aboutsummaryrefslogtreecommitdiffstats
path: root/routers/api
Commit message (Collapse)AuthorAgeFilesLines
* Remove ReverseProxy authentication from the API (#22219) (#22252)Lunny Xiao2022-12-301-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | backport #22219 Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace #22077 Close #22221 Close #22077 Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Use complete SHA to create and query commit status (#22244) (#22258)Jason Song2022-12-282-1/+29
| | | | | | | | | | | | | Backport #22244. Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow empty assignees on pull request edit (#22150) (#22213)KN4CK3R2022-12-221-0/+5
| | | | | Backport of #22150 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Normalize NuGet package version on upload (#22186) (#22201)KN4CK3R2022-12-211-19/+3
| | | | | Backport of #22186 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Workaround for container registry push/pull errors (#21862) (#22069)KN4CK3R2022-12-103-4/+65
| | | Backport of #21862
* Fix ListBranches to handle empty case (#21921) (#22025)Lunny Xiao2022-12-041-26/+34
| | | | | | | | Fix #21910 Backport #21921 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix setting HTTP headers after write (#21833) (#21874)KN4CK3R2022-11-201-2/+6
| | | | Backport #21833
* Load GitRepo in API before deleting issue (#21720) (#21795)Jason Song2022-11-121-1/+1
| | | | | | | | | | | Backport #21720. Fix #20921. The `ctx.Repo.GitRepo` has been used in deleting issues when the issue is a PR. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Remove semver compatible flag and change pypi to an array of test cases ↵Wayne Starr2022-11-092-4/+47
| | | | | | | | | | | | (#21708) (#21729) Backport (#21708) This addresses #21707 and adds a second package test case for a non-semver compatible version (this might be overkill though since you could also edit the old package version to have an epoch in front and see the error, this just seemed more flexible for the future). Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Allow for resolution of NPM registry paths that match upstream (#21568) (#21723)Wayne Starr2022-11-092-0/+45
| | | | | | | | | | | | | | Backport (#21568) This PR fixes issue #21567 allowing for package tarball URLs to match the upstream registry (and GitLab/JFrog Artifactory URLs). It uses a regex to parse the filename (which contains the NPM version) and does a fuzzy search to pull it out. The regex was built/expanded from http://json.schemastore.org/package, https://github.com/Masterminds/semver, and https://docs.npmjs.com/cli/v6/using-npm/semver and is testable here: https://regex101.com/r/OydBJq/5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow local package identifiers for PyPI packages (#21690) (#21726)Wayne Starr2022-11-091-2/+9
| | | | | | | | Backport (#21690) Fixes #21683 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix package access for admins and inactive users (#21580) (#21592)KN4CK3R2022-10-281-0/+2
| | | | | | Backport of #21580 Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* support binary deploy in npm packages (#21589)eleith2022-10-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | backport of #21372 for v1.17.4 ------------------- npm package.json supports binary packaging: https://docs.npmjs.com/cli/v8/configuring-npm/package-json#bin the npm registry documents that the binary references will be attached to the abbreviated version object: https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-object unfortunately their api documentation leaves this out: https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-version-objectdoc which is likely to be the reason this was left out in gitea's initial implementation this response is critical for npm to install the binary in the .bin folder so as to be included on the users default bin path, resulting in immediate access to any binaries provided by the package i have tested upload and installing through npm and can confirm the npm registry now responds with bin in the version metadata and results in the binary being available after install. this fixes https://github.com/go-gitea/gitea/issues/21303 Co-authored-by: eleith <online-github@eleith.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Case-insensitive NuGet symbol file GUID (#21409) (#21575)Hubert Wawrzyńczyk2022-10-242-2/+2
| | | | | | Backport of #21409 Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Display total commit count in hook message (#21400) (#21481)KN4CK3R2022-10-171-9/+10
| | | | | | Backport of #21400 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Enforce grouped NuGet search results (#21442) (#21480)KN4CK3R2022-10-171-13/+6
| | | Backport of #21442
* Set SemverCompatible to false for Conan packages (#21275) (#21366)KN4CK3R2022-10-101-2/+1
| | | Backport of #21275
* Make NuGet service index publicly accessible (#21242) (#21277)KN4CK3R2022-10-081-23/+25
| | | | | | Backport of #21242 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* Use Go 1.19 fmt for Gitea 1.17, sync emoji data (#21239)wxiaoguang2022-09-225-60/+53
| | | | | | | The images used by Gitea's drone pipeline were upgraded to Go 1.19.x It causes the lint fails because Go 1.19 uses new code format. This PR partially backport #20758 (including the emoji-data sync), partially fix the format manually.
