summaryrefslogtreecommitdiffstats
path: root/modules
Commit message (Collapse)AuthorAgeFilesLines
* Add elapsed time on debug for slow git commands (#25642)Lunny Xiao2023-07-041-1/+9
| | | | | | | | | To record which command is slow, this PR adds a debug log for slow git operations. --------- Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: delvh <dev.lh@web.de>
* Add unit test for `HashAvatar` (#25662)Earl Warren2023-07-041-0/+26
| | | | | | | - Add 100% unit test for this function. --------- Co-authored-by: Gusted <postmaster@gusted.xyz>
* Fix issues indexer document mapping (#25619)Jason Song2023-07-041-20/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix regression of #5363 (so long ago). The old code definded a document mapping for `issueIndexerDocType`, and assigned it to `BleveIndexerData` as its type. (`BleveIndexerData` has been renamed to `IndexerData` in #25174, but nothing more.) But the old code never used `BleveIndexerData`, it wrote the index with an anonymous struct type. Nonetheless, bleve would use the default auto-mapping for struct it didn't know, so the indexer still worked. This means the custom document mapping was always dead code. The custom document mapping is not useless, it can reduce index storage, this PR brings it back and disable default mapping to prevent it from happening again. Since `IndexerData`(`BleveIndexerData`) has JSON tags, and bleve uses them first, so we should use `repo_id` as the field name instead of `RepoID`. I did a test to compare the storage size before and after this, with about 3k real comments that were migrated from some public repos. Before: ```text [ 160] . ├── [ 42] index_meta.json ├── [ 13] rupture_meta.json └── [ 128] store ├── [6.9M] 00000000005d.zap └── [256K] root.bolt ``` After: ```text [ 160] . ├── [ 42] index_meta.json ├── [ 13] rupture_meta.json └── [ 128] store ├── [3.5M] 000000000065.zap └── [256K] root.bolt ``` It saves about half the storage space. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Add direct serving of package content (#25543)KN4CK3R2023-07-031-0/+10
| | | | | | | Fixes #24723 Direct serving of content aka HTTP redirect is not mentioned in any of the package registry specs but lots of official registries do that so it should be supported by the usual clients.
* Set SSH_AUTHORIZED_KEYS_BACKUP to false (#25412)techknowlogick2023-07-011-1/+1
| | | | | | | | | | | This prevents the disk from overflowing with auth keys file Fixes #17117 ## ⚠️ BREAKING This changes the default option for creating a backup of the authorized key file when an update is made to default to false.
* Fix branch commit message too long problem (#25588)Lunny Xiao2023-06-301-4/+4
| | | | | | When branch's commit CommitMessage is too long, the column maybe too short.(TEXT 16K for mysql). This PR will fix it to only store the summary because these message will only show on branch list or possible future search?
* Restrict `[actions].DEFAULT_ACTIONS_URL` to only `github` or `self` (#25581)Jason Song2023-06-302-2/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolve #24789 ## :warning: BREAKING :warning: Before this, `DEFAULT_ACTIONS_URL` cound be set to any custom URLs like `https://gitea.com` or `http://your-git-server,https://gitea.com`, and the default value was `https://gitea.com`. But now, `DEFAULT_ACTIONS_URL` supports only `github`(`https://github.com`) or `self`(the root url of current Gitea instance), and the default value is `github`. If it has configured with a URL, an error log will be displayed and it will fallback to `github`. Actually, what we really want to do is always make it `https://github.com`, however, this may not be acceptable for some instances of internal use, so there's extra support for `self`, but no more, even `https://gitea.com`. Please note that `uses: https://xxx/yyy/zzz` always works and it does exactly what it is supposed to do. Although it's breaking, I belive it should be backported to `v1.20` due to some security issues. Follow-up on the runner side: - https://gitea.com/gitea/act_runner/pulls/262 - https://gitea.com/gitea/act/pulls/70
* Add API for changing Avatars (#25369)JakobDev2023-06-292-0/+12
| | | | | | | | | | | | This adds an API for uploading and Deleting Avatars for of Users, Repos and Organisations. I'm not sure, if this should also be added to the Admin API. Resolves #25344 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Update emoji set to Unicode 15 (#25595)isla w2023-06-291-3/+39
| | | | | | | | | | | Update emoji set to Unicode 15 which was added upstream here: https://github.com/github/gemoji/commit/cb5c514d472daf9b312c963987f4d7ee865c28fe <img width="854" alt="Screenshot 2023-06-29 at 11 02 56 AM" src="https://github.com/go-gitea/gitea/assets/1669571/7bfb663d-0804-4d23-a62d-f585a6783ca6"> --------- Co-authored-by: silverwind <me@silverwind.io>
