aboutsummaryrefslogtreecommitdiffstats
path: root/models/user
Commit message (Collapse)AuthorAgeFilesLines
* Return default avatar url when user id is zero rather than updating database ↵Giteabot2025-04-021-1/+3
| | | | | | | | | | | | | | | | | (#34094) (#34095) Backport #34094 by @lunny When visit commit list, it would update the user avatar even if id = 0, which was unnecessary operations. This PR returned default avatar for the git only user avatar rendering who's user id is zero. ```log database duration=0.0005s db.sql="UPDATE `user` SET `avatar` = ?, `updated_unix` = ? WHERE `id`=?" database duration=0.0007s db.sql="UPDATE `user` SET `avatar` = ?, `updated_unix` = ? WHERE `id`=?" ... ``` Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix user avatar (#33439)wxiaoguang2025-01-304-10/+103
|
* Support for email addresses containing uppercase characters when activating ↵Giteabot2024-12-272-19/+35
| | | | | | | | | | user account (#32998) (#33001) Backport #32998 by Zettat123 Fix #32807 Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Enable tenv and testifylint rules (#32852)TheFox0x72024-12-153-12/+11
| | | | Enables tenv and testifylint linters closes: https://github.com/go-gitea/gitea/issues/32842
* Strict pagination check (#32548)Lunny Xiao2024-11-252-3/+3
|
* Fix GetInactiveUsers (#32540)Lunny Xiao2024-11-212-6/+26
| | | Fix #31480
* Allow code search by filename (#32210)Bruno Sofiato2024-10-111-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a large and complex PR, so let me explain in detail its changes. First, I had to create new index mappings for Bleve and ElasticSerach as the current ones do not support search by filename. This requires Gitea to recreate the code search indexes (I do not know if this is a breaking change, but I feel it deserves a heads-up). I've used [this approach](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/analysis-pathhierarchy-tokenizer.html) to model the filename index. It allows us to efficiently search for both the full path and the name of a file. Bleve, however, does not support this out-of-box, so I had to code a brand new [token filter](https://blevesearch.com/docs/Token-Filters/) to generate the search terms. I also did an overhaul in the `indexer_test.go` file. It now asserts the order of the expected results (this is important since matches based on the name of a file are more relevant than those based on its content). I've added new test scenarios that deal with searching by filename. They use a new repo included in the Gitea fixture. The screenshot below depicts how Gitea shows the search results. It shows results based on content in the same way as the current version does. In matches based on the filename, the first seven lines of the file contents are shown (BTW, this is how GitHub does it). ![image](https://github.com/user-attachments/assets/9d938d86-1a8d-4f89-8644-1921a473e858) Resolves #32096 --------- Signed-off-by: Bruno Sofiato <bruno.sofiato@gmail.com>
* Improve the maintainblity of the reserved username list (#32229)wxiaoguang2024-10-101-27/+29
|
* Move admin routers from /admin to /-/admin (#32189)Lunny Xiao2024-10-101-1/+0
| | | | | | | Resolve #32181 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix bug when a token is given public only (#32204)Lunny Xiao2024-10-081-0/+4
|
* Add support for searching users by email (#30908)yp053272024-10-041-1/+13
| | | | | | | Fix #30898 we have an option `SearchByEmail`, so enable it, then we can search user by email. Also added a test for it.
