aboutsummaryrefslogtreecommitdiffstats
path: root/routers/user
Commit message (Collapse)AuthorAgeFilesLines
* Make modules/context.Context a context.Context (#16031)zeripath2021-05-313-9/+9
| | | | | | | | | | | | | | | * Make modules/context.Context a context.Context Signed-off-by: Andrew Thornton <art27@cantab.net> * Simplify context calls Signed-off-by: Andrew Thornton <art27@cantab.net> * Set the base context for requests to the HammerContext Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix goth user infer bug (#15821)Lunny Xiao2021-05-101-5/+10
|
* Use single shared random string generation function (#15741)silverwind2021-05-101-2/+2
| | | | | | | | | | | | | | | | | | * Use single shared random string generation function - Replace 3 functions that do the same with 1 shared one - Use crypto/rand over math/rand for a stronger RNG - Output only alphanumerical for URL compatibilty Fixes: #15536 * use const string method * Update modules/avatar/avatar.go Co-authored-by: a1012112796 <1012112796@qq.com> Co-authored-by: a1012112796 <1012112796@qq.com>
* Allow only internal registration (#15795)65432021-05-092-3/+11
| | | | | * Add ALLOW_ONLY_INTERNAL_REGISTRATION into settings * OpenID respect setting too
* Feature/oauth userinfo (#15721)N. L. H2021-05-061-0/+73
| | | | | | | | | | | | | | | | | | | | | | * Implemented userinfo #8534 * Make lint happy * Add userinfo endpoint to openid-configuration * Give an error when uid equals 0 * Implemented BearerTokenErrorCode handling * instead of ctx.error use ctx.json so that clients parse error and error_description correctly * Removed unneeded if statement * Use switch instead of subsequent if statements Have a default for unknown errorcodes. Co-authored-by: Nils Hillmann <hillmann@nlh-software.de> Co-authored-by: nlhsoftware <nlhsoftware@noreply.localhost>
* Fixed several activation bugs (#15473)KN4CK3R2021-04-301-5/+36
| | | | | | | | | | | * Removed unneeded form tag. * Fixed typo. * Fixed NPE. * Use better error page. * Splitted GET and POST.
* add `/assets` as root dir of public files (#15219)a10121127962021-04-281-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | * add `/assets` as root dir of public files Signed-off-by: a1012112796 <1012112796@qq.com> * move serviceworker.js * make fmt * fix some link * fix test * Apply suggestions from code review Co-authored-by: silverwind <me@silverwind.io> * Apply suggestions from code review Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Refactor renders (#15175)Lunny Xiao2021-04-192-2/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactor renders * Some performance optimization * Fix comment * Transform reader * Fix csv test * Fix test * Fix tests * Improve optimaziation * Fix test * Fix test * Detect file encoding with reader * Improve optimaziation * reduce memory usage * improve code * fix build * Fix test * Fix for go1.15 * Fix render * Fix comment * Fix lint * Fix test * Don't use NormalEOF when unnecessary * revert change on util.go * Apply suggestions from code review Co-authored-by: zeripath <art27@cantab.net> * rename function * Take NormalEOF back Co-authored-by: zeripath <art27@cantab.net>
* add well-known config for OIDC (#15355)techknowlogick2021-04-151-0/+10
| | | | | | | | | | | | | | * add well-known config for OIDC * spacing per feedback * Update oidc_wellknown.tmpl * add id_token * Update oidc_wellknown.tmpl Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Performance improvement for list pull requests (#15447)Lunny Xiao2021-04-151-5/+5
|
* Disable Stars config option (#14653)Kyle D2021-04-151-0/+21
| | | | | | | * Add config option to disable stars * Replace "stars" with watched in user profile * Add documentation
* OAuth2 auto-register (#5123)Martin Michaelis2021-04-142-132/+182