* Sync branches into databases (#22743)Lunny Xiao2023-06-294-6/+176
| | | | | | | | | | | | | | | | | | | | | | | | | | Related #14180 Related #25233 Related #22639 Close #19786 Related #12763 This PR will change all the branches retrieve method from reading git data to read database to reduce git read operations. - [x] Sync git branches information into database when push git data - [x] Create a new table `Branch`, merge some columns of `DeletedBranch` into `Branch` table and drop the table `DeletedBranch`. - [x] Read `Branch` table when visit `code` -> `branch` page - [x] Read `Branch` table when list branch names in `code` page dropdown - [x] Read `Branch` table when list git ref compare page - [x] Provide a button in admin page to manually sync all branches. - [x] Sync branches if repository is not empty but database branches are empty when visiting pages with branches list - [x] Use `commit_time desc` as the default FindBranch order by to keep consistent as before and deleted branches will be always at the end. --------- Co-authored-by: Jason Song <i@wolfogre.com>
* Support downloading raw task logs (#24451)Vitaliy Filippov2023-06-291-2/+2
| | | | | | | | Hi! This pull request adds support for downloading raw task logs for Gitea Actions, similar to Github Actions It looks like the following: ![image](https://user-images.githubusercontent.com/945339/235376746-405d5019-710b-468b-8113-9e82eab8e752.png)
* Split lfs size from repository size (#22900)a10121127962023-06-281-1/+1
| | | | | | | | | | | | | | | | | | | | releated to #21820 - Split `Size` in repository table as two new colunms, one is `GitSize` for git size, the other is `LFSSize` for lfs data. still store full size in `Size` colunm. - Show full size on ui, but show each of them by a `title`; example: ![image](https://user-images.githubusercontent.com/25342410/218636251-e200f085-d7e7-4a25-9ff1-b586a63e07a9.png) - Return full size in api response. --------- Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: DmitryFrolovTri <23313323+DmitryFrolovTri@users.noreply.github.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Do not prepare oauth2 config if it is not enabled, do not write config in ↵wxiaoguang2023-06-281-0/+4
| | | | | | | | | | some sub-commands (#25567) Ref: * https://github.com/go-gitea/gitea/issues/25377#issuecomment-1609757289 And some sub-commands like "generate" / "docs", they do not need to use the ini config
* Fix content holes in Actions task logs file (#25560)Jason Song2023-06-281-1/+17
| | | | | | | | | | | | | | | | | | | Fix #25451. Bugfixes: - When stopping the zombie or endless tasks, set `LogInStorage` to true after transferring the file to storage. It was missing, it could write to a nonexistent file in DBFS because `LogInStorage` was false. - Always update `ActionTask.Updated` when there's a new state reported by the runner, even if there's no change. This is to avoid the task being judged as a zombie task. Enhancement: - Support `Stat()` for DBFS file. - `WriteLogs` refuses to write if it could result in content holes. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Fix sub-command log level (#25537)wxiaoguang2023-06-284-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | More fix for #24981 * #24981 Close #22361 * #22361 There were many patches for Gitea's sub-commands to satisfy the facts: * Some sub-commands shouldn't output any log, otherwise the git protocol would be broken * Sometimes the users want to see "verbose" or "quiet" outputs That's a longstanding problem, and very fragile. This PR is only a quick patch for the problem. In the future, the sub-command system should be refactored to a clear solution. ---- Other changes: * Use `ReplaceAllWriters` to replace `RemoveAllWriters().AddWriters(writer)`, then it's an atomic operation. * Remove unnecessary `syncLevelInternal` calls, because `AddWriters/addWritersInternal` already calls it. Co-authored-by: Giteabot <teabot@gitea.io>
* Add Adopt repository event and handler (#25497)Lunny Xiao2023-06-264-0/+16
| | | | | | | Fix #14304 --------- Co-authored-by: delvh <dev.lh@web.de>
* Support `pull_request_target` event (#25229)Zettat1232023-06-264-46/+60
| | | | | | | | | | | Fix #25088 This PR adds the support for [`pull_request_target`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target) workflow trigger. `pull_request_target` is similar to `pull_request`, but the workflow triggered by the `pull_request_target` event runs in the context of the base branch of the pull request rather than the head branch. Since the workflow from the base is considered trusted, it can access the secrets and doesn't need approvals to run.
