aboutsummaryrefslogtreecommitdiffstats
path: root/routers/user/auth.go
Commit message (Collapse)AuthorAgeFilesLines
* update #9066 Always show Password field on link account sign in page (#9147)Benno2019-11-241-0/+1
|
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
* Add password requirement info on error (#9074)guillep2k2019-11-191-2/+2
| | | | | | | | | | | | | | * Add password requirement info on error * Move BuildComplexityError to the password pkg * Unexport complexity type * Fix extra line * Update modules/password/password.go Co-Authored-By: Lauris BH <lauris@nix.lv>
* Fix require external registration password (#8885)guillep2k2019-11-091-3/+3
| | | | | | * Fix require external registration password * Fix ctx on error condition by @jolheiser
* Fix password complexity check on registration (#8887)guillep2k2019-11-091-0/+5
| | | | | | * Fix registration password complexity * Fix integration to use a complex password ;)
* Password Complexity Checks (#6230)Maxim Tkachenko2019-10-141-5/+6
| | | | | | | | | Add password complexity checks. The default settings require a lowercase, uppercase, number and a special character within passwords. Co-Authored-By: T-M-A <maxim.tkachenko@gmail.com> Co-Authored-By: Lanre Adelowo <adelowomailbox@gmail.com> Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> Co-Authored-By: Lauris BH <lauris@nix.lv>
* Update migrated repositories' issues/comments/prs poster id if user has a ↵Lunny Xiao2019-10-141-37/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | github external user saved (#7751) * update migrated issues/comments when login as github * add get userid when migrating or login with github oauth2 * fix lint * add migrations for repository service type * fix build * remove unnecessary dependencies on migrations * add cron task to update migrations poster ids and fix posterid when migrating * fix lint * fix lint * improve code * fix lint * improve code * replace releases publish id to actual author id * fix import * fix bug * fix lint * fix rawdata definition * fix some bugs * fix error message
* Move all mail related codes from models to services/mailer (#7200)Lunny Xiao2019-09-241-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * move all mail related codes from models to modules/mailer * fix lint * use DBContext instead Engine * use WithContext not WithEngine * Use DBContext instead of Engine * don't use defer when sess.Close() * move DBContext to context.go and add some methods * move mailer from modules/ to services * fix lint * fix tests * fix fmt * add gitea copyright * fix tests * don't expose db functions * make code clear * add DefaultDBContext * fix build * fix bug
* Allow registration when button is hidden (#8237)guillep2k2019-09-191-1/+1
|
* Use gitea forked macaron (#7933)Tamal Saha2019-08-231-1/+1
| | | Signed-off-by: Tamal Saha <tamal@appscode.com>
* Display ui time with customize time location (#7792)Lunny Xiao2019-08-151-5/+6
| | | | | | | | | | | | | | | | | | * display ui time with customize time location * fix lint * rename UILocation to DefaultUILocation * move time related functions to modules/timeutil * fix tests * fix tests * fix build * fix swagger
* Support setting cookie domain (#6288)Tamal Saha2019-07-121-12/+12
| | | Signed-off-by: Tamal Saha <tamal@appscode.com>
* Make captcha and password optional for external accounts (#6606)AJ ONeal2019-07-061-26/+48
|
* routers/user: ensure that decryption of cookie actually suceeds (#7363)leonklingele2019-07-061-2/+2
| | | | | | | | Previously, only the first return value of ctx.GetSuperSecureCookie was used to check whether decryption of the auth cookie succeeded. ctx.GetSuperSecureCookie also returns a second value, a boolean, indicating success or not. That value should be checked first to be on the safe side and not rely on internal logic of the encryption and decryption blackbox.
