summaryrefslogtreecommitdiffstats
path: root/models
Commit message (Collapse)AuthorAgeFilesLines
...
* Adjust object format interface (#28469)Lunny Xiao2023-12-172-3/+7
| | | | | | | - Remove `ObjectFormatID` - Remove function `ObjectFormatFromID`. - Use `Sha1ObjectFormat` directly but not a pointer because it's an empty struct. - Store `ObjectFormatName` in `repository` struct
* Refactor SSH clone URL generation code (#28421)wxiaoguang2023-12-152-13/+42
| | | Refactor the code and add tests, keep the old logic.
* Add combined index for issue_user.uid and issue_id (#28080)sebastian-sauer2023-12-146-2/+100
| | | | | | | | fixes #27877 --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Retry SSH key verification with additional CRLF if it failed (#28392)nekrondev2023-12-141-4/+9
| | | | | | | | | | Windows-based shells will add a CRLF when piping the token into ssh-keygen command resulting in verification error. This resolves #21527. --------- Co-authored-by: Heiko Besemann <heiko.besemann@qbeyond.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Abstract hash function usage (#28138)Adam Majer2023-12-133-10/+11
| | | | | | Refactor Hash interfaces and centralize hash function. This will allow easier introduction of different hash function later on. This forms the "no-op" part of the SHA256 enablement patch.
* Second part of refactor `db.Find` (#28194)Lunny Xiao2023-12-115-174/+94
| | | Continue of #27798 and move more functions to `db.Find` and `db.Count`.
* Fix commit status in repo list (#28412)yp053272023-12-111-1/+3
| | | | | | | | | | | | | | | Before: ![image](https://github.com/go-gitea/gitea/assets/18380374/00edf23a-aee1-4177-a12c-bd03ae14e65e) ![image](https://github.com/go-gitea/gitea/assets/18380374/0663e443-682c-4a68-b14e-a0fa0e4c3716) `TestOrg/testactions` does have commit status, but won't display in `All` After: ![image](https://github.com/go-gitea/gitea/assets/18380374/7231db29-9c4e-484f-afa2-87db19be19b8) Same to #26179.
* Also sync DB branches on push if necessary (#28361)Lunny Xiao2023-12-093-24/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | Fix #28056 This PR will check whether the repo has zero branch when pushing a branch. If that, it means this repository hasn't been synced. The reason caused that is after user upgrade from v1.20 -> v1.21, he just push branches without visit the repository user interface. Because all repositories routers will check whether a branches sync is necessary but push has not such check. For every repository, it has two states, synced or not synced. If there is zero branch for a repository, then it will be assumed as non-sync state. Otherwise, it's synced state. So if we think it's synced, we just need to update branch/insert new branch. Otherwise do a full sync. So that, for every push, there will be almost no extra load added. It's high performance than yours. For the implementation, we in fact will try to update the branch first, if updated success with affect records > 0, then all are done. Because that means the branch has been in the database. If no record is affected, that means the branch does not exist in database. So there are two possibilities. One is this is a new branch, then we just need to insert the record. Another is the branches haven't been synced, then we need to sync all the branches into database.