* Use InitWorkPathAndCfgProvider for environment-to-ini to avoid unnecessary ↵wxiaoguang2023-06-241-2/+6
| | | | | | | | | | | | | | | checks (#25480) Fix #25481 The `InitWorkPathAndCommonConfig` calls `LoadCommonSettings` which does many checks like "current user is root or not". Some commands like "environment-to-ini" shouldn't do such check, because it might be run with "root" user at the moment (eg: the docker's setup script) ps: in the future, the docker's setup script should be improved to avoid Gitea's command running with "root"
* Fix `Init` of db indexer (#25470)Jason Song2023-06-231-2/+3
| | | | | | | | Fix regression of #25174. The `Init` of the db indexer should return true to indicate that the index was opened/existed, or the indexer will try to populate the index (not really populate, just fill the queue, `Index` method of the db indexer is a dummy).
* Refactor indexer (#25174)Jason Song2023-06-2337-1412/+1360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactor `modules/indexer` to make it more maintainable. And it can be easier to support more features. I'm trying to solve some of issue searching, this is a precursor to making functional changes. Current supported engines and the index versions: | engines | issues | code | | - | - | - | | db | Just a wrapper for database queries, doesn't need version | - | | bleve | The version of index is **2** | The version of index is **6** | | elasticsearch | The old index has no version, will be treated as version **0** in this PR | The version of index is **1** | | meilisearch | The old index has no version, will be treated as version **0** in this PR | - | ## Changes ### Split Splited it into mutiple packages ```text indexer ├── internal │   ├── bleve │   ├── db │   ├── elasticsearch │   └── meilisearch ├── code │   ├── bleve │   ├── elasticsearch │   └── internal └── issues ├── bleve ├── db ├── elasticsearch ├── internal └── meilisearch ``` - `indexer/interanal`: Internal shared package for indexer. - `indexer/interanal/[engine]`: Internal shared package for each engine (bleve/db/elasticsearch/meilisearch). - `indexer/code`: Implementations for code indexer. - `indexer/code/internal`: Internal shared package for code indexer. - `indexer/code/[engine]`: Implementation via each engine for code indexer. - `indexer/issues`: Implementations for issues indexer. ### Deduplication - Combine `Init/Ping/Close` for code indexer and issues indexer. - ~Combine `issues.indexerHolder` and `code.wrappedIndexer` to `internal.IndexHolder`.~ Remove it, use dummy indexer instead when the indexer is not ready. - Duplicate two copies of creating ES clients. - Duplicate two copies of `indexerID()`. ### Enhancement - [x] Support index version for elasticsearch issues indexer, the old index without version will be treated as version 0. - [x] Fix spell of `elastic_search/ElasticSearch`, it should be `Elasticsearch`. - [x] Improve versioning of ES index. We don't need `Aliases`: - Gitea does't need aliases for "Zero Downtime" because it never delete old indexes. - The old code of issues indexer uses the orignal name to create issue index, so it's tricky to convert it to an alias. - [x] Support index version for meilisearch issues indexer, the old index without version will be treated as version 0. - [x] Do "ping" only when `Ping` has been called, don't ping periodically and cache the status. - [x] Support the context parameter whenever possible. - [x] Fix outdated example config. - [x] Give up the requeue logic of issues indexer: When indexing fails, call Ping to check if it was caused by the engine being unavailable, and only requeue the task if the engine is unavailable. - It is fragile and tricky, could cause data losing (It did happen when I was doing some tests for this PR). And it works for ES only. - Just always requeue the failed task, if it caused by bad data, it's a bug of Gitea which should be fixed. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Store and use seconds for timeline time comments (#25392)65432023-06-231-1/+3
| | | | | | | | | | | this will allow us to fully localize it later PS: we can not migrate back as the old value was a one-way conversion prepare for #25213 --- *Sponsored by Kithara Software GmbH*
* Import additional secrets via file uri (#25408)techknowlogick2023-06-233-1/+5
|
* Update octicons and use `octicon-file-directory-symlink` (#25453)silverwind2023-06-221-1/+1
| | | | | | | | Make use of the [new octicon](https://github.com/primer/octicons/issues/945) that indicates a symlink to a directory: <img width="189" alt="Screenshot 2023-06-22 at 22 50 57" src="https://github.com/go-gitea/gitea/assets/115237/a70690ea-ebfc-48fe-af23-cdc33bcb2098">