* Save initial signup information for users to aid in spam prevention (#31852)techknowlogick2024-09-093-9/+37
| | | | | | | | | | | | | | This will allow instance admins to view signup pattern patterns for public instances. It is modelled after discourse, mastodon, and MediaWiki's approaches. Note: This has privacy implications, but as the above-stated open-source projects take this approach, especially MediaWiki, which I have no doubt looked into this thoroughly, it is likely okay for us, too. However, I would be appreciative of any feedback on how this could be improved. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Support delete user email in admin panel (#31690)yp053272024-07-251-0/+1
| | | | | | | | | | | ![QQ_1721784609320](https://github.com/user-attachments/assets/23f08bf3-93f4-44d7-963d-10380ef8c1f1) ![QQ_1721784616403](https://github.com/user-attachments/assets/667cbd1e-5e21-4489-8d18-2a7be85190db) ![QQ_1721784626722](https://github.com/user-attachments/assets/495beb94-dfa2-481c-aa60-d5115cad1ae1) --------- Co-authored-by: Jason Song <i@wolfogre.com>
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-161-3/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Allow disabling authentication related user features (#31535)Rowan Bohde2024-07-091-4/+6
| | | | | | | | | | | | | | | | | | | | We have some instances that only allow using an external authentication source for authentication. In this case, users changing their email, password, or linked OpenID connections will not have any effect, and we'd like to prevent showing that to them to prevent confusion. Included in this are several changes to support this: * A new setting to disable user managed authentication credentials (email, password & OpenID connections) * A new setting to disable user managed MFA (2FA codes & WebAuthn) * Fix an issue where some templates had separate logic for determining if a feature was disabled since it didn't check the globally disabled features * Hide more user setting pages in the navbar when their settings aren't enabled --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Use FullName in Emails to address the recipient if possible (#31527)65432024-07-082-0/+53
| | | | | | | | Before we had just the plain mail address as recipient. But now we provide additional Information for the Mail clients. --- *Sponsored by Kithara Software GmbH*
* Fix duplicate sub-path for avatars (#31365)wxiaoguang2024-06-152-2/+32
| | | | | | | | | | | Fix #31361, and add tests And this PR introduces an undocumented & debug-purpose-only config option: `USE_SUB_URL_PATH`. It does nothing for end users, it only helps the development of sub-path related problems. And also fix #31366 Co-authored-by: @ExplodingDragon
* Performance improvements for pull request list API (#30490)Lunny Xiao2024-05-311-0/+4
| | | | | | | | Fix #30483 --------- Co-authored-by: yp05327 <576951401@qq.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Refactor sha1 and time-limited code (#31023)wxiaoguang2024-05-202-8/+4
| | | | | | | Remove "EncodeSha1", it shouldn't be used as a general purpose hasher (just like we have removed "EncodeMD5" in #28622) Rewrite the "time-limited code" related code and write better tests, the old code doesn't seem quite right.
* Refactor AppURL usage (#30885)wxiaoguang2024-05-071-7/+3
| | | | | | | | Fix #30883 Fix #29591 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Replace deprecated `math/rand` functions (#30733)v1.23.0-devChongyi Zheng2024-04-271-1/+1
| | | | | | | | | | | | Suggested by logs in #30729 - Remove `math/rand.Seed` `rand.Seed is deprecated: As of Go 1.20 there is no reason to call Seed with a random value.` - Replace `math/rand.Read` `rand.Read is deprecated: For almost all use cases, [crypto/rand.Read] is more appropriate.` - Replace `math/rand` with `math/rand/v2`, which is available since Go 1.22
* Improve oauth2 client "preferred username field" logic and the error ↵wxiaoguang2024-04-252-12/+13
| | | | | | | | | | | | | handling (#30622) Follow #30454 And fix #24957 When using "preferred_username", if no such field, `extractUserNameFromOAuth2` (old `getUserName`) shouldn't return an error. All other USERNAME options do not return such error. And fine tune some logic and error messages, make code more stable and more friendly to end users.
* Enable more `revive` linter rules (#30608)silverwind2024-04-221-2/+1
| | | | | | | | | | | Noteable additions: - `redefines-builtin-id` forbid variable names that shadow go builtins - `empty-lines` remove unnecessary empty lines that `gofumpt` does not remove for some reason - `superfluous-else` eliminate more superfluous `else` branches Rules are also sorted alphabetically and I cleaned up various parts of `.golangci.yml`.