* Remove GetByBean method because sometimes it's danger when query condition ↵Lunny Xiao2023-12-0720-155/+169
| | | | | | | | | | | | | | | | | | | | parameter is zero and also introduce new generic methods (#28220) The function `GetByBean` has an obvious defect that when the fields are empty values, it will be ignored. Then users will get a wrong result which is possibly used to make a security problem. To avoid the possibility, this PR removed function `GetByBean` and all references. And some new generic functions have been introduced to be used. The recommand usage like below. ```go // if query an object according id obj, err := db.GetByID[Object](ctx, id) // query with other conditions obj, err := db.Get[Object](ctx, builder.Eq{"a": a, "b":b}) ```
* Include public repos in doer's dashboard for issue search (#28304)Jason Song2023-12-071-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It will fix #28268 . <img width="1313" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/cb1e07d5-7a12-4691-a054-8278ba255bfc"> <img width="1318" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/4fd60820-97f1-4c2c-a233-d3671a5039e9"> ## :warning: BREAKING :warning: But need to give up some features: <img width="1312" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/281c0d51-0e7d-473f-bbed-216e2f645610"> However, such abandonment may fix #28055 . ## Backgroud When the user switches the dashboard context to an org, it means they want to search issues in the repos that belong to the org. However, when they switch to themselves, it means all repos they can access because they may have created an issue in a public repo that they don't own. <img width="286" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/182dcd5b-1c20-4725-93af-96e8dfae5b97"> It's a confusing design. Think about this: What does "In your repositories" mean when the user switches to an org? Repos belong to the user or the org? Whatever, it has been broken by #26012 and its following PRs. After the PR, it searches for issues in repos that the dashboard context user owns or has been explicitly granted access to, so it causes #28268. ## How to fix it It's not really difficult to fix it. Just extend the repo scope to search issues when the dashboard context user is the doer. Since the user may create issues or be mentioned in any public repo, we can just set `AllPublic` to true, which is already supported by indexers. The DB condition will also support it in this PR. But the real difficulty is how to count the search results grouped by repos. It's something like "search issues with this keyword and those filters, and return the total number and the top results. **Then, group all of them by repo and return the counts of each group.**" <img width="314" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/5206eb20-f8f5-49b9-b45a-1be2fcf679f4"> Before #26012, it was being done in the DB, but it caused the results to be incomplete (see the description of #26012). And to keep this, #26012 implement it in an inefficient way, just count the issues by repo one by one, so it cannot work when `AllPublic` is true because it's almost impossible to do this for all public repos. https://github.com/go-gitea/gitea/blob/1bfcdeef4cca0f5509476358e5931c13d37ed1ca/modules/indexer/issues/indexer.go#L318-L338 ## Give up unnecessary features We may can resovle `TODO: use "group by" of the indexer engines to implement it`, I'm sure it can be done with Elasticsearch, but IIRC, Bleve and Meilisearch don't support "group by". And the real question is, does it worth it? Why should we need to know the counts grouped by repos? Let me show you my search dashboard on gitea.com. <img width="1304" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/2bca2d46-6c71-4de1-94cb-0c9af27c62ff"> I never think the long repo list helps anything. And if we agree to abandon it, things will be much easier. That is this PR. ## TODO I know it's important to filter by repos when searching issues. However, it shouldn't be the way we have it now. It could be implemented like this. <img width="1316" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/99ee5f21-cbb5-4dfe-914d-cb796cb79fbe"> The indexers support it well now, but it requires some frontend work, which I'm not good at. So, I think someone could help do that in another PR and merge this one to fix the bug first. Or please block this PR and help to complete it. Finally, "Switch dashboard context" is also a design that needs improvement. In my opinion, it can be accomplished by adding filtering conditions instead of "switching".
* Fix incorrect run order of action jobs (#28367)yp053272023-12-061-1/+1
| | | | | | When we pick up a job, all waiting jobs should firstly be ordered by update time, otherwise when there's a running job, if I rerun an older job, the older job will run first, as it's id is smaller.
* handle repository.size column being NULL in migration v263 (#28336)Nate Levesque2023-12-051-1/+6
| | | | | | | | | | | | | | | | | | This resolves a problem I encountered while updating gitea from 1.20.4 to 1.21. For some reason (correct or otherwise) there are some values in `repository.size` that are NULL in my gitea database which cause this migration to fail due to the NOT NULL constraints. Log snippet (excuse the escape characters) ``` ESC[36mgitea |ESC[0m 2023-12-04T03:52:28.573122395Z 2023/12/04 03:52:28 ...ations/migrations.go:641:Migrate() [I] Migration[263]: Add git_size and lfs_size columns to repository table ESC[36mgitea |ESC[0m 2023-12-04T03:52:28.608705544Z 2023/12/04 03:52:28 routers/common/db.go:36:InitDBEngine() [E] ORM engine initialization attempt #3/10 failed. Error: migrate: migration[263]: Add git_size and lfs_size columns to repository table failed: NOT NULL constraint failed: repository.git_size ``` I assume this should be reasonably safe since `repository.git_size` has a default value of 0 but I don't know if that value being 0 in the odd situation where `repository.size == NULL` has any problematic consequences.
