aboutsummaryrefslogtreecommitdiffstats
path: root/modules/setting
Commit message (Collapse)AuthorAgeFilesLines
* Fix incorrect PostgreSQL connection string for Unix sockets (#28865)sdvcrx2024-01-202-2/+10
| | | Fix #28864
* Retarget depending pulls when the parent branch is deleted (#28686)Viktor Kuzmin2024-01-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes you need to work on a feature which depends on another (unmerged) feature. In this case, you may create a PR based on that feature instead of the main branch. Currently, such PRs will be closed without the possibility to reopen in case the parent feature is merged and its branch is deleted. Automatic target branch change make life a lot easier in such cases. Github and Bitbucket behave in such way. Example: $PR_1$: main <- feature1 $PR_2$: feature1 <- feature2 Currently, merging $PR_1$ and deleting its branch leads to $PR_2$ being closed without the possibility to reopen. This is both annoying and loses the review history when you open a new PR. With this change, $PR_2$ will change its target branch to main ($PR_2$: main <- feature2) after $PR_1$ has been merged and its branch has been deleted. This behavior is enabled by default but can be disabled. For security reasons, this target branch change will not be executed when merging PRs targeting another repo. Fixes #27062 Fixes #18408 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: delvh <dev.lh@web.de>
* Warn that `DISABLE_QUERY_AUTH_TOKEN` is false only if it's explicitly ↵Yarden Shoham2024-01-141-1/+4
| | | | | | | | | | defined (#28783) So we don't warn on default behavior - Fixes https://github.com/go-gitea/gitea/issues/28758 - Follows https://github.com/go-gitea/gitea/pull/28390 Signed-off-by: Yarden Shoham <git@yardenshoham.com>
* Recommend/convert to use case-sensitive collation for MySQL/MSSQL (#28662)wxiaoguang2024-01-101-3/+4
| | | | | | | | | | | | | | | | | | Mainly for MySQL/MSSQL. It is important for Gitea to use case-sensitive database charset collation. If the database is using a case-insensitive collation, Gitea will show startup error/warning messages, and show the errors/warnings on the admin panel's Self-Check page. Make `gitea doctor convert` work for MySQL to convert the collations of database & tables & columns. * Fix #28131 ## :warning: BREAKING :warning: It is not quite breaking, but it's highly recommended to convert the database&table&column to a consistent and case-sensitive collation.
* Fix panic when parsing empty pgsql host (#28708)wxiaoguang2024-01-062-1/+5
| | | | Regression of #27723 Fix #28705
* Normalize oauth email username (#28561)Kyle D2024-01-031-1/+1
|
* Add global setting how timestamps should be rendered (#28657)Yarden Shoham2024-01-021-40/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Resolves https://github.com/go-gitea/gitea/issues/22493 - Related to https://github.com/go-gitea/gitea/issues/4520 Some admins prefer all timestamps to display the full date instead of relative time. They can do that now by setting ```ini [ui] PREFERRED_TIMESTAMP_TENSE = absolute ``` This setting is set to `mixed` by default, allowing dates to render as "5 hours ago". Here are some screenshots of the UI with this setting set to `absolute`: ![image](https://github.com/go-gitea/gitea/assets/20454870/f496457f-6afa-44be-a1e7-249ee5fe0706) ![image](https://github.com/go-gitea/gitea/assets/20454870/c03b14f5-063d-4e13-9780-76ab002d76a9) ![image](https://github.com/go-gitea/gitea/assets/20454870/f4b34e28-1546-4374-9199-c43348844edd) --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: delvh <dev.lh@web.de>
* Avoid cycle-redirecting user/login page (#28636)wxiaoguang2023-12-301-2/+1
| | | | Fix #28231, and remove some unused code. The `db.HasEngine` doesn't seem useful because the db engine is always initialized before web route.