* Add golangci (#6418)kolaente2019-06-121-30/+83
|
* Allow Recaptcha service url to be configured (#6820)zeripath2019-05-021-2/+5
|
* UX + Security current user password reset (#5042)AJ ONeal2019-04-181-43/+68
| | | | | | | | | | | | | | * allow current user to reset their own password * handle reset password edge cases properly and consistently * remove dangling assignment * properly label account recovery instead of reset password * remove 'Click here' from button * update English-only account-recovery templates
* Better logging (#6038) (#6095)zeripath2019-04-021-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Panic don't fatal on create new logger Fixes #5854 Signed-off-by: Andrew Thornton <art27@cantab.net> * partial broken * Update the logging infrastrcture Signed-off-by: Andrew Thornton <art27@cantab.net> * Reset the skip levels for Fatal and Error Signed-off-by: Andrew Thornton <art27@cantab.net> * broken ncsa * More log.Error fixes Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove nal * set log-levels to lowercase * Make console_test test all levels * switch to lowercased levels * OK now working * Fix vetting issues * Fix lint * Fix tests * change default logging to match current gitea * Improve log testing Signed-off-by: Andrew Thornton <art27@cantab.net> * reset error skip levels to 0 * Update documentation and access logger configuration * Redirect the router log back to gitea if redirect macaron log but also allow setting the log level - i.e. TRACE * Fix broken level caching * Refactor the router log * Add Router logger * Add colorizing options * Adjust router colors * Only create logger if they will be used * update app.ini.sample * rename Attribute ColorAttribute * Change from white to green for function * Set fatal/error levels * Restore initial trace logger * Fix Trace arguments in modules/auth/auth.go * Properly handle XORMLogger * Improve admin/config page * fix fmt * Add auto-compression of old logs * Update error log levels * Remove the unnecessary skip argument from Error, Fatal and Critical * Add stacktrace support * Fix tests * Remove x/sync from vendors? * Add stderr option to console logger * Use filepath.ToSlash to protect against Windows in tests * Remove prefixed underscores from names in colors.go * Remove not implemented database logger This was removed from Gogs on 4 Mar 2016 but left in the configuration since then. * Ensure that log paths are relative to ROOT_PATH * use path.Join * rename jsonConfig to logConfig * Rename "config" to "jsonConfig" to make it clearer * Requested changes * Requested changes: XormLogger * Try to color the windows terminal If successful default to colorizing the console logs * fixup * Colorize initially too * update vendor * Colorize logs on default and remove if this is not a colorizing logger * Fix documentation * fix test * Use go-isatty to detect if on windows we are on msys or cygwin * Fix spelling mistake * Add missing vendors * More changes * Rationalise the ANSI writer protection * Adjust colors on advice from @0x5c * Make Flags a comma separated list * Move to use the windows constant for ENABLE_VIRTUAL_TERMINAL_PROCESSING * Ensure matching is done on the non-colored message - to simpify EXPRESSION
* Don't Unescape redirect_to cookie value (#6399)mrsdizzie2019-03-201-5/+4
| | | | | | | redirect_to holds a value that we want to redirect back to after login. This value can be a path with intentonally escaped values and we should not unescape it. Fixes #4475
* Minor UI tweaks (#5980)John Olheiser2019-02-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove all CommitStatus when a repo is deleted Signed-off-by: jolheiser <john.olheiser@gmail.com> * Minor UI tweaks (#5782) Added 'No License' option Added link and octicon change for external issue trackers Reset password now notifies right away if the code is invalid Signed-off-by: jolheiser <john.olheiser@gmail.com> * More UI tweaks More info in PR * Generate stylesheet for arc-green * Make gofmt work * Change PR integration since the button is changed * Rebase * Generate stylesheet * UI updates Made the PR button a "basic" button Vertically centered the issue checkboxes Labels will update only once after modal is closed * Commit to reference related issues Resolves #5782 Resolves #5861 Addresses original question in #5993 * Change the comment wording since PR button is no longer little and green. * Revert changes that made Windows work * Regenerate stylesheet * Regenerate stylesheets * make generate-stylesheets * Update integration again, changed button style Signed-off-by: jolheiser <john.olheiser@gmail.com> * Added ID to PR button Changed integration to use the ID to avoid breaking in the future * Added missing semi-colons * Added back distinction between issue actions and filters (overlooked it before) Moved action button over next to other action dropdowns * Remove extra tab formatting in list.tmpl * Remove more formatting from GoLand * Replace hardcoded "No License" with i18n license helper.
