530 Basically, many of the diffs were broken because they were comparing to the base commit, where a 3-dot diff should be comparing to the [last common ancestor](https://matthew-brett.github.io/pydagogue/git_diff_dots.html). This should have an integration test so that we don’t run into this issue again. --------- Co-authored-by: Jonathan Tran <jonnytran@gmail.com>
* Provide the ability to set password hash algorithm parameters (#22942)zeripath2023-02-191-65/+65
| | | | | | | | | | | | | | | | | | | | | | | This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Scoped labels (#22585)Brecht Van Lommel2023-02-184-1/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new "exclusive" option per label. This makes it so that when the label is named `scope/name`, no other label with the same `scope/` prefix can be set on an issue. The scope is determined by the last occurence of `/`, so for example `scope/alpha/name` and `scope/beta/name` are considered to be in different scopes and can coexist. Exclusive scopes are not enforced by any database rules, however they are enforced when editing labels at the models level, automatically removing any existing labels in the same scope when either attaching a new label or replacing all labels. In menus use a circle instead of checkbox to indicate they function as radio buttons per scope. Issue filtering by label ensures that only a single scoped label is selected at a time. Clicking with alt key can be used to remove a scoped label, both when editing individual issues and batch editing. Label rendering refactor for consistency and code simplification: * Labels now consistently have the same shape, emojis and tooltips everywhere. This includes the label list and label assignment menus. * In label list, show description below label same as label menus. * Don't use exactly black/white text colors to look a bit nicer. * Simplify text color computation. There is no point computing luminance in linear color space, as this is a perceptual problem and sRGB is closer to perceptually linear. * Increase height of label assignment menus to show more labels. Showing only 3-4 labels at a time leads to a lot of scrolling. * Render all labels with a new RenderLabel template helper function. Label creation and editing in multiline modal menu: * Change label creation to open a modal menu like label editing. * Change menu layout to place name, description and colors on separate lines. * Don't color cancel button red in label editing modal menu. * Align text to the left in model menu for better readability and consistent with settings layout elsewhere. Custom exclusive scoped label rendering: * Display scoped label prefix and suffix with slightly darker and lighter background color respectively, and a slanted edge between them similar to the `/` symbol. * In menus exclusive labels are grouped with a divider line. --------- Co-authored-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Do not overwrite empty DefaultBranch (#22708)Jason Song2023-02-021-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix #21994. And fix #19470. While generating new repo from a template, it does something like "commit to git repo, re-fetch repo model from DB, and update default branch if it's empty". https://github.com/go-gitea/gitea/blob/19d5b2f922c2defde579a935fbedb680eb8fff18/modules/repository/generate.go#L241-L253 Unfortunately, when load repo from DB, the default branch will be set to `setting.Repository.DefaultBranch` if it's empty: https://github.com/go-gitea/gitea/blob/19d5b2f922c2defde579a935fbedb680eb8fff18/models/repo/repo.go#L228-L233 I believe it's a very old temporary patch but has been kept for many years, see: [2d2d85bb](https://github.com/go-gitea/gitea/commit/2d2d85bb#diff-1851799b06733db4df3ec74385c1e8850ee5aedee70b8b55366910d22725eea8) I know it's a risk to delete it, may lead to potential behavioral changes, but we cannot keep the outdated `FIXME` forever. On the other hand, an empty `DefaultBranch` does make sense: an empty repo doesn't have one conceptually (actually, Gitea will still set it to `setting.Repository.DefaultBranch` to make it safer).