* Refactor CORS handler (#28587)wxiaoguang2023-12-251-3/+1
| | | | | | | | | | | The CORS code has been unmaintained for long time, and the behavior is not correct. This PR tries to improve it. The key point is written as comment in code. And add more tests. Fix #28515 Fix #27642 Fix #17098
* Make offline mode as default to no connect external avatar service by ↵Lunny Xiao2023-12-211-1/+1
| | | | | | | default (#28548) To keep user's privacy, make offline mode as true by default. Users can still change it from installation ui and app.ini
* Always enable caches (#28527)Lunny Xiao2023-12-191-23/+0
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Add option to disable ambiguous unicode characters detection (#28454)wxiaoguang2023-12-171-0/+5
| | | | | | | | * Close #24483 * Close #28123 * Close #23682 * Close #23149 (maybe more)
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-121-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
* Use `filepath` instead of `path` to create SQLite3 database file (#28374)wxiaoguang2023-12-061-2/+1
|
* Fix incorrect default value of `[attachment].MAX_SIZE` (#28373)capvor2023-12-061-1/+1
|
* add skip ci functionality (#28075)Denys Konovalov2023-11-181-2/+4
| | | | | | | | | | | | Adds the possibility to skip workflow execution if the commit message contains a string like [skip ci] or similar. The default strings are the same as on GitHub, users can also set custom ones in app.ini Reference: https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs Close #28020
* Change default size of attachments and repo files (#28100)Nanguan Lin2023-11-172-2/+2
| | | | https://github.com/go-gitea/gitea/pull/27946 forgets to change them in code. Sorry about that.
* Fix incorrect pgsql conn builder behavior (#28085)wxiaoguang2023-11-172-9/+11
| | | Fix #28083 and fix the tests
* Allow to set explore page default sort (#27951)65432023-11-091-0/+1
| | | | | | | as title --- *Sponsored by Kithara Software GmbH*
* refactor postgres connection string building (#27723)Moritz Poldrack2023-11-012-29/+44
| | | | | | | | This patchset changes the connection string builder to use net.URL and the host/port parser to use the stdlib function for splitting host from port. It also adds a footnote about a potentially required portnumber for postgres UNIX sockets. Fixes: #24552
* Support storage base path as prefix (#27827)Lunny Xiao2023-11-012-3/+67
| | | | | | This PR adds a prefix path for all minio storage and override base path will override the path. The previous behavior is undefined officially, so it will be marked as breaking.
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-141-2/+0
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Increase queue length (#27555)Jason Song2023-10-101-1/+1
|
* Fix `environment-to-ini` inherited key bug (#27543)wxiaoguang2023-10-102-1/+28
| | | | | | | Fix #27541 The INI package has a quirk: by default, the keys are inherited. When maintaining the keys, the newly added sub key should not be affected by the parent key.
* Pre-register OAuth application for tea (#27509)M Hickford2023-10-081-1/+1
| | | | | | It remains to implement OAuth login in tea https://gitea.com/gitea/tea/issues/598 Fixes #27510
* Rename the default themes to gitea-light, gitea-dark, gitea-auto (#27419)silverwind2023-10-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Part of https://github.com/go-gitea/gitea/issues/27097: - `gitea` theme is renamed to `gitea-light` - `arc-green` theme is renamed to `gitea-dark` - `auto` theme is renamed to `gitea-auto` I put both themes in separate CSS files, removing all colors from the base CSS. Existing users will be migrated to the new theme names. The dark theme recolor will follow in a separate PR. ## :warning: BREAKING :warning: 1. If there are existing custom themes with the names `gitea-light` or `gitea-dark`, rename them before this upgrade and update the `theme` column in the `user` table for each affected user. 2. The theme in `<html>` has moved from `class="theme-name"` to `data-theme="name"`, existing customizations that depend on should be updated. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Remove redundant `len` check around loop (#27464)Eng Zer Jun2023-10-061-5/+3
| | | | | | | | | | | | | | | | | | | | This pull request is a minor code cleanup. From the Go specification (https://go.dev/ref/spec#For_range): > "1. For a nil slice, the number of iterations is 0." > "3. If the map is nil, the number of iterations is 0." `len` returns 0 if the slice or map is nil (https://pkg.go.dev/builtin#len). Therefore, checking `len(v) > 0` before a loop is unnecessary. --- At the time of writing this pull request, there wasn't a lint rule that catches these issues. The closest I could find is https://staticcheck.dev/docs/checks/#S103 Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Refactor system setting (#27000)wxiaoguang2023-10-053-0/+185
| | | | | | | | | This PR reduces the complexity of the system setting system. It only needs one line to introduce a new option, and the option can be used anywhere out-of-box. It is still high-performant (and more performant) because the config values are cached in the config system.