* Increase "version" when update the setting value to a same value as before ↵wxiaoguang2023-11-272-1/+13
| | | | | | (#28243) Setting the same value should not trigger DuplicateKey error, and the "version" should be increased
* Fix comment permissions (#28213)Lunny Xiao2023-11-259-48/+83
| | | | This PR will fix some missed checks for private repositories' data on web routes and API routes.
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-2432-495/+369
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Use restricted sanitizer for repository description (#28141)Earl Warren2023-11-231-2/+2
| | | | | | | | | | | | | | | - Currently the repository description uses the same sanitizer as a normal markdown document. This means that element such as heading and images are allowed and can be abused. - Create a minimal restricted sanitizer for the repository description, which only allows what the postprocessor currently allows, which are links and emojis. - Added unit testing. - Resolves https://codeberg.org/forgejo/forgejo/issues/1202 - Resolves https://codeberg.org/Codeberg/Community/issues/1122 (cherry picked from commit 631c87cc2347f0036a75dcd21e24429bbca28207) Co-authored-by: Gusted <postmaster@gusted.xyz>
* Fix no ActionTaskOutput table waring (#28149)yp053272023-11-211-0/+4
| | | | | | | | | | | | | | | Reproduce: - Create a new Gitea instance - Register a runner - Create a repo and add a workflow - Check the log, you will see warnings: ![image](https://github.com/go-gitea/gitea/assets/18380374/5f1278e0-114b-48bc-8113-8ba1404d9975) It comes from: ![image](https://github.com/go-gitea/gitea/assets/18380374/c2807831-e137-4229-9536-87f6114c8a5b) The reason is that we forgot registering `ActionTaskOutput` model. So `action_table_output` table will be missing in your db.
* Fix system config cache expiration timing (#28072)wxiaoguang2023-11-161-8/+10
| | | | | | To avoid unnecessary database access, the `cacheTime` should always be set if the revision has been checked. Fix #28057
* Revert "packages: Calculate package size quota using package creator ID ↵Lunny Xiao2023-11-141-12/+0
| | | | | instead of owner ID (#28007)" (#28049) This reverts commit #28007 60522fc96f1fa4675e95010e4b1535e0eac21910.
* Restricted users only see repos in orgs which their team was assigned to ↵65432023-11-141-5/+5
| | | | | | (#28025) --- *Sponsored by Kithara Software GmbH*
* packages: Calculate package size quota using package creator ID instead of ↵Danila Fominykh2023-11-141-0/+12
| | | | | | | | | | | | | | | | | | | | owner ID (#28007) Changed behavior to calculate package quota limit using package `creator ID` instead of `owner ID`. Currently, users are allowed to create an unlimited number of organizations, each of which has its own package limit quota, resulting in the ability for users to have unlimited package space in different organization scopes. This fix will calculate package quota based on `package version creator ID` instead of `package version owner ID` (which might be organization), so that users are not allowed to take more space than configured package settings. Also, there is a side case in which users can publish packages to a specific package version, initially published by different user, taking that user package size quota. Version in fix should be better because the total amount of space is limited to the quota for users sharing the same organization scope.
* Enable system users for comment.LoadPoster (#28014)Earl Warren2023-11-131-1/+1
| | | | | | | | | | | | System users (Ghost, ActionsUser, etc) have a negative id and may be the author of a comment, either because it was created by a now deleted user or via an action using a transient token. The GetPossibleUserByID function has special cases related to system users and will not fail if given a negative id. Refs: https://codeberg.org/forgejo/forgejo/issues/1425 (cherry picked from commit 6a2d2fa24390116d31ae2507c0a93d423f690b7b)
* Fix missing mail reply address (#27997)KN4CK3R2023-11-131-0/+8
| | | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1458 Some mails such as issue creation mails are missing the reply-to-comment address. This PR fixes that and specifies which comment types should get a reply-possibility.