* Don't return duplicated users who can create org repo (#22560)Gusted2023-01-303-1/+18
| | | | | | | | | | | | | | | - Currently the function `GetUsersWhoCanCreateOrgRepo` uses a query that is able to have duplicated users in the result, this is can happen under the condition that a user is in team that either is the owner team or has permission to create organization repositories. - Add test code to simulate the above condition for user 3, [`TestGetUsersWhoCanCreateOrgRepo`](https://github.com/go-gitea/gitea/blob/a1fcb1cfb84fd6b36c8fe9fd56588119fa4377bc/models/organization/org_test.go#L435) is the test function that tests for this. - The fix is quite trivial use a map keyed by user id in order to drop duplicates. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Support org/user level projects (#22235)Lunny Xiao2023-01-202-0/+17
| | | | | | | | Fix #13405 <img width="1151" alt="image" src="https://user-images.githubusercontent.com/81045/209442911-7baa3924-c389-47b6-b63b-a740803e640e.png"> Co-authored-by: 6543 <6543@obermui.de>
* Fix error when calculate the repository size (#22392)Lunny Xiao2023-01-131-1/+1
| | | | | | | | Fix #22386 `GetDirectorySize` moved as `getDirectorySize` because it becomes a special function which should not be put in `util`. Co-authored-by: Jason Song <i@wolfogre.com>
* Check primary keys for all tables and drop ForeignReference (#21721)Jason Song2022-12-231-1/+0
| | | | | | | | | | | | | | | | | Some dbs require that all tables have primary keys, see - #16802 - #21086 We can add a test to keep it from being broken again. Edit: ~Added missing primary key for `ForeignReference`~ Dropped the `ForeignReference` table to satisfy the check, so it closes #21086. More context can be found in comments. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Test views of LFS files (#22196)Nick2022-12-234-1/+50
|
* Add a simple test for external renderer (#20033)Lunny Xiao2022-12-123-1/+34
| | | Fix #16402
* Record OAuth client type at registration (#21316)M Hickford2022-10-243-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Decouple HookTask from Repository (#17940)KN4CK3R2022-10-211-1/+0
| | | | | | | | | | | | | At the moment a repository reference is needed for webhooks. With the upcoming package PR we need to send webhooks without a repository reference. For example a package is uploaded to an organization. In theory this enables the usage of webhooks for future user actions. This PR removes the repository id from `HookTask` and changes how the hooks are processed (see `services/webhook/deliver.go`). In a follow up PR I want to remove the usage of the `UniqueQueue´ and replace it with a normal queue because there is no reason to be unique. Co-authored-by: 6543 <6543@obermui.de>
* Add some api integration tests (#18872)KN4CK3R2022-10-189-287/+1823
| | | | | | | | | | depends on #18871 Added some api integration tests to help testing of #18798. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add system setting table with cache and also add cache supports for user ↵Lunny Xiao2022-10-171-0/+15
| | | | setting (#18058)
* Improve OAuth integration tests (#21390)M Hickford2022-10-121-1/+1
| | | | | | | In particular, test explicit error responses. No change to behaviour. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add API endpoint to get changed files of a PR (#21177)qwerty2872022-09-291-2/+2
| | | | | | | | | | This adds an api endpoint `/files` to PRs that allows to get a list of changed files. built upon #18228, reviews there are included closes https://github.com/go-gitea/gitea/issues/654 Co-authored-by: Anton Bracke <anton@ju60.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix user visible check (#21210)KN4CK3R2022-09-206-2/+53
| | | | | | | | | | Fixes #21206 If user and viewer are equal the method should return true. Also the common organization check was wrong as `count` can never be less then 0. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix SQL Query for `SearchTeam` (#20844)Gusted2022-08-212-1/+7
| | | | | | | | | | - Currently the function takes in the `UserID` option, but isn't being used within the SQL query. This patch fixes that by checking that only teams are being returned that the user belongs to. Fix #20829 Co-authored-by: delvh <dev.lh@web.de>
* Exclude Archived repos from Dashboard Milestones (#19882)zeripath2022-06-041-1/+2
| | | | | | | | | Milestones in archived repos should not be displayed on `/milestones`. Therefore we should exclude these repositories from milestones page. Fix #18257 Signed-off-by: Andrew Thornton <art27@cantab.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-09 04:01:49 +0000