* Refactor DeleteInactiveUsers, fix bug and add tests (#30206)wxiaoguang2024-04-011-8/+0
| | | | | | | | | 1. check `IsActive` before calling `IsLastAdminUser`. 2. Fix some comments and error messages. 3. Don't `return err` if "removing file" fails in `DeleteUser`. 4. Remove incorrect `DeleteInactiveEmailAddresses`. Active users could also have inactive emails, and inactive emails do not support "olderThan" 5. Add tests
* Add setting to disable user features when user login type is not plain (#29615)Jack Hay2024-03-292-0/+53
| | | | | | | | | ## Changes - Adds setting `EXTERNAL_USER_DISABLE_FEATURES` to disable any supported user features when login type is not plain - In general, this is necessary for SSO implementations to avoid inconsistencies between the external account management and the linked account - Adds helper functions to encourage correct use
* Fix user id column case (#29863)Nanguan Lin2024-03-171-2/+2
| | | Sometimes the column name is case-sensitive and it may cause 500.
* remove repetitive words (#29695)pengqiseven2024-03-111-1/+1
| | | Signed-off-by: pengqiseven <912170095@qq.com>
* Add a warning for disallowed email domains (#29658)Zettat1232024-03-111-8/+8
| | | | | | | | | | | | | Resolve #29660 Follow #29522 and #29609 Add a warning for disallowed email domains when admins manually add/edit users. Thanks @yp05327 for the [comment](https://github.com/go-gitea/gitea/pull/29605#issuecomment-1980105119) ![image](https://github.com/go-gitea/gitea/assets/15528715/6737b221-a3a2-4180-9ef8-b846c10f96e0)
* Skip email domain check when admins edit user emails (#29609)Zettat1232024-03-051-1/+1
| | | | | | Follow #29522 Administrators should be able to set a user's email address even if the email address is not in `EMAIL_DOMAIN_ALLOWLIST`
* Skip email domain check when admin users adds user manually (#29522)Zettat1232024-03-052-30/+65
| | | | | | Fix #27457 Administrators should be able to manually create any user even if the user's email address is not in `EMAIL_DOMAIN_ALLOWLIST`.
* Add user blocking (#29028)KN4CK3R2024-03-044-12/+144
| | | | | | | | | | | | | | | | | | | | | | Fixes #17453 This PR adds the abbility to block a user from a personal account or organization to restrict how the blocked user can interact with the blocker. The docs explain what's the consequence of blocking a user. Screenshots: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/4ed884f3-e06a-4862-afd3-3b8aa2488dc6) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ae6d4981-f252-4f50-a429-04f0f9f1cdf1) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ca153599-5b0f-4b4a-90fe-18bdfd6f0b6b) --------- Co-authored-by: Lauris BH <lauris@nix.lv>
* remove util.OptionalBool and related functions (#29513)65432024-03-021-4/+4
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Add admin API route for managing user's badges (#23106)techknowlogick2024-03-011-1/+84
| | | | | | | Fix #22785 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* migrate some more "OptionalBool" to "Option[bool]" (#29479)65432024-02-294-41/+36
| | | | | | | | just some refactoring bits towards replacing **util.OptionalBool** with **optional.Option[bool]** --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Allow to change primary email before account activation (#29412)wxiaoguang2024-02-272-35/+38
|
* Only use supported sort order for "explore/users" page (#29430)wxiaoguang2024-02-271-0/+3
| | | | | | | | | | | | | | Thanks to inferenceus : some sort orders on the "explore/users" page could list users by their lastlogintime/updatetime. It leaks user's activity unintentionally. This PR makes that page only use "supported" sort orders. Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help. ![image](https://github.com/go-gitea/gitea/assets/2114189/ce5c39c1-1e86-484a-80c3-33cac6419af8)
* Allow non-admin users to delete review requests (#29057)Zettat1232024-02-241-3/+3
| | | | | | | | Fix #14459 The following users can add/remove review requests of a PR - the poster of the PR - the owner or collaborators of the repository - members with read permission on the pull requests unit
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-231-12/+13
| | | just create transition helper and migrate two structs
* Remove unused `KeyID`. (#29167)KN4CK3R2024-02-143-14/+11
| | | `KeyID` is never set.