* Fix wrong xorm Delete usage (#27995)Nanguan Lin2023-11-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Bug in Gitea I ran into this bug when I accidentally used the wrong redirect URL for the oauth2 provider when using mssql. But the oauth2 provider still got added. Most of the time, we use `Delete(&some{id: some.id})` or `In(condition).Delete(&some{})`, which specify the conditions. But the function uses `Delete(source)` when `source.Cfg` is a `TEXT` field and not empty. This will cause xorm `Delete` function not working in mssql. https://github.com/go-gitea/gitea/blob/61ff91f9603806df2505907614b9006bf721b9c8/models/auth/source.go#L234-L240 ## Reason Because the `TEXT` field can not be compared in mssql, xorm doesn't support it according to [this PR](https://gitea.com/xorm/xorm/pulls/2062) [related code](https://gitea.com/xorm/xorm/src/commit/b23798dc987af776bec867f4537ca129fd66328e/internal/statements/statement.go#L552-L558) in xorm ```go if statement.dialect.URI().DBType == schemas.MSSQL && (col.SQLType.Name == schemas.Text ||   col.SQLType.IsBlob() || col.SQLType.Name == schemas.TimeStampz) {   if utils.IsValueZero(fieldValue) {   continue   }   return nil, fmt.Errorf("column %s is a TEXT type with data %#v which cannot be as compare condition", col.Name, fieldValue.Interface())   } } ``` When using the `Delete` function in xorm, the non-empty fields will auto-set as conditions(perhaps some special fields are not?). If `TEXT` field is not empty, xorm will return an error. I only found this usage after searching, but maybe there is something I missing. --------- Co-authored-by: delvh <dev.lh@web.de>
* Fix 500 when deleting a dismissed review (#27903)Nanguan Lin2023-11-052-0/+40
| | | | Fix #27767 Add a test to ensure its behavior
* Remove action runners on user deletion (#27902)Earl Warren2023-11-051-0/+24
| | | | | | | | | | - On user deletion, delete action runners that the user has created. - Add a database consistency check to remove action runners that have nonexistent belonging owner. - Resolves https://codeberg.org/forgejo/forgejo/issues/1720 (cherry picked from commit 009ca7223dab054f7f760b7ccae69e745eebfabb) Co-authored-by: Gusted <postmaster@gusted.xyz>
* Refactor the function RemoveOrgUser (#27582)Lunny Xiao2023-11-032-20/+12
| | | This PR is a small refactor to merge removeOrgUser into RemoveOrgUser.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-033-38/+22
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Display issue task list on project cards (#27865)KN4CK3R2023-11-021-10/+2
| | | | | | | | Display the issue task list on project cards. ![grafik](https://github.com/go-gitea/gitea/assets/1666336/e6cb3196-8980-403c-9795-3a7b03fbfb3c) Co-authored-by: Giteabot <teabot@gitea.io>
* Add Index to pull_auto_merge.doer_id (#27811)JakobDev2023-10-303-1/+19
| | | | | | | | Reported at https://codeberg.org/forgejo/forgejo/issues/1677 This column is used by [deleteUser](https://github.com/go-gitea/gitea/blob/f089be91da44ee3e85fbe326a204c7c8a5df3d31/services/user/delete.go#L90). Note: This PR contains a Migration, so we can't backport it to 1.21.
* List all Debian package versions in `Packages` (#27786)KN4CK3R2023-10-293-17/+34
| | | | | | Closes #27783 This PR lists all and not only the latest package versions in the `Packages` index.
* Upgrade xorm to 1.3.4 (#27807)Nanguan Lin2023-10-271-1/+1
| | | | | | | Noticeable change: Remove the `OrderBy("1") ` [patch](https://github.com/go-gitea/gitea/pull/27673#issuecomment-1768570142) for mssql since xorm has [fixed it](https://gitea.com/xorm/xorm/commit/0f085408afd85707635eadb2294ab52be04f3c0f).