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactored handleOAuth2SignIn in routers/user/auth.go The function handleOAuth2SignIn was called twice but some code path could only be reached by one of the invocations. Moved the unnecessary code path out of handleOAuth2SignIn. * Refactored user creation There was common code to create a user and display the correct error message. And after the creation the only user should be an admin and if enabled a confirmation email should be sent. This common code is now abstracted into two functions and a helper function to call both. * Added auto-register for OAuth2 users If enabled new OAuth2 users will be registered with their OAuth2 details. The UserID, Name and Email fields from the gothUser are used. Therefore the OpenID Connect provider needs additional scopes to return the coresponding claims. * Added error for missing fields in OAuth2 response * Linking and auto linking on oauth2 registration * Set default username source to nickname * Add automatic oauth2 scopes for github and google * Add hint to change the openid connect scopes if fields are missing * Extend info about auto linking security risk Co-authored-by: Viktor Kuzmin <kvaster@gmail.com> Signed-off-by: Martin Michaelis <code@mgjm.de>
* Prevent NPE on avatar direct rendering if federated avatars disabled (#15434)zeripath2021-04-121-2/+17
| | | | | | | | | | #13649 assumed that direct avatar urls would always be libravatar urls - this leads to NPEs if federated avatar service is disabled. Fix #15421 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Code Formats, Nits & Unused Func/Var deletions (#15286)65432021-04-091-3/+0
| | | | | | | | | | | | | | | * _ to unused func options * rm useless brakets * rm trifial non used models functions * rm dead code * rm dead global vars * fix routers/api/v1/repo/issue.go * dont overload import module
* Add dashboard milestone search and repo milestone search by name (#14866)Roger Luo2021-04-081-5/+8
| | | | | Feature for issue #13845: - Add milestones search by name on dashboard milestones page. - Add milestones search by name on repo issue/milestones page.
* Move modules/forms to services/forms (#15305)zeripath2021-04-0612-53/+53
| | | | | | | | | | | Forms are dependent on models and therefore should be in services. This PR also removes the old auth. aliasing Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* [refactor] replace int with httpStatusCodes (#15282)65432021-04-0515-83/+102
| | | | | | | | | | | * replace "200" (int) with "http.StatusOK" (const) * ctx.Error & ctx.HTML * ctx.JSON Part1 * ctx.JSON Part2 * ctx.JSON Part3
* [refactor] mailer service (#15072)65432021-04-022-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Unexport SendUserMail * Instead of "[]*models.User" or "[]string" lists infent "[]*MailRecipient" for mailer * adopt * code format * TODOs for "i18n" * clean * no fallback for lang -> just use english * lint * exec testComposeIssueCommentMessage per lang and use only emails * rm MailRecipient * Dont reload from users from db if you alredy have in ram * nits * minimize diff Signed-off-by: 6543 <6543@obermui.de> * localize subjects * linter ... * Tr extend * start tmpl edit ... * Apply suggestions from code review * use translation.Locale * improve mailIssueCommentBatch Signed-off-by: Andrew Thornton <art27@cantab.net> * add i18n to datas Signed-off-by: Andrew Thornton <art27@cantab.net> * a comment Co-authored-by: Andrew Thornton <art27@cantab.net>
* Validate email in oauth registration form (#15014)Kyle D2021-03-171-0/+5
|
* Show correct issues for team dashboard (#14952)Norwin2021-03-121-3/+3
| | | | | | | | | | | | | | * fix no items under /org/$org/{issues,pulls}?type=mentioned it was filtering by org id, but org-mentions are not persisted like that to the DB, we need to filter by UID. This means, selecting different teams will only have an effect on the selected repos, otherwise results will be the same, which may be suboptimal. fixes #14941 * don't spam a warning for a perfectly fine request
* Add SameSite setting for cookies (#14900)zeripath2021-03-073-21/+24
| | | | | | | | | Add SameSite setting for cookies and rationalise the cookie setting code. Switches SameSite to Lax by default. There is a possible future extension of differentiating which cookies could be set at Strict by default but that is for a future PR. Fix #5583 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Show private heatmap on profile to self & admins (#14881)Norwin2021-03-042-6/+2
| | | followup to #14080
* Migrate to use jsoniter instead of encoding/json (#14841)zeripath2021-03-011-1/+2
