summaryrefslogtreecommitdiffstats
path: root/routers/user/auth.go
Commit message (Collapse)AuthorAgeFilesLines
...
* routers/user: ensure that decryption of cookie actually suceeds (#7363)leonklingele2019-07-061-2/+2
| | | | | | | | Previously, only the first return value of ctx.GetSuperSecureCookie was used to check whether decryption of the auth cookie succeeded. ctx.GetSuperSecureCookie also returns a second value, a boolean, indicating success or not. That value should be checked first to be on the safe side and not rely on internal logic of the encryption and decryption blackbox.
* Add golangci (#6418)kolaente2019-06-121-30/+83
|
* Allow Recaptcha service url to be configured (#6820)zeripath2019-05-021-2/+5
|
* UX + Security current user password reset (#5042)AJ ONeal2019-04-181-43/+68
| | | | | | | | | | | | | | * allow current user to reset their own password * handle reset password edge cases properly and consistently * remove dangling assignment * properly label account recovery instead of reset password * remove 'Click here' from button * update English-only account-recovery templates
* Better logging (#6038) (#6095)zeripath2019-04-021-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Panic don't fatal on create new logger Fixes #5854 Signed-off-by: Andrew Thornton <art27@cantab.net> * partial broken * Update the logging infrastrcture Signed-off-by: Andrew Thornton <art27@cantab.net> * Reset the skip levels for Fatal and Error Signed-off-by: Andrew Thornton <art27@cantab.net> * broken ncsa * More log.Error fixes Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove nal * set log-levels to lowercase * Make console_test test all levels * switch to lowercased levels * OK now working * Fix vetting issues * Fix lint * Fix tests * change default logging to match current gitea * Improve log testing Signed-off-by: Andrew Thornton <art27@cantab.net> * reset error skip levels to 0 * Update documentation and access logger configuration * Redirect the router log back to gitea if redirect macaron log but also allow setting the log level - i.e. TRACE * Fix broken level caching * Refactor the router log * Add Router logger * Add colorizing options * Adjust router colors * Only create logger if they will be used * update app.ini.sample * rename Attribute ColorAttribute * Change from white to green for function * Set fatal/error levels * Restore initial trace logger * Fix Trace arguments in modules/auth/auth.go * Properly handle XORMLogger * Improve admin/config page * fix fmt * Add auto-compression of old logs * Update error log levels * Remove the unnecessary skip argument from Error, Fatal and Critical * Add stacktrace support * Fix tests * Remove x/sync from vendors? * Add stderr option to console logger * Use filepath.ToSlash to protect against Windows in tests * Remove prefixed underscores from names in colors.go * Remove not implemented database logger This was removed from Gogs on 4 Mar 2016 but left in the configuration since then. * Ensure that log paths are relative to ROOT_PATH * use path.Join * rename jsonConfig to logConfig * Rename "config" to "jsonConfig" to make it clearer * Requested changes * Requested changes: XormLogger * Try to color the windows terminal If successful default to colorizing the console logs * fixup * Colorize initially too * update vendor * Colorize logs on default and remove if this is not a colorizing logger * Fix documentation * fix test * Use go-isatty to detect if on windows we are on msys or cygwin * Fix spelling mistake * Add missing vendors * More changes * Rationalise the ANSI writer protection * Adjust colors on advice from @0x5c * Make Flags a comma separated list * Move to use the windows constant for ENABLE_VIRTUAL_TERMINAL_PROCESSING * Ensure matching is done on the non-colored message - to simpify EXPRESSION
* Don't Unescape redirect_to cookie value (#6399)mrsdizzie2019-03-201-5/+4
| | | | | | | redirect_to holds a value that we want to redirect back to after login. This value can be a path with intentonally escaped values and we should not unescape it. Fixes #4475
* Minor UI tweaks (#5980)John Olheiser2019-02-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove all CommitStatus when a repo is deleted Signed-off-by: jolheiser <john.olheiser@gmail.com> * Minor UI tweaks (#5782) Added 'No License' option Added link and octicon change for external issue trackers Reset password now notifies right away if the code is invalid Signed-off-by: jolheiser <john.olheiser@gmail.com> * More UI tweaks More info in PR * Generate stylesheet for arc-green * Make gofmt work * Change PR integration since the button is changed * Rebase * Generate stylesheet * UI updates Made the PR button a "basic" button Vertically centered the issue checkboxes Labels will update only once after modal is closed * Commit to reference related issues Resolves #5782 Resolves #5861 Addresses original question in #5993 * Change the comment wording since PR button is no longer little and green. * Revert changes that made Windows work * Regenerate stylesheet * Regenerate stylesheets * make generate-stylesheets * Update integration again, changed button style Signed-off-by: jolheiser <john.olheiser@gmail.com> * Added ID to PR button Changed integration to use the ID to avoid breaking in the future * Added missing semi-colons * Added back distinction between issue actions and filters (overlooked it before) Moved action button over next to other action dropdowns * Remove extra tab formatting in list.tmpl * Remove more formatting from GoLand * Replace hardcoded "No License" with i18n license helper.