* Fix `Permission` in API returned repository struct (#25388)Jason Song2023-06-221-3/+3
| | | | | | | | | | | | | | | | | | | | | | | The old code generates `structs.Repository.Permissions` with only `access.Permission.AccessMode`, however, it should check the units too, or the value could be incorrect. For example, `structs.Repository.Permissions.Push` could be false even the doer has write access to code unit. Should fix https://github.com/renovatebot/renovate/issues/14059#issuecomment-1047961128 (Not reported by it, I just found it when I was looking into this bug) --- Review tips: The major changes are - `modules/structs/repo.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-870406f6857117f8b03611c43fca0ab9ed6d6e76a2d0069a7c1f17e8fa9092f7 - `services/convert/repository.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-7736f6d2ae894c9edb7729a80ab89aa183b888a26a811a0c1fdebd18726a7101 And other changes are passive.
* Move some regexp out of functions (#25430)John Olheiser2023-06-212-5/+6
| | | | | | | | | | /cc @KN4CK3R https://github.com/go-gitea/gitea/pull/25294#discussion_r1237425343 I also searched the codebase and found a few more. --------- Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Remove "CHARSET" config option for MySQL, always use "utf8mb4" (#25413)wxiaoguang2023-06-211-19/+9
| | | | | | | | | | | | | In modern days, there is no reason to make users set "charset" anymore. Close #25378 ## :warning: BREAKING The key `[database].CHARSET` was removed completely as every newer (>10years) MySQL database supports `utf8mb4` already. There is a (deliberately) undocumented new fallback option if anyone still needs to use it, but we don't recommend using it as it simply causes problems.
* Fix missing commit message body when the message has leading newlines (#25418)Jason Song2023-06-212-3/+59
| | | | | | | Commit with `echo "\nmessage after a blank line\nsecond line of the message" | git commit --cleanup=verbatim -F -` and push. <img width="1139" alt="image" src="https://github.com/go-gitea/gitea/assets/9418365/f9a2c28c-e307-4c78-9e31-3d3ace7b9274">
* Refactor path & config system (#25330)wxiaoguang2023-06-2112-178/+407
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # The problem There were many "path tricks": * By default, Gitea uses its program directory as its work path * Gitea tries to use the "work path" to guess its "custom path" and "custom conf (app.ini)" * Users might want to use other directories as work path * The non-default work path should be passed to Gitea by GITEA_WORK_DIR or "--work-path" * But some Gitea processes are started without these values * The "serv" process started by OpenSSH server * The CLI sub-commands started by site admin * The paths are guessed by SetCustomPathAndConf again and again * The default values of "work path / custom path / custom conf" can be changed when compiling # The solution * Use `InitWorkPathAndCommonConfig` to handle these path tricks, and use test code to cover its behaviors. * When Gitea's web server runs, write the WORK_PATH to "app.ini", this value must be the most correct one, because if this value is not right, users would find that the web UI doesn't work and then they should be able to fix it. * Then all other sub-commands can use the WORK_PATH in app.ini to initialize their paths. * By the way, when Gitea starts for git protocol, it shouldn't output any log, otherwise the git protocol gets broken and client blocks forever. The "work path" priority is: WORK_PATH in app.ini > cmd arg --work-path > env var GITEA_WORK_DIR > builtin default The "app.ini" searching order is: cmd arg --config > cmd arg "work path / custom path" > env var "work path / custom path" > builtin default ## ⚠️ BREAKING If your instance's "work path / custom path / custom conf" doesn't meet the requirements (eg: work path must be absolute), Gitea will report a fatal error and exit. You need to set these values according to the error log. ---- Close #24818 Close #24222 Close #21606 Close #21498 Close #25107 Close #24981 Maybe close #24503 Replace #23301 Replace #22754 And maybe more
* Avoid polluting config file when "save" (#25395)wxiaoguang2023-06-216-13/+85
| | | | | | | | | | | | | That's a longstanding INI package problem: the "MustXxx" calls change the option values, and the following "Save" will save a lot of garbage options into the user's config file. Ideally we should refactor the INI package to a clear solution, but it's a huge work. A clear workaround is what this PR does: when "Save", load a clear INI instance and save it. Partially fix #25377, the "install" page needs more fine tunes.