| | | | | | | | | | * Migrate to use jsoniter * fix tests * update gitea.com/go-chi/binding Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Set HCaptchaSiteKey on Link Account pages (#14834)zeripath2021-02-281-0/+3
| | | | | | | | | | When using HCaptcha on link account pages the site key needs to be passed in. This PR ensures that HCaptchaSiteKey is set in the data. Fix #14766 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Heatmap days clickable (#13935)gordon--2021-02-202-0/+2
| | | | | | | | | | | | | | | | * Heatmap days clickable * Error handling * Unselect filter * better dayclick handler * made linter happy * clickable heatmap for profiles Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Clarify the suffices and prefixes of setting.AppSubURL and setting.AppURL ↵zeripath2021-02-191-1/+1
| | | | | | | | (#12999) Also removes some unnecessary uses of fmt.Sprintf and adds documentation strings Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow blocking some email domains from registering an account (#14667)Damien Goutte-Gattat2021-02-151-1/+1
| | | | | | | | | Gitea allows to whitelist email domains so that only email addresses from certain domains are allowed to register an account, but does not currently allows to do the opposite: blacklisting email domains so that addresses from certain domains are *forbidden* to register an account. The idea has been briefly mentioned in the discussion about issue #6350, but never implemented. This PR does that. The rationale is that, in my experience of running a Gitea instance, *a single email domain* is responsible for *most* of the spam accounts, and for *all* of the spam accounts that manage to get past the email confirmation step. So on top of the other spam mitigation measures already available (email confirmation, CAPTCHA, etc.), having the option to block a particularly annoying domain would be helpful. close #13628
* Honor REGISTER_MANUAL_CONFIRM when doing openid registration (#14548)Michel Ganguin2021-02-051-1/+1
| | | | | REGISTER_MANUAL_CONFIRM is not honored when doing performing an openid registration. The new account is directly accessible. With this patch, the manual confirm flag gets honored in the same way as a "normal" registration.
* Fix captcha (#14488)Lunny Xiao2021-01-272-0/+7
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
* Move macaron to chi (#14293)Lunny Xiao2021-01-2612-63/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | Use [chi](https://github.com/go-chi/chi) instead of the forked [macaron](https://gitea.com/macaron/macaron). Since macaron and chi have conflicts with session share, this big PR becomes a have-to thing. According my previous idea, we can replace macaron step by step but I'm wrong. :( Below is a list of big changes on this PR. - [x] Define `context.ResponseWriter` interface with an implementation `context.Response`. - [x] Use chi instead of macaron, and also a customize `Route` to wrap chi so that the router usage is similar as before. - [x] Create different routers for `web`, `api`, `internal` and `install` so that the codes will be more clear and no magic . - [x] Use https://github.com/unrolled/render instead of macaron's internal render - [x] Use https://github.com/NYTimes/gziphandler instead of https://gitea.com/macaron/gzip - [x] Use https://gitea.com/go-chi/session which is a modified version of https://gitea.com/macaron/session and removed `nodb` support since it will not be maintained. **BREAK** - [x] Use https://gitea.com/go-chi/captcha which is a modified version of https://gitea.com/macaron/captcha - [x] Use https://gitea.com/go-chi/cache which is a modified version of https://gitea.com/macaron/cache - [x] Use https://gitea.com/go-chi/binding which is a modified version of https://gitea.com/macaron/binding - [x] Use https://github.com/go-chi/cors instead of https://gitea.com/macaron/cors - [x] Dropped https://gitea.com/macaron/i18n and make a new one in `code.gitea.io/gitea/modules/translation` - [x] Move validation form structs from `code.gitea.io/gitea/modules/auth` to `code.gitea.io/gitea/modules/forms` to avoid dependency cycle. - [x] Removed macaron log service because it's not need any