* Make Actions tasks/jobs timeouts configurable by the user (#27400)Francesco Antognazza2023-10-021-0/+8
| | | | | | | | | | | | | | | | | | | With this PR we added the possibility to configure the Actions timeouts values for killing tasks/jobs. Particularly this enhancement is closely related to the `act_runner` configuration reported below: ``` # The timeout for a job to be finished. # Please note that the Gitea instance also has a timeout (3h by default) for the job. # So the job could be stopped by the Gitea instance if it's timeout is shorter than this. timeout: 3h ``` --- Setting the corresponding key in the INI configuration file, it is possible to let jobs run for more than 3 hours. Signed-off-by: Francesco Antognazza <francesco.antognazza@gmail.com>
* Remove some dead code (#27196)wxiaoguang2023-09-221-2/+0
| | | Some code is not in use any more, remove them.
* Actions are no longer experimental, so enable them by default (#27054)Lunny Xiao2023-09-151-1/+1
| | | | This PR makes the actions enabled by default, so people will find it easier to enable actions in repository setting.
* Use secure cookie for HTTPS sites (#26999)wxiaoguang2023-09-111-1/+1
| | | | | | | | | | | If the AppURL(ROOT_URL) is an HTTPS URL, then the COOKIE_SECURE's default value should be true. And, if a user visits an "http" site with "https" AppURL, they won't be able to login, and they should have been warned. The only problem is that the "language" can't be set either in such case, while I think it is not a serious problem, and it could be fixed easily if needed. ![image](https://github.com/go-gitea/gitea/assets/2114189/7bc9a859-dcc1-467d-bc7c-1dd6a10389e3)
* Fix INI parsing for value with trailing slash (#26995)wxiaoguang2023-09-102-2/+20
| | | Fix #26977 (a temp fix)
* Add reverseproxy auth for API back with default disabled (#26703)Lunny Xiao2023-09-071-0/+2
| | | | | | | | | | | | | | | This feature was removed by #22219 to avoid possible CSRF attack. This PR takes reverseproxy auth for API back but with default disabled. To prevent possbile CSRF attack, the responsibility will be the reverseproxy but not Gitea itself. For those want to enable this `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`, they should know what they are doing. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Artifacts retention and auto clean up (#26131)FuXiaoHei2023-09-061-4/+10
| | | | | | | | | | | | | | Currently, Artifact does not have an expiration and automatic cleanup mechanism, and this feature needs to be added. It contains the following key points: - [x] add global artifact retention days option in config file. Default value is 90 days. - [x] add cron task to clean up expired artifacts. It should run once a day. - [x] support custom retention period from `retention-days: 5` in `upload-artifact@v3`. - [x] artifacts link in actions view should be non-clickable text when expired.
* Fix some slice append usages (#26778)Chongyi Zheng2023-08-291-1/+1
| | | Co-authored-by: delvh <dev.lh@web.de>
* Expanded minimum RSA Keylength to 3072 (#26604)mainboarder2023-08-281-1/+1
| | | | | | | | | | | | | | | German Federal Office for Information Security requests in its technical guideline BSI TR-02102-1 RSA Keylength not shorter than 3000bits starting 2024, in the year 2023 3000bits as a recommendation. Gitea should request longer RSA Keys by default in favor of security and drop old clients which do not support longer keys. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102.pdf?__blob=publicationFile&v=9 - Page 19, Table 1.2 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Update minimum password length requirements (#25946)techknowlogick2023-08-211-1/+1
|
* Handle base64 decoding correctly to avoid panic (#26483)wxiaoguang2023-08-142-14/+11
| | | Fix the panic if the "base64 secret" is too long.