* Substitute variables in path names of template repos too (#25294)Kyle D2023-06-202-2/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | ### Summary Extend the template variable substitution to replace file paths. This can be helpful for setting up log files & directories that should match the repository name. ### PR Changes - Move files matching glob pattern when setting up repos from template - For security, added ~escaping~ sanitization for cross-platform support and to prevent directory traversal (thanks @silverwind for the reference) - Added unit testing for escaping function - Fixed the integration tests for repo template generation by passing the repo_template_id - Updated the integration testfiles to add some variable substitution & assert the outputs I had to fix the existing repo template integration test and extend it to add a check for variable substitutions. Example: ![image](https://github.com/go-gitea/gitea/assets/12700993/621feb09-0ef3-460e-afa8-da74cd84fa4e)
* Batch delete issue and improve tippy opts (#25253)wxiaoguang2023-06-191-0/+4
| | | | | 1. Add "batch delete" button for selected issues, close #22273 2. Address the review in https://github.com/go-gitea/gitea/pull/25219#discussion_r1229266083
* Avoid polluting the config (#25345)wxiaoguang2023-06-183-14/+16
| | | | | Caught by #25330 Co-authored-by: Giteabot <teabot@gitea.io>
* Refactor web package and context package (#25298)wxiaoguang2023-06-1811-63/+102
| | | | | | | | | | | | | 1. The "web" package shouldn't depends on "modules/context" package, instead, let each "web context" register themselves to the "web" package. 2. The old Init/Free doesn't make sense, so simplify it * The ctx in "Init(ctx)" is never used, and shouldn't be used that way * The "Free" is never called and shouldn't be called because the SSPI instance is shared --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Use fetch to send requests to create issues/comments (#25258)wxiaoguang2023-06-165-9/+89
| | | | | | | | | | | | | | | | Follow #23290 Network error won't make content lost. And this is a much better approach than "loading-button". The UI is not perfect and there are still some TODOs, they can be done in following PRs, not a must in this PR's scope. <details> ![image](https://github.com/go-gitea/gitea/assets/2114189/c94ba958-aa46-4747-8ddf-6584deeed25c) </details>
* Fix index generation parallelly failure (#25235)Lunny Xiao2023-06-151-0/+8
| | | | | | | Fix #22109 --------- Co-authored-by: silverwind <me@silverwind.io>
* Change form actions to fetch for submit review box (#25219)HesterG2023-06-141-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Co-author: @wxiaoguang Close #25096 The way to fix it in this PR is to change form submit to fetch using formData, and add flags to avoid post repeatedly. Should be able to apply to more forms that have the same issue after this PR. In the demo below, 'approve' is clicked several times, and then 'comment' is clicked several time after 'request changes' clicked. After: https://github.com/go-gitea/gitea/assets/17645053/beabeb1d-fe66-4b76-b048-4f022b4e83a0 Update: screenshots from /devtest > ![image](https://user-images.githubusercontent.com/2114189/245680011-ee4231e0-a53d-4c2a-a9c2-71ccd98005cc.png) > > ![image](https://user-images.githubusercontent.com/2114189/245680057-9215d348-63d8-406d-8828-17e171163aaa.png) > > ![image](https://user-images.githubusercontent.com/2114189/245680148-89d7b3d1-d7b6-442f-b69e-eadaee112482.png) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix all possible setting error related storages and added some tests (#23911)Lunny Xiao2023-06-1423-412/+984
| | | | | | | | | | | | | | | | | | | | | | | | | | | Follow up #22405 Fix #20703 This PR rewrites storage configuration read sequences with some breaks and tests. It becomes more strict than before and also fixed some inherit problems. - Move storage's MinioConfig struct into setting, so after the configuration loading, the values will be stored into the struct but not still on some section. - All storages configurations should be stored on one section, configuration items cannot be overrided by multiple sections. The prioioty of configuration is `[attachment]` > `[storage.attachments]` | `[storage.customized]` > `[storage]` > `default` - For extra override configuration items, currently are `SERVE_DIRECT`, `MINIO_BASE_PATH`, `MINIO_BUCKET`, which could be configured in another section. The prioioty of the override configuration is `[attachment]` > `[storage.attachments]` > `default`. - Add more tests for storages configurations. - Update the storage documentations. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use inline SVG for built-in OAuth providers (#25171)silverwind2023-06-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The plan is that all built-in auth providers use inline SVG for more flexibility in styling and to get the GitHub icon to follow `currentcolor`. This only removes the `public/img/auth` directory and adds the missing svgs to our svg build. It should map the built-in providers to these SVGs and render them. If the user has set a Icon URL, it should render that as an `img` tag instead. ``` gitea-azure-ad gitea-bitbucket gitea-discord gitea-dropbox gitea-facebook gitea-gitea gitea-gitlab gitea-google gitea-mastodon gitea-microsoftonline gitea-nextcloud gitea-twitter gitea-yandex octicon-mark-github ``` GitHub logo is now white again on dark theme: <img width="431" alt="Screenshot 2023-06-12 at 21 45 34" src="https://github.com/go-gitea/gitea/assets/115237/27a43504-d60a-4132-a502-336b25883e4d"> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix profile render when the README.md size is larger than 1024 bytes (#25131)yp053272023-06-133-7/+111
| | | | | | | | | | | | | | | | | Fixes https://github.com/go-gitea/gitea/issues/25094 `GetBlobContent` will only get the first 1024 bytes, if the README.md size is larger than 1024 bytes, We can not render the rest of them. After this fix, we should provide the limited size to read when call `GetBlobContent`. After: ![image](https://github.com/go-gitea/gitea/assets/18380374/22a42936-4cf8-40b4-a5c7-e384082beb0d) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix task list checkbox toggle to work with YAML front matter (#25184)Jonathan Tran2023-06-135-7/+58
| | | | | | | | Fixes #25160. `data-source-position` of checkboxes in a task list was incorrect whenever there was YAML front matter. This would result in issue content or PR descriptions getting corrupted with random `x` or space characters when a user checked or unchecked a task.
* Fix compatible for webhook ref type (#25195)Lunny Xiao2023-06-131-0/+14
| | | | Fix #25185 Caused by #24634
* Fix open redirect check for more cases (#25143)Lauris BH2023-06-081-2/+2
| | | | | If redirect_to parameter has set value starting with `\\example.com` redirect will be created with header `Location: /\\example.com` that will redirect to example.com domain.
* fix swagger documentation for multiple files API endpoint (#25110)v1.20.0-rc0Denys Konovalov2023-06-071-4/+6
| | | | | | | | | | Fixes some issues with the swagger documentation for the new multiple files API endpoint (#24887) which were overlooked when submitting the original PR: 1. add some missing parameter descriptions 2. set correct `required` option for required parameters 3. change endpoint description to match it full functionality (every kind of file modification is supported, not just creating and updating)
* Remove stars when repo goes private (#19904)Wim2023-06-051-0/+4
| | | Fixes #18600
* Use git command instead of the ini package to remove the `origin` remote ↵Lunny Xiao2023-06-051-12/+9
| | | | (#25066)
* Add ability to set multiple redirect URIs in OAuth application UI (#25072)Denys Konovalov2023-06-051-1/+18
| | | | | | | | | | | | | | | | | | | | OAuth applications can already have multiple redirect URIs if created/edited over API. This change allows for setting multiple redirect URIs through the UI as a comma-separated list (e. g. `https://example.org/redirect,https://redirect.example.org`) <details> <summary>Screenshots</summary> ![Bildschirmfoto vom 2023-06-04 17-14-40](https://github.com/go-gitea/gitea/assets/47871822/2206dc32-e7e4-4953-9ecb-e098890b3f54) ![Bildschirmfoto vom 2023-06-04 17-14-50](https://github.com/go-gitea/gitea/assets/47871822/cd97c73c-9310-44ee-a83a-b927a1ef94da) </details> Closes #25068