more. **BREAK** - [x] All form structs have to be get by `web.GetForm(ctx)` in the route function but not as a function parameter on routes definition. - [x] Move Git HTTP protocol implementation to use routers directly. - [x] Fix the problem that chi routes don't support trailing slash but macaron did. - [x] `/api/v1/swagger` now will be redirect to `/api/swagger` but not render directly so that `APIContext` will not create a html render. Notices: - Chi router don't support request with trailing slash - Integration test `TestUserHeatmap` maybe mysql version related. It's failed on my macOS(mysql 5.7.29 installed via brew) but succeed on CI. Co-authored-by: 6543 <6543@obermui.de>
* Redirect on changed user and org name (#11649)Andrew Bezold2021-01-241-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add redirect for user * Add redirect for orgs * Add user redirect test * Appease linter * Add comment to DeleteUserRedirect function * Fix locale changes * Fix GetUserByParams * Fix orgAssignment * Remove debug logging * Add redirect prompt * Dont Export DeleteUserRedirect & only use it within a session * Unexport newUserRedirect * cleanup * Fix & Dedub API code * Format Template * Add Migration & rm dublicat * Refactor: unexport newRepoRedirect() & rm dedub del exec * if this fails we'll need to re-rename the user directory Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Enhance Ghost comment mitigation Settings (#14392)65432021-01-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | * refactor models.DeleteComment and delete related reactions too * use deleteComment for UserDeleteWithCommentsMaxDays in DeleteUser * nits * Use time.Duration as other time settings have * docs * Resolve Fixme & fix potential deadlock * Disabled by Default * Update Config Value Description * switch args * Update models/issue_comment.go Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* load U2F js only on pages which need it (#11585)Kamil Domański2021-01-201-1/+1
| | | | | | * load U2F js only on pages which need it * Update templates/base/head.tmpl
* Display error if twofaSecret cannot be retrieved (#14372)Ash McKenzie2021-01-181-1/+8
|
* Allow passcode invalid error to appear (#14371)Ash McKenzie2021-01-181-1/+1
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Implement ghost comment mitigation (#14349)65432021-01-171-0/+6
| | | | | | | | | | | | | * Implement ghost comment mitigation Adds a config option USER_DELETE_WITH_COMMENTS_MAX_DAYS to the [service] section. See https://codeberg.org/Codeberg/Discussion/issues/24 for the underlying issue. * cleanup * use setting module correctly * add to docs Co-authored-by: Moritz Marquardt <git@momar.de>
* Add review requested filter on pull request overview (#13701)Jimmy Praet2021-01-171-1/+5
| | | | | | | | | | | | | * Add review requested filter on pull request overview #13682 fix formatting * add review_requested filter to /repos/issues/search API endpoint * only Approve and Reject status should supersede Request status * add support for team reviews * refactor: remove duplication of issue filtering conditions
* Issues overview should not show issues from archived repos (#13220)Elena Neuschild2021-01-122-149/+313
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add lots of comments to user.Issues() * Answered some questions from comments * fix typo in comment * Refac user.Issues(): add func repoIDs * Refac user.Issues(): add func userRepoIDs * Refac user.Issues(): add func issueIDsFromSearch * Refac user.Issues(): improve error handling * Refac user.Issues(): add inline documentation and move variable declarations closer to their usages * Refac user.Issues(): add func repoIDMap * Refac user.Issues(): cleanup * Refac: Separate Issues from Pulls during routing * fix typo in comment * Adapt Unittests to Refactoring * Issue13171: Issue and PR Overviews now ignore archived Repositories * changed some verbatim SQL conditions to builder.Eq * models/issue.go: use OptionalBool properly Co-authored-by: 6543 <6543@obermui.de> * Use IsArchived rather than ExcludeArchivedRepos * fixed broken test after merge * added nil check * Added Unit Test securing Issue 13171 fix * Improved IsArchived filtering in issue.GetUserIssueStats * Removed unused func * Added grouping to avoid returning duplicate repo IDs Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Gitea <gitea@fake.local> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* [Refactor] Passwort Hash/Set (#14282)65432021-01-102-6/+3