* Fix prohibit login check on authorization (#6106)Lunny Xiao2019-02-191-0/+13
| | | | | | | | | | | | * fix bug prohibit login not applied on dashboard * fix tests * fix bug user status leak * fix typo * return after render
* Block registration based on email domain (#5157)Lanre Adelowo2018-11-141-0/+5
| | | * implement email domain whitelist
* UX of link account (Step 1) (#5006)AJ ONeal2018-10-281-2/+24
| | | | | | | | | | | | | | * Show either sign up OR sign in * disambiguate fresh start from adding recovery options * use tabs to switch between account link flows * add active to tab body as well * changes as per discussion * handle specific error; fix missing err typo
* Force user to change password (#4489)Lanre Adelowo2018-09-131-1/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * redirect to login page after successfully activating account * force users to change password if account was created by an admin * force users to change password if account was created by an admin * fixed build * fixed build * fix pending issues with translation and wrong routes * make sure path check is safe * remove unneccessary newline * make sure users that don't have to view the form get redirected * move route to use /settings prefix so as to make sure unauthenticated users can't view the page * update as per @lafriks review * add necessary comment * remove unrelated changes * support redirecting to location the user actually want to go to before being forced to change his/her password * run make fmt * added tests * improve assertions * add assertion * fix copyright year Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
* Make cookies HttpOnly and obey COOKIE_SECURE flag (#4706)SagePtr2018-08-141-16/+16
|
* log user in after a successful sign up (#4615)Lanre Adelowo2018-08-111-1/+2
|
* Switch plaintext scratch tokens to use hash instead (#4331)techknowlogick2018-07-271-1/+5
|
* Add flash message after an account has been successfully activated (#4510)Lanre Adelowo2018-07-251-0/+1
| | | | * added new locale text
* Redirect to correct page after using scratch token (#4458)techknowlogick2018-07-191-1/+2
|
* Add Recaptcha functionality to Gitea (#4044)Fluf2018-07-051-2/+33
|
* Fix open redirect vulnerability on login screen (#4312)Jonas Franz2018-06-261-1/+2
| | | | | | | | | | | | | | * Fix open redirect vulnerability on login screen Signed-off-by: Jonas Franz <info@jonasfranz.software> * Reorder imports Signed-off-by: Jonas Franz <info@jonasfranz.software> * Replace www. from Domain too Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add support for FIDO U2F (#3971)Jonas Franz2018-05-191-5/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for U2F Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add vendor library Add missing translations Signed-off-by: Jonas Franz <info@jonasfranz.software> * Minor improvements Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F support for Firefox, Chrome (Android) by introducing a custom JS library Add U2F error handling Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F login page to OAuth Signed-off-by: Jonas Franz <info@jonasfranz.software> * Move U2F user settings to a separate file Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add unit tests for u2f model Renamed u2f table name Signed-off-by: Jonas Franz <info@jonasfranz.software> * Fix problems caused by refactoring Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F documentation Signed-off-by: Jonas Franz <info@jonasfranz.software> * Remove not needed console.log-s Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add default values to app.ini.sample Add FIDO U2F to comparison Signed-off-by: Jonas Franz <info@jonasfranz.software>
* issue-2768: added new option allow_only_external_registration (#3910)FabioFortini2018-05-131-1/+2
|
* Added user language setting (#3875)kolaente2018-05-051-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Added user language setting * Added translation string for setting * Fixed import order + typo * improved checking if the user has a language saved in the db * The current saved language is now set a default inside the dropdown * fmt * When a user signs in and doesn't have a language saved, the current browser language is saved * updated gitea-sdk * Merge branch 'master' of https://github.com/go-gitea/gitea into save-user-language # Conflicts: # models/migrations/migrations.go # models/migrations/v62.go * Made tests work again * trigger CI * trigger CI * fmt * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * re-trigger that FUCKING CI SO IT REALLY PICKS UP THE LATEST COMMIT ISTEAD OF PREDENDING TO DO SO * When loggin in, only the language col gets updated instead of everything