* Drop "@" from email sender to avoid spam filters (#29109)Gwyneth Morgan2024-02-101-4/+4
| | | | | | | | | | | | | | | | Commit 360b3fd17c (Include username in email headers (#28981), 2024-02-03) adds usernames to the From field of notification emails in the form of `Display Name (@username)`, to prevent spoofing. However, some email filtering software flags "@" in the display name part of the From field as potential spoofing, as you could set the display name part to another email address than the one you are sending from (e.g. `From: "apparent@email-address" <actual@email-address>`). To avoid being flagged, instead send emails from `Display Name (username)`. Closes: #29107 --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Unify user update methods (#28733)KN4CK3R2024-02-045-396/+59
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Include username in email headers (#28981)Gwyneth Morgan2024-02-031-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Emails from Gitea comments do not contain the username of the commenter anywhere, only their display name, so it is not possible to verify who made a comment from the email itself: From: "Alice" <email@gitea> X-Gitea-Sender: Alice X-Gitea-Recipient: Bob X-GitHub-Sender: Alice X-GitHub-Recipient: Bob This comment looks like it's from @alice. The X-Gitea/X-GitHub headers also use display names, which is not very reliable for filtering, and inconsistent with GitHub's behavior: X-GitHub-Sender: lunny X-GitHub-Recipient: gwymor This change includes both the display name and username in the From header, and switches the other headers from display name to username: From: "Alice (@fakealice)" <email@gitea> X-Gitea-Sender: fakealice X-Gitea-Recipient: bob X-GitHub-Sender: fakealice X-GitHub-Recipient: bob This comment looks like it's from @alice.
* Forbid removing the last admin user (#28337)yp053272024-01-151-4/+25
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix when private user following user, private user will not be counted in ↵yp053272024-01-151-0/+2
| | | | | | | | | | | | | | | | | | | his own view (#28037) Doer: asdasasdasasdasasdasasdasasdasasdasasdas (private user) Followed: TestUser (public user) Before: (From doer's view) ![image](https://github.com/go-gitea/gitea/assets/18380374/9ba16b3b-068c-43c5-a3dd-e3343b5b32f2) (From followed user's view, can see doer) ![image](https://github.com/go-gitea/gitea/assets/18380374/dfd1b564-d689-4393-b3d3-1e6bf52c94ba) After: (From doer's view) ![image](https://github.com/go-gitea/gitea/assets/18380374/1c85c1d1-c9f7-40c8-948c-145f7cae9a04)
* Normalize oauth email username (#28561)Kyle D2024-01-032-0/+53
|
* Remove GetByBean method because sometimes it's danger when query condition ↵Lunny Xiao2023-12-072-14/+18
| | | | | | | | | | | | | | | | | | | | parameter is zero and also introduce new generic methods (#28220) The function `GetByBean` has an obvious defect that when the fields are empty values, it will be ignored. Then users will get a wrong result which is possibly used to make a security problem. To avoid the possibility, this PR removed function `GetByBean` and all references. And some new generic functions have been introduced to be used. The recommand usage like below. ```go // if query an object according id obj, err := db.GetByID[Object](ctx, id) // query with other conditions obj, err := db.Get[Object](ctx, builder.Eq{"a": a, "b":b}) ```
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-241-27/+9
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Replace -1 with GhostUserID (#27703)Nanguan Lin2023-10-203-9/+14
|
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-141-16/+16
| | | Last part of #27065
* Refactor system setting (#27000)wxiaoguang2023-10-051-4/+1
| | | | | | | | | This PR reduces the complexity of the system setting system. It only needs one line to introduce a new option, and the option can be used anywhere out-of-box. It is still high-performant (and more performant) because the config values are cached in the config system.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-16 19:11:00 +0000