summaryrefslogtreecommitdiffstats
path: root/modules/auth/auth.go
Commit message (Collapse)AuthorAgeFilesLines
* Move macaron to chi (#14293)Lunny Xiao2021-01-261-149/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | Use [chi](https://github.com/go-chi/chi) instead of the forked [macaron](https://gitea.com/macaron/macaron). Since macaron and chi have conflicts with session share, this big PR becomes a have-to thing. According my previous idea, we can replace macaron step by step but I'm wrong. :( Below is a list of big changes on this PR. - [x] Define `context.ResponseWriter` interface with an implementation `context.Response`. - [x] Use chi instead of macaron, and also a customize `Route` to wrap chi so that the router usage is similar as before. - [x] Create different routers for `web`, `api`, `internal` and `install` so that the codes will be more clear and no magic . - [x] Use https://github.com/unrolled/render instead of macaron's internal render - [x] Use https://github.com/NYTimes/gziphandler instead of https://gitea.com/macaron/gzip - [x] Use https://gitea.com/go-chi/session which is a modified version of https://gitea.com/macaron/session and removed `nodb` support since it will not be maintained. **BREAK** - [x] Use https://gitea.com/go-chi/captcha which is a modified version of https://gitea.com/macaron/captcha - [x] Use https://gitea.com/go-chi/cache which is a modified version of https://gitea.com/macaron/cache - [x] Use https://gitea.com/go-chi/binding which is a modified version of https://gitea.com/macaron/binding - [x] Use https://github.com/go-chi/cors instead of https://gitea.com/macaron/cors - [x] Dropped https://gitea.com/macaron/i18n and make a new one in `code.gitea.io/gitea/modules/translation` - [x] Move validation form structs from `code.gitea.io/gitea/modules/auth` to `code.gitea.io/gitea/modules/forms` to avoid dependency cycle. - [x] Removed macaron log service because it's not need any more. **BREAK** - [x] All form structs have to be get by `web.GetForm(ctx)` in the route function but not as a function parameter on routes definition. - [x] Move Git HTTP protocol implementation to use routers directly. - [x] Fix the problem that chi routes don't support trailing slash but macaron did. - [x] `/api/v1/swagger` now will be redirect to `/api/swagger` but not render directly so that `APIContext` will not create a html render. Notices: - Chi router don't support request with trailing slash - Integration test `TestUserHeatmap` maybe mysql version related. It's failed on my macOS(mysql 5.7.29 installed via brew) but succeed on CI. Co-authored-by: 6543 <6543@obermui.de>
* Fix recovery middleware to render gitea style page. (#13857)Lunny Xiao2021-01-051-25/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | * Some changes to fix recovery * Move Recovery to middlewares * Remove trace code * Fix lint * add session middleware and remove dependent on macaron for sso * Fix panic 500 page rendering * Fix bugs * Fix fmt * Fix vendor * recover unnecessary change * Fix lint and addd some comments about the copied codes. * Use util.StatDir instead of com.StatDir Co-authored-by: 6543 <6543@obermui.de>
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-207/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
* Add setting to disable BASIC authentication (#8586)zeripath2019-10-191-0/+3
| | | Closes #8561.
* Implement webhook branch filter (#7791)WGH2019-09-091-9/+8
| | | | | | | | * Fix validate() function to handle errors in embedded anon structs * Implement webhook branch filter See #2025, #3998.
* Allow token as authorization for accessing attachments (#7909)David Svantesson2019-08-241-1/+6
| | | | | | | | * Allow token as authorization for accessing attachments Signed-off-by: David Svantesson <davidsvantesson@gmail.com> * Only allow token authentication for attachments if it is a download (GET)
* Use gitea forked macaron (#7933)Tamal Saha2019-08-231-6/+6
| | | Signed-off-by: Tamal Saha <tamal@appscode.com>
* Display ui time with customize time location (#7792)Lunny Xiao2019-08-151-3/+3
| | | | | | | | | | | | | | | | | | * display ui time with customize time location * fix lint * rename UILocation to DefaultUILocation * move time related functions to modules/timeutil * fix tests * fix tests * fix build * fix swagger
* Add golangci (#6418)kolaente2019-06-121-10/+2
|
* OAuth2 token can be used in basic auth (#6747)techknowlogick2019-04-251-2/+16
|
* API OTP Context (#6674)techknowlogick2019-04-191-1/+2
| | | | | | | | | | | | | | | | | | | | | | * API OTP Context * Update api.go * token * token * fix per discord * copyright header * remove check for token in OTP * Update auth.go * simplify * Update api.go
* Better logging (#6038) (#6095)zeripath2019-04-021-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Panic don't fatal on create new logger Fixes #5854 Signed-off-by: Andrew Thornton <art27@cantab.net> * partial broken * Update the logging infrastrcture Signed-off-by: Andrew Thornton <art27@cantab.net> * Reset the skip levels for Fatal and Error Signed-off-by: Andrew Thornton <art27@cantab.net> * broken ncsa * More log.Error fixes Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove nal * set log-levels to lowercase * Make console_test test all levels * switch to lowercased levels * OK now working * Fix vetting issues * Fix lint * Fix tests * change default logging to match current gitea * Improve log testing Signed-off-by: Andrew Thornton <art27@cantab.net> * reset error skip levels to 0 * Update documentation and access logger configuration * Redirect the router log back to gitea if redirect macaron log but also allow