* Fix storage path logic especially for relative paths (#26441)Lunny Xiao2023-08-132-93/+294
| | | | | | | | | This PR rewrites the function `getStorage` and make it more clear. Include tests from #26435, thanks @earl-warren --------- Co-authored-by: Earl Warren <contact@earl-warren.org>
* Remove last newline from config file (#26468)wxiaoguang2023-08-122-0/+21
| | | | | | | | | When users put the secrets into a file (GITEA__sec__KEY__FILE), the newline sometimes is different to avoid (eg: echo/vim/...) So the last newline could be removed when reading, it makes the users easier to maintain the secret files. Co-authored-by: Giteabot <teabot@gitea.io>
* Pre-register OAuth2 applications for git credential helpers (#26291)Denys Konovalov2023-08-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This PR is an extended implementation of #25189 and builds upon the proposal by @hickford in #25653, utilizing some ideas proposed internally by @wxiaoguang. Mainly, this PR consists of a mechanism to pre-register OAuth2 applications on startup, which can be enabled or disabled by modifying the `[oauth2].DEFAULT_APPLICATIONS` parameter in app.ini. The OAuth2 applications registered this way are being marked as "locked" and neither be deleted nor edited over UI to prevent confusing/unexpected behavior. Instead, they're being removed if no longer enabled in config. ![grafik](https://github.com/go-gitea/gitea/assets/47871822/81a78b1c-4b68-40a7-9e99-c272ebb8f62e) The implemented mechanism can also be used to pre-register other OAuth2 applications in the future, if wanted. Co-authored-by: hickford <mirth.hickford@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> --------- Co-authored-by: M Hickford <mirth.hickford@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix the wrong derive path (#26271)Lunny Xiao2023-08-042-17/+215
| | | | | | | | | | | | | This PR will fix #26264, caused by #23911. The package configuration derive is totally wrong when storage type is local in that PR. This PR fixed the inherit logic when storage type is local with some unit tests. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Clarify the logger's MODE config option (#26267)wxiaoguang2023-08-011-1/+1
| | | | | | | 1. Fix the wrong document (add the missing `MODE=`) 2. Add a more friendly log message to tell users to add `MODE=` in their config Co-authored-by: Giteabot <teabot@gitea.io>
* Add 'Show on a map' button to Location in profile, fix layout (#26214)Panagiotis "Ivory" Vasilopoulos2023-07-311-0/+2
| | | | | | | | | | | Not too important, but I think that it'd be a pretty neat touch. Also fixes some layout bugs introduced by a previous PR. --------- Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: Caesar Schinas <caesar@caesarschinas.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix allowed user types setting problem (#26200)Lunny Xiao2023-07-282-6/+110
| | | Fix #25951
* Calculate MAX_WORKERS default value by CPU number (#26177)wxiaoguang2023-07-271-11/+18
| | | | | | To avoid consuming user's 100% CPU, limit the default value of MAX_WORKERS Fix #26063 (the CPU 100% problem mentioned in it)
* Display deprecated warning in admin panel pages as well as in the log file ↵Lunny Xiao2023-07-263-8/+38
| | | | | | | | | | | | | | | (#26094) This PR includes #26007 's changes but have a UI to prompt administrator about the deprecated settings as well as the log or console warning. Then users will have enough time to notice the problem and don't have surprise like before. <img width="1293" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/c33355f0-1ea7-4fb3-ad43-cd23cd15391d"> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix loading `LFS_JWT_SECRET` from wrong section (#26109)Jason Song2023-07-251-1/+1
| | | | | | | | | | | Regression of #25408. `LFS_JWT_SECRET_URI` and `LFS_JWT_SECRET` are under the `server` section, not `lfs`. So each time gitea restarts, it resets `LFS_JWT_SECRET`. <img width="1378" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/527ec9b9-eea2-4334-a274-6d1471456edd">
* Avoid writing config file if not installed (#26107)wxiaoguang2023-07-251-1/+1
| | | | Just like others (oauth2 secret, internal token, etc), do not generate if no install lock
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-05 15:53:10 +0000