* Fix issue not showing on default board and add test (#27720)Nanguan Lin2023-10-251-1/+1
| | | | | | | | | | | | See https://github.com/go-gitea/gitea/pull/27718#issuecomment-1773743014 . Add a test to ensure its behavior. Why this test uses `ProjectBoardID=0`? Because in `SearchOptions`, `ProjectBoardID=0` means what it is. But in `IssueOptions`, `ProjectBoardID=0` means there is no condition, and `ProjectBoardID=db.NoConditionID` means the board ID = 0. It's really confusing. Probably it's better to separate the db search engine and the other issue search code. It's really two different systems. As far as I can see, `IssueOptions` is not necessary for most of the code, which has very simple issue search conditions.
* Upgrade to golangci-lint@v1.55.0 (#27756)silverwind2023-10-243-5/+3
| | | https://github.com/golangci/golangci-lint/releases/tag/v1.55.0
* refactor: make db iterate context aware (#27710)65432023-10-211-14/+19
| | | | | | | | | the iteration will run until finished atm. this changes it by checking if if the context got canceled before each run of a loop sequence is executed [View this pull with now whitespace](https://github.com/go-gitea/gitea/pull/27710/files?diff=unified&w=1)
* Replace -1 with GhostUserID (#27703)Nanguan Lin2023-10-206-12/+17
|
* Clean some functions about project issue (#27705)Nanguan Lin2023-10-202-36/+14
| | | | | | | | | 1. remove unused function `MoveIssueAcrossProjectBoards` 2. extract the project board condition into a function 3. use db.NoCondition instead of -1. (BTW, the usage of db.NoCondition is too confusing. Is there any way to avoid that?) 4. remove the unnecessary comment since the ctx refactor is completed. 5. Change `b.ID != 0` to `b.ID > 0`. It's more intuitive but I think they're the same since board ID can't be negative.
* Show total TrackedTime on issue/pull/milestone lists (#26672)65432023-10-193-0/+62
| | | | | | | | | | | | | | TODOs: - [x] write test for `GetIssueTotalTrackedTime` - [x] frontport kitharas template changes and make them mobile-friendly --- ![image](https://github.com/go-gitea/gitea/assets/24977596/6713da97-201f-4217-8588-4c4cec157171) ![image](https://github.com/go-gitea/gitea/assets/24977596/3a45aba8-26b5-4e6a-b97d-68bfc2bf9024) --- *Sponsored by Kithara Software GmbH*
* Upgrade xorm (#27673)Nanguan Lin2023-10-192-2/+10
| | | Related to https://gitea.com/xorm/xorm/pulls/2341
* Add unit tests for action runner token (#27670)Nanguan Lin2023-10-193-0/+93
| | | In case the behavior of the register token changes.
* Fix typo "GetLatestRunnerToken" (#27680)Jason Song2023-10-181-2/+2
|
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-1510-29/+33
| | | Target #27065
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-1415-104/+110
| | | Last part of #27065
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-147-0/+83
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Replace assert.Fail with assert.FailNow (#27578)Nanguan Lin2023-10-112-4/+3
| | | | | | | | | assert.Fail() will continue to execute the code while assert.FailNow() not. I thought those uses of assert.Fail() should exit immediately. PS: perhaps it's a good idea to use [require](https://pkg.go.dev/github.com/stretchr/testify/require) somewhere because the assert package's default behavior does not exit when an error occurs, which makes it difficult to find the root error reason.
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-1132-180/+180
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Make actions default enabled for newly created repository if global ↵Lunny Xiao2023-10-102-1/+2
| | | | configuraion enabled (#27482)
* Respect SSH.KeygenPath option when calculating ssh key fingerprints (#27536)Sebastian Grabowski2023-10-101-1/+1
| | | Fixes #27535
* Restore warning commit status (#27504)silverwind2023-10-082-3/+4
| | | | | | | | | | | | | Partial revert of https://github.com/go-gitea/gitea/pull/25839. This commit status is used by a number of external integrations, so I think we should not remove it (See https://github.com/go-gitea/gitea/pull/25839#issuecomment-1729002077). This is a rare case where an existing migration needed to be alterted to avoid data loss. --------- Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Giteabot <teabot@gitea.io>
* Pre-register OAuth application for tea (#27509)M Hickford2023-10-081-0/+5
| | | | | | It remains to implement OAuth login in tea https://gitea.com/gitea/tea/issues/598 Fixes #27510
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-23 04:02:29 +0000