* Do not allow to reuse TOTP passcode (#3878)Lauris BH2018-05-021-1/+7
|
* Refactor and simplify redirect to url (#3674)Lauris BH2018-03-151-8/+4
|
* Cleanup models.User.HashPassword (#3334)Kim "BKC" Carlbäcker2018-01-121-2/+1
|
* Handle refactor (#3339)Morgan Bazalgette2018-01-101-44/+44
| | | | | | * Replace all ctx.Handle with ctx.ServerError or ctx.NotFound * Change Handle(403) to NotFound, avoid using macaron's NotFound
* Change EncodePasswd to HashPassword (#3329)Morgan Bazalgette2018-01-081-1/+1
| | | | | | * Change EncodePasswd to HashPassword * Create test+benchmark for HashPassword
* Apply LANDING_PAGE config options for logged in users (#2894)schaffman52017-11-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to logged in users and added switch for 'organizations' in addition to 'home' and 'explore'. * Updated comments. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Extended LANDINGPAGE config variable to trigger when user logs in and added switch for 'organizations' in addition to 'home' and 'explore'. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Removed superfluous conditional and correct whitespace. Signed-off-by: Mike Schaffer <mschaff@gmail.com> * Update app.ini Reverted new line. * Formatting. Signed-off-by: Mike Schaffer <mschaff@gmail.com>
* Log failed authentication attempts with remote address for fail2ban (#2334)David Schneiderbauer2017-08-241-0/+2
| | | Signed-off-by: David Schneiderbauer <dschneiderbauer@gmail.com>
* Only update needed columns when update user (#2296)Lunny Xiao2017-08-121-8/+10
| | | | | | * only update needed columns when update user * fix missing update_unix column
* Make time diff translatable (#2057)Lauris BH2017-06-281-5/+5
|
* xxx_active_code_live setting in printed in hours and minutes instead … (#1814)Jonas Östanbäck2017-05-291-5/+5
| | | | | | * xxx_active_code_live setting in printed in hours and minutes instead of just hours * Update app.ini description of xxx_code_lives settings
* Add new text for reset password flash (#1718)Jonas Östanbäck2017-05-141-2/+2
| | | | | * Forgot password should use ResetPwdCodeLives, not ActiveCodeLives * Improve documentation for different send mail functions related to password reset * Improve documentation in conf/app.ini regarding xxx_CODE_LIVE_MINUTES settings
* Additional OAuth2 providers (#1010)Willem van Dreumel2017-05-011-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add google+ * sort signin oauth2 providers based on the name so order is always the same * update auth tip for google+ * add gitlab provider * add bitbucket provider (and some go fmt) * add twitter provider * add facebook provider * add dropbox provider * add openid connect provider incl. new format of tips section in "Add New Source" * lower the amount of disk storage for each session to prevent issues while building cross platform (and disk overflow) * imports according to goimport and code style * make it possible to set custom urls to gitlab and github provider (only these could have a different host) * split up oauth2 into multiple files * small typo in comment * fix indention * fix indentation * fix new line before external import * fix layout of signin part * update "broken" dependency
* Reduce conditionals in signin/signup inner formsSandro Santilli2017-03-201-4/+9
| | | | by always using SignInLink and SignUpLink in the form action
* Login via OpenID-2.0 (#618)Sandro Santilli2017-03-171-1/+9
|
* Rename /forget_password url to /forgot_passwordSandro Santilli2017-03-141-2/+2
| | | | | | | | | Also renames `forgot_password` translation key to `forgot_password_title` and `forget_password` to `forgot_password` Includes entry in CHANGELOG about the breaking change (and some markdown fixes in there)
* Show a link to password reset from password change and delete account (#862)Sandro Santilli2017-03-111-0/+3
| | | | | | | It's helpful when you forgot your password thus cannot change it (can happen if you log in via OAuth2 or OpenID) Also make sure that both the delete-account and password-change links to forgot-password will have the primary email pre-filled
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-12 02:02:35 +0000