setting the log level - i.e. TRACE * Fix broken level caching * Refactor the router log * Add Router logger * Add colorizing options * Adjust router colors * Only create logger if they will be used * update app.ini.sample * rename Attribute ColorAttribute * Change from white to green for function * Set fatal/error levels * Restore initial trace logger * Fix Trace arguments in modules/auth/auth.go * Properly handle XORMLogger * Improve admin/config page * fix fmt * Add auto-compression of old logs * Update error log levels * Remove the unnecessary skip argument from Error, Fatal and Critical * Add stacktrace support * Fix tests * Remove x/sync from vendors? * Add stderr option to console logger * Use filepath.ToSlash to protect against Windows in tests * Remove prefixed underscores from names in colors.go * Remove not implemented database logger This was removed from Gogs on 4 Mar 2016 but left in the configuration since then. * Ensure that log paths are relative to ROOT_PATH * use path.Join * rename jsonConfig to logConfig * Rename "config" to "jsonConfig" to make it clearer * Requested changes * Requested changes: XormLogger * Try to color the windows terminal If successful default to colorizing the console logs * fixup * Colorize initially too * update vendor * Colorize logs on default and remove if this is not a colorizing logger * Fix documentation * fix test * Use go-isatty to detect if on windows we are on msys or cygwin * Fix spelling mistake * Add missing vendors * More changes * Rationalise the ANSI writer protection * Adjust colors on advice from @0x5c * Make Flags a comma separated list * Move to use the windows constant for ENABLE_VIRTUAL_TERMINAL_PROCESSING * Ensure matching is done on the non-colored message - to simpify EXPRESSION
* Integrate OAuth2 Provider (#5378)Jonas Franz2019-03-081-1/+32
|
* In basic auth check for tokens before call UserSignIn (#5725)manuelluis2019-02-121-5/+46
| | | | | | | | | | * Check first if user/password is a token * In basic auth check if user/password is a token * Remove unnecessary else statement * Changes of fmt
* Support reverse proxy providing email (#5554)zeripath2018-12-181-1/+8
| | | This PR implements #2347
* Remove check for negative length (#5120)Oleg Kovalov2018-10-201-1/+1
|
* Enforce token on api routes [fixed critical security issue #4357] (#4840)B-OnTheGo2018-09-101-1/+2
|
* Refactor struct's time to remove unnecessary memory usage (#3142)Lunny Xiao2017-12-111-2/+2
| | | | | | | | | | | | | | * refactor struct's time to remove unnecessary memory usage * use AsTimePtr simple code * fix tests * fix time compare * fix template on gpg * use AddDuration instead of Add
* Better URL validation (#1507)Lauris BH2017-04-191-0/+3
| | | | | | | | | | | | | | | | | | | | * Add correct git branch name validation * Change git refname validation error constant name * Implement URL validation based on GoLang url.Parse method * Backward compatibility with older Go compiler * Add git reference name validation unit tests * Remove unused variable in unit test * Implement URL validation based on GoLang url.Parse method * Backward compatibility with older Go compiler * Add url validation unit tests
* fix: gofmt errors. (#1106)Bo-Yi Wu2017-03-031-2/+2
|
* Oauth2 consumer (#679)Willem van Dreumel2017-02-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
* Avoid duplicate queries in auth (#827)Ethan Koenig2017-02-051-57/+48
| | | Avoid identical making calls to GetUserByID(..) in SignedInUser(..)
* GitHub API Compliance (& linting)Kim "BKC" Carlbäcker2016-12-021-0/+3
|
* golint fixed for modules/authLunny Xiao2016-11-271-2/+7
|
* Update import paths from github.com/go-gitea to code.gitea.io (#135)Sandro Santilli2016-11-101-4/+4
| | | | | | | - Update import paths from github.com/go-gitea to code.gitea.io - Fix import path for travis See https://docs.travis-ci.com/user/languages/go#Go-Import-Path
* Change import reference to match gitea instead of gogs (#37)Rémy Boulanouar2016-11-031-4/+4
|
* Fixes #3110 (#3136)Franz Schmidt2016-06-271-1/+1
|
* Replace uuid module with original packageUnknwon2016-02-201-2/+2
|
* typo fixzhuharev2016-01-061-2/+2
|
* work on #470 and fix miror JS issue when choose targets on compare and pullUnknwon2015-10-291-4/+10
|
* fix import path, fix #1782Unknwon2015-10-151-3/+3
|
* support URL param to token, but still restrict to APIsUnknwon2015-09-021-21/+23
|
* #842 able to use access token replace basic authUnknwon2015-09-021-22/+28
|
* #1487 Readme TemplateUnknwon2015-08-281-0/+6
|
* token recent activityUnknwon2015-08-191-2/+7
|
* work on #1493Unknwon2015-08-171-1/+1
|
* WIP: create PR - choose branchUnknwon2015-08-081-2/+2
|
* allow anonymous SSH cloneUnknwon2015-08-051-3/+3
|
* UI: basic label listUnknwon2015-07-241-1/+7
| | | | - create new label
* #1128: API calls are not hidden behind sign inUnknwon2015-07-151-1/+5
|
* UI: install - new versionUnknwon2015-07-081-1/+8
|
* Attempt #3 of ldap fixesGogs2015-02-271-5/+4
|
* cmd: CMD option for port number of `gogs web` to prevent first time run conflictUnknwon2015-02-011-0/+7
| | | | | - routers: use new binding convention to simplify code - templates: able to set HTTP port number in install page
* fix binding api brokenUnknwon2014-12-151-7/+7
|
* Fix spelling errors in comments.Joseph Crail2014-12-061-1/+1
|
* work on #672Unknwon2014-12-051-1/+2
|
* fix #165Unknwon2014-12-051-1/+19
|
* more APIs on #12Unknwon2014-11-181-9/+9
|
* #12, API: list user repos, list repo hooksUnknwon2014-11-131-15/+15
|
* add personal access token panel #12Unknwon2014-11-121-5/+23
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-24 09:56:05 +0000