summaryrefslogtreecommitdiffstats
path: root/routers/user/auth.go
Commit message (Collapse)AuthorAgeFilesLines
* Block registration based on email domain (#5157)Lanre Adelowo2018-11-141-0/+5
| | | * implement email domain whitelist
* UX of link account (Step 1) (#5006)AJ ONeal2018-10-281-2/+24
| | | | | | | | | | | | | | * Show either sign up OR sign in * disambiguate fresh start from adding recovery options * use tabs to switch between account link flows * add active to tab body as well * changes as per discussion * handle specific error; fix missing err typo
* Force user to change password (#4489)Lanre Adelowo2018-09-131-1/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * redirect to login page after successfully activating account * force users to change password if account was created by an admin * force users to change password if account was created by an admin * fixed build * fixed build * fix pending issues with translation and wrong routes * make sure path check is safe * remove unneccessary newline * make sure users that don't have to view the form get redirected * move route to use /settings prefix so as to make sure unauthenticated users can't view the page * update as per @lafriks review * add necessary comment * remove unrelated changes * support redirecting to location the user actually want to go to before being forced to change his/her password * run make fmt * added tests * improve assertions * add assertion * fix copyright year Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
* Make cookies HttpOnly and obey COOKIE_SECURE flag (#4706)SagePtr2018-08-141-16/+16
|
* log user in after a successful sign up (#4615)Lanre Adelowo2018-08-111-1/+2
|
* Switch plaintext scratch tokens to use hash instead (#4331)techknowlogick2018-07-271-1/+5
|
* Add flash message after an account has been successfully activated (#4510)Lanre Adelowo2018-07-251-0/+1
| | | | * added new locale text
* Redirect to correct page after using scratch token (#4458)techknowlogick2018-07-191-1/+2
|
* Add Recaptcha functionality to Gitea (#4044)Fluf2018-07-051-2/+33
|
* Fix open redirect vulnerability on login screen (#4312)Jonas Franz2018-06-261-1/+2
| | | | | | | | | | | | | | * Fix open redirect vulnerability on login screen Signed-off-by: Jonas Franz <info@jonasfranz.software> * Reorder imports Signed-off-by: Jonas Franz <info@jonasfranz.software> * Replace www. from Domain too Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add support for FIDO U2F (#3971)Jonas Franz2018-05-191-5/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for U2F Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add vendor library Add missing translations Signed-off-by: Jonas Franz <info@jonasfranz.software> * Minor improvements Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F support for Firefox, Chrome (Android) by introducing a custom JS library Add U2F error handling Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F login page to OAuth Signed-off-by: Jonas Franz <info@jonasfranz.software> * Move U2F user settings to a separate file Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add unit tests for u2f model Renamed u2f table name Signed-off-by: Jonas Franz <info@jonasfranz.software> * Fix problems caused by refactoring Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F documentation Signed-off-by: Jonas Franz <info@jonasfranz.software> * Remove not needed console.log-s Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add default values to app.ini.sample Add FIDO U2F to comparison Signed-off-by: Jonas Franz <info@jonasfranz.software>
* issue-2768: added new option allow_only_external_registration (#3910)FabioFortini2018-05-131-1/+2
|
* Added user language setting (#3875)kolaente2018-05-051-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Added user language setting * Added translation string for setting * Fixed import order + typo * improved checking if the user has a language saved in the db * The current saved language is now set a default inside the dropdown * fmt * When a user signs in and doesn't have a language saved, the current browser language is saved * updated gitea-sdk * Merge branch 'master' of https://github.com/go-gitea/gitea into save-user-language # Conflicts: # models/migrations/migrations.go # models/migrations/v62.go * Made tests work again * trigger CI * trigger CI * fmt * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * When loggin in, only the language col gets updated instead of everything
* Do not allow to reuse TOTP passcode (#3878)Lauris BH2018-05-021-1/+7
|
* Refactor and simplify redirect to url (#3674)Lauris BH2018-03-151-8/+4
|
* Cleanup models.User.HashPassword (#3334)Kim "BKC" Carlbäcker2018-01-121-2/+1
|
* Handle refactor (#3339)Morgan Bazalgette2018-01-101-44/+44
| | | | | | * Replace all ctx.Handle with ctx.ServerError or ctx.NotFound * Change Handle(403) to NotFound, avoid using macaron's NotFound
* Change EncodePasswd to HashPassword (#3329)Morgan Bazalgette2018-01-081-1/+1
| | | | | | * Change EncodePasswd to HashPassword * Create test+benchmark for HashPassword
* Apply LANDING_PAGE config options for logged in users (#2894)schaffman52017-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Removed superfluous conditional and correct whitespace. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Update app.ini Reverted new line. * Formatting. Signed-off-by: Mike Schaffer <mschaff@gmail.com>
* Log failed authentication attempts with remote address for fail2ban (#2334)David Schneiderbauer2017-08-241-0/+2
| | | Signed-off-by: David Schneiderbauer <dschneiderbauer@gmail.com>
* Only update needed columns when update user (#2296)Lunny Xiao2017-08-121-8/+10