* Fix prohibit login check on authorization (#6106)Lunny Xiao2019-02-191-0/+13
| | | | | | | | | | | | * fix bug prohibit login not applied on dashboard * fix tests * fix bug user status leak * fix typo * return after render
* Block registration based on email domain (#5157)Lanre Adelowo2018-11-141-0/+5
| | | * implement email domain whitelist
* UX of link account (Step 1) (#5006)AJ ONeal2018-10-281-2/+24
| | | | | | | | | | | | | | * Show either sign up OR sign in * disambiguate fresh start from adding recovery options * use tabs to switch between account link flows * add active to tab body as well * changes as per discussion * handle specific error; fix missing err typo
* Force user to change password (#4489)Lanre Adelowo2018-09-131-1/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * redirect to login page after successfully activating account * force users to change password if account was created by an admin * force users to change password if account was created by an admin * fixed build * fixed build * fix pending issues with translation and wrong routes * make sure path check is safe * remove unneccessary newline * make sure users that don't have to view the form get redirected * move route to use /settings prefix so as to make sure unauthenticated users can't view the page * update as per @lafriks review * add necessary comment * remove unrelated changes * support redirecting to location the user actually want to go to before being forced to change his/her password * run make fmt * added tests * improve assertions * add assertion * fix copyright year Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
* Make cookies HttpOnly and obey COOKIE_SECURE flag (#4706)SagePtr2018-08-141-16/+16
|
* log user in after a successful sign up (#4615)Lanre Adelowo2018-08-111-1/+2
|
* Switch plaintext scratch tokens to use hash instead (#4331)techknowlogick2018-07-271-1/+5
|
* Add flash message after an account has been successfully activated (#4510)Lanre Adelowo2018-07-251-0/+1
| | | | * added new locale text
* Redirect to correct page after using scratch token (#4458)techknowlogick2018-07-191-1/+2
|
* Add Recaptcha functionality to Gitea (#4044)Fluf2018-07-051-2/+33
|
* Fix open redirect vulnerability on login screen (#4312)Jonas Franz2018-06-261-1/+2
| | | | | | | | | | | | | | * Fix open redirect vulnerability on login screen Signed-off-by: Jonas Franz <info@jonasfranz.software> * Reorder imports Signed-off-by: Jonas Franz <info@jonasfranz.software> * Replace www. from Domain too Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add support for FIDO U2F (#3971)Jonas Franz2018-05-191-5/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for U2F Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add vendor library Add missing translations Signed-off-by: Jonas Franz <info@jonasfranz.software> * Minor improvements Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F support for Firefox, Chrome (Android) by introducing a custom JS library Add U2F error handling Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F login page to OAuth Signed-off-by: Jonas Franz <info@jonasfranz.software> * Move U2F user settings to a separate file Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add unit tests for u2f model Renamed u2f table name Signed-off-by: Jonas Franz <info@jonasfranz.software> * Fix problems caused by refactoring Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F documentation Signed-off-by: Jonas Franz <info@jonasfranz.software> * Remove not needed console.log-s Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add default values to app.ini.sample Add FIDO U2F to comparison Signed-off-by: Jonas Franz <info@jonasfranz.software>
* issue-2768: added new option allow_only_external_registration (#3910)FabioFortini2018-05-131-1/+2
|
* Added user language setting (#3875)kolaente2018-05-051-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Added user language setting * Added translation string for setting * Fixed import order + typo * improved checking if the user has a language saved in the db * The current saved language is now set a default inside the dropdown * fmt * When a user signs in and doesn't have a language saved, the current browser language is saved * updated gitea-sdk * Merge branch 'master' of https://github.com/go-gitea/gitea into save-user-language # Conflicts: # models/migrations/migrations.go # models/migrations/v62.go * Made tests work again * trigger CI * trigger CI * fmt * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * When loggin in, only the language col gets updated instead of everything
* Do not allow to reuse TOTP passcode (#3878)Lauris BH2018-05-021-1/+7
|
* Refactor and simplify redirect to url (#3674)Lauris BH2018-03-151-8/+4
|
* Cleanup models.User.HashPassword (#3334)Kim "BKC" Carlbäcker2018-01-121-2/+1
|
* Handle refactor (#3339)Morgan Bazalgette2018-01-101-44/+44
| | | | | | * Replace all ctx.Handle with ctx.ServerError or ctx.NotFound * Change Handle(403) to NotFound, avoid using macaron's NotFound
* Change EncodePasswd to HashPassword (#3329)Morgan Bazalgette2018-01-081-1/+1
| | | | | | * Change EncodePasswd to HashPassword * Create test+benchmark for HashPassword
* Apply LANDING_PAGE config options for logged in users (#2894)schaffman52017-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Removed superfluous conditional and correct whitespace. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Update app.ini Reverted new line. * Formatting. Signed-off-by: Mike Schaffer <mschaff@gmail.com>