* Redesign Scoped Access Tokens (#24767)Jack Hay2023-06-041-10/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Adds the following high level access scopes, each with `read` and `write` levels: - `activitypub` - `admin` (hidden if user is not a site admin) - `misc` - `notification` - `organization` - `package` - `issue` - `repository` - `user` - Adds new middleware function `tokenRequiresScopes()` in addition to `reqToken()` - `tokenRequiresScopes()` is used for each high-level api section - _if_ a scoped token is present, checks that the required scope is included based on the section and HTTP method - `reqToken()` is used for individual routes - checks that required authentication is present (but does not check scope levels as this will already have been handled by `tokenRequiresScopes()` - Adds migration to convert old scoped access tokens to the new set of scopes - Updates the user interface for scope selection ### User interface example <img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM" src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3"> <img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM" src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c"> ## tokenRequiresScopes Design Decision - `tokenRequiresScopes()` was added to more reliably cover api routes. For an incoming request, this function uses the given scope category (say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say `DELETE`) and verifies that any scoped tokens in use include `delete:organization`. - `reqToken()` is used to enforce auth for individual routes that require it. If a scoped token is not present for a request, `tokenRequiresScopes()` will not return an error ## TODO - [x] Alphabetize scope categories - [x] Change 'public repos only' to a radio button (private vs public). Also expand this to organizations - [X] Disable token creation if no scopes selected. Alternatively, show warning - [x] `reqToken()` is missing from many `POST/DELETE` routes in the api. `tokenRequiresScopes()` only checks that a given token has the correct scope, `reqToken()` must be used to check that a token (or some other auth) is present. - _This should be addressed in this PR_ - [x] The migration should be reviewed very carefully in order to minimize access changes to existing user tokens. - _This should be addressed in this PR_ - [x] Link to api to swagger documentation, clarify what read/write/delete levels correspond to - [x] Review cases where more than one scope is needed as this directly deviates from the api definition. - _This should be addressed in this PR_ - For example: ```go m.Group("/users/{username}/orgs", func() { m.Get("", reqToken(), org.ListUserOrgs) m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), context_service.UserAssignmentAPI()) ``` ## Future improvements - [ ] Add required scopes to swagger documentation - [ ] Redesign `reqToken()` to be opt-out rather than opt-in - [ ] Subdivide scopes like `repository` - [ ] Once a token is created, if it has no scopes, we should display text instead of an empty bullet point - [ ] If the 'public repos only' option is selected, should read categories be selected by default Closes #24501 Closes #24799 Co-authored-by: Jonathan Tran <jon@allspice.io> Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Use a separate admin page to show global stats, remove `actions` stat (#25062)wxiaoguang2023-06-031-12/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Before, Gitea shows the database table stats on the `admin dashboard` page. It has some problems: * `count(*)` is quite heavy. If tables have many records, this blocks loading the admin page blocks for a long time * Some users had even reported issues that they can't visit their admin page because this page causes blocking or `50x error (reverse proxy timeout)` * The `actions` stat is not useful. The table is simply too large. Does it really matter if it contains 1,000,000 rows or 9,999,999 rows? * The translation `admin.dashboard.statistic_info` is difficult to maintain. So, this PR uses a separate page to show the stats and removes the `actions` stat. ![image](https://github.com/go-gitea/gitea/assets/2114189/babf7c61-b93b-4a62-bfaa-22983636427e) ## :warning: BREAKING The `actions` Prometheus metrics collector has been removed for the reasons mentioned beforehand. Please do not rely on its output anymore.
* Refactor INI package (first step) (#25024)wxiaoguang2023-06-027-68/+209
| | | | | | | | | The INI package has many bugs and quirks, and in fact it is unmaintained. This PR is the first step for the INI package refactoring: * Use Gitea's "config_provider" to provide INI access * Deprecate the INI package by golangci.yml rule
* Rename NotifyPullReviewRequest to NotifyPullRequestReviewRequest (#24988)谈笑风生间2023-05-315-8/+8
| | | | | | | | | | | | after #24481 To keep consistent, maybe pull_request_review_request is better. ## what my pull request does Rename NotifyPullReviewRequest to NotifyPullRequestReviewRequest. <img width="1087" alt="image" src="https://github.com/go-gitea/gitea/assets/75628309/2cf91f02-74f2-42fe-a998-0a039b821d8d">
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-14 03:59:40 +0000