| | | | | | * only update needed columns when update user * fix missing update_unix column
* Make time diff translatable (#2057)Lauris BH2017-06-281-5/+5
|
* xxx_active_code_live setting in printed in hours and minutes instead … (#1814)Jonas Östanbäck2017-05-291-5/+5
| | | | | | * xxx_active_code_live setting in printed in hours and minutes instead of just hours * Update app.ini description of xxx_code_lives settings
* Add new text for reset password flash (#1718)Jonas Östanbäck2017-05-141-2/+2
| | | | | * Forgot password should use ResetPwdCodeLives, not ActiveCodeLives * Improve documentation for different send mail functions related to password reset * Improve documentation in conf/app.ini regarding xxx_CODE_LIVE_MINUTES settings
* Additional OAuth2 providers (#1010)Willem van Dreumel2017-05-011-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add google+ * sort signin oauth2 providers based on the name so order is always the same * update auth tip for google+ * add gitlab provider * add bitbucket provider (and some go fmt) * add twitter provider * add facebook provider * add dropbox provider * add openid connect provider incl. new format of tips section in "Add New Source" * lower the amount of disk storage for each session to prevent issues while building cross platform (and disk overflow) * imports according to goimport and code style * make it possible to set custom urls to gitlab and github provider (only these could have a different host) * split up oauth2 into multiple files * small typo in comment * fix indention * fix indentation * fix new line before external import * fix layout of signin part * update "broken" dependency
* Reduce conditionals in signin/signup inner formsSandro Santilli2017-03-201-4/+9
| | | | by always using SignInLink and SignUpLink in the form action
* Login via OpenID-2.0 (#618)Sandro Santilli2017-03-171-1/+9
|
* Rename /forget_password url to /forgot_passwordSandro Santilli2017-03-141-2/+2
| | | | | | | | | Also renames `forgot_password` translation key to `forgot_password_title` and `forget_password` to `forgot_password` Includes entry in CHANGELOG about the breaking change (and some markdown fixes in there)
* Show a link to password reset from password change and delete account (#862)Sandro Santilli2017-03-111-0/+3
| | | | | | | It's helpful when you forgot your password thus cannot change it (can happen if you log in via OAuth2 or OpenID) Also make sure that both the delete-account and password-change links to forgot-password will have the primary email pre-filled
* Link OAuth2 account to 2FA enabled account (fix #1050) (#1052)Willem van Dreumel2017-02-271-2/+20
| | | | | | * fixes #1050 where linking an account to a 2fa enabled account failed because we forgot to really link the account when 2fa is completed * handle errors
* fix 500 when use a duplicat email instead of giving an error tip (#1040)Lunny Xiao2017-02-251-7/+9
|
* Oauth2 consumer (#679)Willem van Dreumel2017-02-221-8/+350
| | | | | | | | | | | | | | | | | | | | | | | | | * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
* Two factor authentication support (#630)Andrew2017-01-161-8/+169
| | | | | | | | | | | | | | | | | | | | | | | | | | * Initial commit for 2FA support Signed-off-by: Andrew <write@imaginarycode.com> * Add vendored files * Add missing depends * A few clean ups * Added improvements, proper encryption * Better encryption key * Simplify "key" generation * Make 2FA enrollment page more robust * Fix typo * Rename twofa/2FA to TwoFactor * UNIQUE INDEX -> UNIQUE
* Added minimum password length to app.ini (#223)Bwko2016-12-241-3/+8
|
* Fix random string generator (#384)Denis Denisov2016-12-201-3/+14
| | | | | | | | | | | * Remove unused custom-alphabet feature of random string generator Fix random string generator Random string generator should return error if it fails to read random data via crypto/rand * Fixes variable (un)initialization mixed assign Update test GetRandomString
* Golint fixed for modules/setting (#262)Lunny Xiao2016-11-271-19/+19
| | | | | | * golint fixed for modules/setting * typo fixed and renamed UNIXSOCKET to UnixSocket
* golint fixed for parts of routers root, dev, user and org dirs (#167)Lunny Xiao2016-11-181-33/+47
| | | | | | | | * golint fixed for parts of routers root, dev and org dirs * add user/auth.go golint fixed * rename unnecessary exported to unexported and user dir golint fixed
* Normalize files with gofmtThibault Meyer2016-11-111-2/+2
|
* Update import paths from github.com/go-gitea to code.gitea.io (#135)Sandro Santilli2016-11-101-6/+6
| | | | | | | - Update import paths from github.com/go-gitea to code.gitea.io - Fix import path for travis See https://docs.travis-ci.com/user/languages/go#Go-Import-Path
* Support to last login featureJoubert RedRat2016-11-091-0/+7
|
* Change import reference to match gitea instead of gogs (#37)Rémy Boulanouar2016-11-031-6/+6
|
* Prevented user enumeration of valid users through HTTP status codes of login ↵LefsFlare2016-10-161-2/+4
| | | | (#3639) (#3654)
* #3448 redirect if any after sign inUnknwon2016-08-271-1/+8
|
* Refactor User.Id to User.IDUnknwon2016-07-241-4/+4
|
* #2854 fix no mail notification when issue is closed/reopenedUnknwon2016-07-161-6/+5
|
* Merge pull request #2823 from zacheryph/feature/local-only-password-resetUnknwon2016-03-141-0/+6
|\ | | | | Prevent `Forgot Password` for non local users
| * ensure we don’t try changing LDAP passswordsZachery Hostens2016-03-141-0/+6
| |
* | #1891 attempt to fix invalid csrf tokenUnknwon2016-03-121-0/+6
| |
* | Rename module: middleware -> contextUnknwon2016-03-111-13/+53
|/
* fix #2020Unknwon2015-11-241-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-12 01:15:53 +0000