* Log failed authentication attempts with remote address for fail2ban (#2334)David Schneiderbauer2017-08-241-0/+2
| | | Signed-off-by: David Schneiderbauer <dschneiderbauer@gmail.com>
* Only update needed columns when update user (#2296)Lunny Xiao2017-08-121-8/+10
| | | | | | * only update needed columns when update user * fix missing update_unix column
* Make time diff translatable (#2057)Lauris BH2017-06-281-5/+5
|
* xxx_active_code_live setting in printed in hours and minutes instead … (#1814)Jonas Östanbäck2017-05-291-5/+5
| | | | | | * xxx_active_code_live setting in printed in hours and minutes instead of just hours * Update app.ini description of xxx_code_lives settings
* Add new text for reset password flash (#1718)Jonas Östanbäck2017-05-141-2/+2
| | | | | * Forgot password should use ResetPwdCodeLives, not ActiveCodeLives * Improve documentation for different send mail functions related to password reset * Improve documentation in conf/app.ini regarding xxx_CODE_LIVE_MINUTES settings
* Additional OAuth2 providers (#1010)Willem van Dreumel2017-05-011-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add google+ * sort signin oauth2 providers based on the name so order is always the same * update auth tip for google+ * add gitlab provider * add bitbucket provider (and some go fmt) * add twitter provider * add facebook provider * add dropbox provider * add openid connect provider incl. new format of tips section in "Add New Source" * lower the amount of disk storage for each session to prevent issues while building cross platform (and disk overflow) * imports according to goimport and code style * make it possible to set custom urls to gitlab and github provider (only these could have a different host) * split up oauth2 into multiple files * small typo in comment * fix indention * fix indentation * fix new line before external import * fix layout of signin part * update "broken" dependency
* Reduce conditionals in signin/signup inner formsSandro Santilli2017-03-201-4/+9
| | | | by always using SignInLink and SignUpLink in the form action
* Login via OpenID-2.0 (#618)Sandro Santilli2017-03-171-1/+9
|
* Rename /forget_password url to /forgot_passwordSandro Santilli2017-03-141-2/+2
| | | | | | | | | Also renames `forgot_password` translation key to `forgot_password_title` and `forget_password` to `forgot_password` Includes entry in CHANGELOG about the breaking change (and some markdown fixes in there)
* Show a link to password reset from password change and delete account (#862)Sandro Santilli2017-03-111-0/+3
| | | | | | | It's helpful when you forgot your password thus cannot change it (can happen if you log in via OAuth2 or OpenID) Also make sure that both the delete-account and password-change links to forgot-password will have the primary email pre-filled
* Link OAuth2 account to 2FA enabled account (fix #1050) (#1052)Willem van Dreumel2017-02-271-2/+20
| | | | | | * fixes #1050 where linking an account to a 2fa enabled account failed because we forgot to really link the account when 2fa is completed * handle errors
* fix 500 when use a duplicat email instead of giving an error tip (#1040)Lunny Xiao2017-02-251-7/+9
|
* Oauth2 consumer (#679)Willem van Dreumel2017-02-221-8/+350
| | | | | | | | | | | | | | | | | | | | | | | | | * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
* Two factor authentication support (#630)Andrew2017-01-161-8/+169
| | | | | | | | | | | | | | | | | | | | | | | | | | * Initial commit for 2FA support Signed-off-by: Andrew <write@imaginarycode.com> * Add vendored files * Add missing depends * A few clean ups * Added improvements, proper encryption * Better encryption key * Simplify "key" generation * Make 2FA enrollment page more robust * Fix typo * Rename twofa/2FA to TwoFactor * UNIQUE INDEX -> UNIQUE
* Added minimum password length to app.ini (#223)Bwko2016-12-241-3/+8
|
* Fix random string generator (#384)Denis Denisov2016-12-201-3/+14
| | | | | | | | | | | * Remove unused custom-alphabet feature of random string generator Fix random string generator Random string generator should return error if it fails to read random data via crypto/rand * Fixes variable (un)initialization mixed assign Update test GetRandomString
* Golint fixed for modules/setting (#262)Lunny Xiao2016-11-271-19/+19
| | | | | | * golint fixed for modules/setting * typo fixed and renamed UNIXSOCKET to UnixSocket
* golint fixed for parts of routers root, dev, user and org dirs (#167)Lunny Xiao2016-11-181-33/+47
| | | | | | | | * golint fixed for parts of routers root, dev and org dirs * add user/auth.go golint fixed * rename unnecessary exported to unexported and user dir golint fixed
* Normalize files with gofmtThibault Meyer2016-11-111-2/+2
|
* Update import paths from github.com/go-gitea to code.gitea.io (#135)Sandro Santilli2016-11-101-6/+6
| | | | | | | - Update import paths from github.com/go-gitea to code.gitea.io - Fix import path for travis See https://docs.travis-ci.com/user/languages/go#Go-Import-Path
* Support to last login featureJoubert RedRat2016-11-091-0/+7
|
* Change import reference to match gitea instead of gogs (#37)Rémy Boulanouar2016-11-031-6/+6
|
* Prevented user enumeration of valid users through HTTP status codes of login ↵LefsFlare2016-10-161-2/+4
| | | | (#3639) (#3654)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 21:10:14 +0000