* Allow uppercase ASCII alphabet in PyPI package names (#21095) (#21217)KN4CK3R2022-09-201-1/+1
| | | | | Backport of #21095 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix hard-coded timeout and error panic in API archive download endpoint ↵zeripath2022-09-061-2/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#20925) (#21051) Backport #20925 This commit updates the `GET /api/v1/repos/{owner}/{repo}/archive/{archive}` endpoint which prior to this PR had a couple of issues. 1. The endpoint had a hard-coded 20s timeout for the archiver to complete after which a 500 (Internal Server Error) was returned to client. For a scripted API client there was no clear way of telling that the operation timed out and that it should retry. 2. Whenever the timeout _did occur_, the code used to panic. This was caused by the API endpoint "delegating" to the same call path as the web, which uses a slightly different way of reporting errors (HTML rather than JSON for example). More specifically, `api/v1/repo/file.go#GetArchive` just called through to `web/repo/repo.go#Download`, which expects the `Context` to have a `Render` field set, but which is `nil` for API calls. Hence, a `nil` pointer error. The code addresses (1) by dropping the hard-coded timeout. Instead, any timeout/cancelation on the incoming `Context` is used. The code addresses (2) by updating the API endpoint to use a separate call path for the API-triggered archive download. This avoids producing HTML-errors on errors (it now produces JSON errors). Signed-off-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com> Signed-off-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fill the specified ref in webhook test payload (#20961) (#21055)Jason Song2022-09-041-4/+12
| | | | | | | Backport #20961 The webhook payload should use the right ref when it‘s specified in the testing request. The compare URL should not be empty, a URL like `compare/A...A` seems useless in most cases but is helpful when testing.
* Add more checks in migration code (#21011) (#21050)zeripath2022-09-042-4/+2
| | | | | | | | | | | Backport #21011 When migrating add several more important sanity checks: * SHAs must be SHAs * Refs must be valid Refs * URLs must be reasonable Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add Dev, Peer and Optional dependencies to npm PackageMetadataVersion ↵José Carlos2022-09-031-9/+12
| | | | | | | | | (#21017) (#21044) Backport #21017 Set DevDependencies, PeerDependencies & OptionalDependencies in npm package metadatas Fix https://github.com/go-gitea/gitea/issues/21013
* Return 404 NotFound if requested attachment does not exist (#20886) (#20941)zeripath2022-08-251-0/+20
| | | | | | | | | | | | | | Backport #20886 Add code to test if GetAttachmentByID returns an ErrAttachmentNotExist error and return NotFound instead of InternalServerError Fix #20884 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow multiple metadata files for Maven packages (#20674) (#20916)KN4CK3R2022-08-231-2/+3
| | | | | | | | | | | | | * Allow file overwrite for meta files. * Added tests. * lint Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Pad GPG Key ID with preceding zeroes (#20878) (#20885)zeripath2022-08-221-0/+7
| | | | | | | | | | | | | | Backport #20878 The go crypto library does not pad keyIDs to 16 characters with preceding zeroes. This is a somewhat confusing thing for most users who expect these to have preceding zeroes. This PR prefixes any sub 16 length KeyID with preceding zeroes and removes preceding zeroes from KeyIDs inputted on the API. Fix #20876 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix owners cannot create organization repos bug (#20841) (#20854)zeripath2022-08-181-1/+1
| | | | | | | | | | | | | | | Backport #20841 * Fix owners cannot create organization repos bug * Fix api * Update routers/api/v1/org/team.go Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Add support for NuGet API keys (#20721) (#20734)KN4CK3R2022-08-102-0/+46
| | | | | Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Keep download count on Container tag overwrite (#20728) (#20735)KN4CK3R2022-08-091-0/+3
| | | Co-authored-by: 6543 <6543@obermui.de>
* Send correct NuGet status codes (#20647) (#20677)KN4CK3R2022-08-051-3/+5
| | | | | * Fixed status codes. * Fixed status codes.
* Add Docker /v2/_catalog endpoint (#20469) (#20556)65432022-07-307-6/+60
| | | | | | | | | | | | | | * Added properties for packages. * Fixed authenticate header format. * Added _catalog endpoint. * Check owner visibility. * Extracted condition. * Added test for _catalog. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* packages/generic: Do not restrict package versions to SemVer (#20414) (#20531)65432022-07-291-8/+6
| | | | | | | | There are existing packages out there whose version do not conform to SemVer, yet, one would like to have them available in a generic package repository. To this end, remove the SemVer restriction on package versions when using the Generic package registry, and replace it with a check that simply makes sure the version isn't empty. Signed-off-by: Gergely Nagy <me@gergo.csillger.hu> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Gergely Nagy <algernon@users.noreply.github.com>
* Dismiss prior pull reviews if done via web in review dismiss (#20197) (#20407)65432022-07-191-4/+4
|
* Add missing return for when topic isn't found (#20351) (#20395)zeripath2022-07-181-0/+1
|
* Set target on create release with existing tag (#20381) (#20382)Gusted2022-07-151-0/+1
| | | When you create a new release(e.g. via Tea) and specify a tag that already exists on the repository, Gitea will instead use the `UpdateRelease` functionality. However it currently doesn't set the Target field. This PR fixes that.