| | | | | | | | | * move SaltGeneration into HashPasswort and rename it to what it does * Migration: Where Password is Valid with Empty String delete it * prohibit empty password hash * let SetPassword("") unset pwd stuff
* Add option to change username to the admin panel (#14229)65432021-01-101-19/+17
| | | | | Co-authored-by: Bwko <bouwko@gmail.com> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: zeripath <art27@cantab.net>
* Check permission for the appropriate unit type (#14261)Jimmy Praet2021-01-061-2/+2
| | | | | | | | | * Check permission for the appropriate unit type Fixes false positives for "User created Issues in Repository which they no longer have access to" errors * change log level to Debug Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Issue and pull request filters on organization dashboard #14052 (#14072)Jimmy Praet2021-01-031-22/+31
|
* Fix dashboard issues labels filter bug (#14210)Lunny Xiao2021-01-011-0/+4
| | | Co-authored-by: zeripath <art27@cantab.net>
* Minimal OpenID Connect implementation (#14139)Johnny Oskarsson2021-01-021-4/+49
| | | | | | | | | | | | | | | | | | | | | | | | | This is "minimal" in the sense that only the Authorization Code Flow from OpenID Connect Core is implemented. No discovery, no configuration endpoint, and no user scope management. OpenID Connect is an extension to the (already implemented) OAuth 2.0 protocol, and essentially an `id_token` JWT is added to the access token endpoint response when using the Authorization Code Flow. I also added support for the "nonce" field since it is required to be used in the id_token if the client decides to include it in its initial request. In order to enable this extension an OAuth 2.0 scope containing "openid" is needed. Other OAuth 2.0 requests should not be impacted by this change. This minimal implementation is enough to enable single sign-on (SSO) for other sites, e.g. by using something like `mod_auth_openidc` to only allow access to a CI server if a user has logged into Gitea. Fixes: #1310 Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Check for notExist on profile repository page (#14197)zeripath2020-12-311-0/+3
| | | Fix #14189
* Team dashboards (#14159)Jimmy Praet2020-12-271-31/+37
|
* Disable SSH key deletion of externally managed Keys (#13985)zeripath2020-12-251-1/+19
| | | | | | | | | | | | | | | | * Disable SSH key addition and deletion when externally managed When a user has a login source which has SSH key management key addition and deletion using the UI should be disabled. Fix #13983 Signed-off-by: Andrew Thornton <art27@cantab.net> * Make only externally managed keys disabled Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix creating OAuth2 auth source from CLI (#14116)Daniil Pankratov2020-12-241-2/+11
| | | | | | | | Fix creation OAuth2 auth source from CLI. Fix #8356 Co-authored-by: Daniil Pankratov <daniil.pankratov@t-systems.com>
* rework heatmap permissions (#14080)Norwin2020-12-222-2/+2
| | | | | | | | | | | | | | | | * now uses the same permission model as for the activity feed: only include activities in repos, that the doer has access to. this might be somewhat slower. * also improves handling of user.KeepActivityPrivate (still shows the heatmap to self & admins) * extend tests * adjust integration test to new behaviour * add access to actions for admins * extend heatmap unit tests
* Show dropdown with all statuses for commit (#13977)Cirno the Strongest2020-12-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Show dropdown with all statuses for commit * Use popups * Remove unnecessary change * Style popup * Use divided list * As per @silverwind * Refactor GetLastCommitStatus * Missing dropdown on repo home and commit page * Fix tests * Make status icon be a part of a link on PR list * Fix missing translation call * Indent fix Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-19 21:15:55 +0000