* Add write check for creating Commit status (#20332) (#20333)Gusted2022-07-121-1/+1
| | | | | | - Backport #20332 - Add write code checks for creating new commit status - Regression from #5314 - Resolves #20331
* Only show Followers that current user can access (#20220) (#20252)zeripath2022-07-061-4/+4
| | | | | | | | | Backport #20220 Users who are following or being followed by a user should only be displayed if the viewing user can see them. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Check if project has the same repository id with issue when assign project ↵Lunny Xiao2022-07-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | to issue (#20133) (#20188) * Check if project has the same repository id with issue when assign project to issue * Check if issue's repository id match project's repository id * Add more permission checking * Remove invalid argument * Fix errors * Add generic check * Remove duplicated check * Return error + add check for new issues * Apply suggestions from code review Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de>
* fix permission check for delete tag (#19985)a10121127962022-06-163-0/+27
| | | | | | | fix #19970 by the way, fix some error response about protected tags. Signed-off-by: a1012112796 <1012112796@qq.com>
* Move issues related files into models/issues (#19931)Lunny Xiao2022-06-1315-246/+246
| | | | | | | | | | | | | | | | | | | | | | | | | | | * Move access and repo permission to models/perm/access * fix test * fix git test * Move functions sequence * Some improvements per @KN4CK3R and @delvh * Move issues related code to models/issues * Move some issues related sub package * Merge * Fix test * Fix test * Fix test * Fix test * Rename some files
* fix: some typos (#19956)yutotnh2022-06-131-1/+1
|
* Move some code into models/git (#19879)Lunny Xiao2022-06-123-20/+22
| | | | | | | | | | | | | | | | | | | * Move access and repo permission to models/perm/access * fix test * Move some git related files into sub package models/git * Fix build * fix git test * move lfs to sub package * move more git related functions to models/git * Move functions sequence * Some improvements per @KN4CK3R and @delvh
* Move some repository related code into sub package (#19711)Lunny Xiao2022-06-064-14/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Move some repository related code into sub package * Move more repository functions out of models * Fix lint * Some performance optimization for webhooks and others * some refactors * Fix lint * Fix * Update modules/repository/delete.go Co-authored-by: delvh <dev.lh@web.de> * Fix test * Merge * Fix test * Fix test * Fix test * Fix test Co-authored-by: delvh <dev.lh@web.de>
* Implement http signatures support for the API (#17565)Wim2022-06-051-0/+1
| | | | | | | | | | | | | | | | Fixes #12338 This allows use to talk to the API with our ssh certificate (and/or ssh-agent) without needing to fetch an API key or tokens. It will just automatically work when users have added their ssh principal in gitea. This needs client code in tea Update: also support normal pubkeys ref: https://tools.ietf.org/html/draft-cavage-http-signatures Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add API to serve blob or LFS file content (#19689)qwerty2872022-06-042-0/+143
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add LFS API * Update routers/api/v1/repo/file.go Co-authored-by: Gusted <williamzijl7@hotmail.com> * Apply suggestions * Apply suggestions * Update routers/api/v1/repo/file.go Co-authored-by: Gusted <williamzijl7@hotmail.com> * Report errors * ADd test * Use own repo for test * Use different repo name * Improve handling * Slight restructures 1. Avoid reading the blob data multiple times 2. Ensure that caching is only checked when about to serve the blob/lfs 3. Avoid nesting by returning early 4. Make log message a bit more clear 5. Ensure that the dataRc is closed by defer when passed to ServeData Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* improvement some release related code (#19867)Lunny Xiao2022-06-032-11/+12
|
* Move almost all functions' parameter db.Engine to context.Context (#19748)Lunny Xiao2022-05-2034-104/+104
| | | | * Move almost all functions' parameter db.Engine to context.Context * remove some unnecessary wrap functions
* ContainerRegistry - removed Basic Auth header (#19735)KN4CK3R2022-05-171-1/+0
| | | | | * Removed Basic Auth header. * Fixed test.
* Fix nodeinfo caching and prevent NPE if cache non-existent (#19721)zeripath2022-05-161-7/+11
| | | | | Extract from #19703 Signed-off-by: Andrew Thornton <art27@cantab.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-31 03:01:30 +0000