summaryrefslogtreecommitdiffstats
path: root/routers/web/user
Commit message (Collapse)AuthorAgeFilesLines
...
* Support pagination of organizations on user settings pages (#16083)Lunny Xiao2021-11-222-4/+29
| | | | | | * Add pagination for user setting orgs * Use FindOrgs instead of GetOrgsByUserID * Remove unnecessary functions and fix test * remove unnecessary code
* Reset locale on login (#17734)zeripath2021-11-201-0/+4
| | | | | | | | | When logging in reset the user's locale to ensure that it matches their preferred locale. Fix #15612 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Use a standalone struct name for Organization (#17632)Lunny Xiao2021-11-192-9/+9
| | | | | | | | | | | | | | | | | | | | | * Use a standalone struct name for Organization * recover unnecessary change * make the code readable * Fix template failure * Fix template failure * Move HasMemberWithUserID to org * Fix test * Remove unnecessary user type check * Fix test Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Move user/org deletion to services (#17673)KN4CK3R2021-11-191-1/+2
|
* Move user follow and openid into models/user/ (#17613)Lunny Xiao2021-11-174-17/+19
| | | | | | | | | | | | | | | | | | | | | | | * Move UserRedirect into models/user/ * Fix lint & test * Fix lint * Fix lint * remove nolint comment * Fix lint * Move user follow and openid into models/user * Ignore the lint * Ignore the lint * Fix test * ignore stutters lint on UserOpenID
* Multiple Escaping Improvements (#17551)zeripath2021-11-164-6/+5
| | | | | | | | | | | | | | There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move some functions into services/repository (#17660)Lunny Xiao2021-11-161-3/+3
|
* Decouple unit test, remove intermediate `unittestbridge` package (#17662)wxiaoguang2021-11-161-2/+1
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove unnecassary calls to `filepath.Join` (#17608)Gusted2021-11-152-2/+2
| | | | | | | | | | | - Partialy resolvess #17596 - Resolves `badCall` errors from go-critic `badCall: suspicious Join on 1 argument` - When only 1 argument is passed into `filepath.Join`, it won't do anything special other than `filepath.Clean(...)` will be applied over it. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* Correctly handle failed migrations (#17575)zeripath2021-11-131-0/+7
| | | | | | | | | | | | | | * Correctly handle failed migrations There is a bug in handling failed migrations whereby the migration task gets decoupled from the migration repository. This leads to a failure of the task to get deleted with the repository and also leads to the migration failed page resulting in a ISE. This PR removes the zeroing out of the task id from the migration but also makes the migration handler tolerate missing tasks much nicer. Fix #17571 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Decouple unit test code from business code (#17623)wxiaoguang2021-11-125-13/+14
|
* Move EmailAddress & UserRedirect into models/user/ (#17607)Lunny Xiao2021-11-114-17/+21
| | | | | | | | | | | | | | | | | | | | | * Move EmailAddress into models/user/ * Fix test * rename user_mail to user_email * Fix test * Move UserRedirect into models/user/ * Fix lint & test * Fix lint * Fix lint * remove nolint comment * Fix lint
* Move unit into models/unit/ (#17576)Lunny Xiao2021-11-091-10/+11
| | | | | * Move unit into models/unit/ * Rename unit.UnitType as unit.Type
* Allow U2F 2FA without TOTP (#11573)Kamil Domański2021-11-082-25/+44
| | | | | | | This change enables the usage of U2F without being forced to enroll an TOTP authenticator. The `/user/auth/u2f` has been changed to hide the "use TOTP instead" bar if TOTP is not enrolled. Fixes #5410 Fixes #17495
* Simplify Gothic to use our session store instead of creating a different ↵zeripath2021-11-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | store (#17507) * Simplify Gothic to use our session store instead of creating a different store We have been using xormstore to provide a separate session store for our OAuth2 logins however, this relies on using gorilla context and some doubling of our session storing. We can however, simplify and simply use our own chi-based session store. Thus removing a cookie and some of the weirdness with missing contexts. Signed-off-by: Andrew Thornton <art27@cantab.net> * as per review Signed-off-by: Andrew Thornton <art27@cantab.net> * as per review Signed-off-by: Andrew Thornton <art27@cantab.net> * Handle MaxTokenLength Signed-off-by: Andrew Thornton <art27@cantab.net> * oops Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* Add appearance section in settings (#17433)qwerty2872021-10-272-36/+66
| | | | | | | | | | | | | * Add appearance section in settings * Fix lint * Fix lint * Apply suggestions from code review Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lauris BH <lauris@nix.lv>
* Add groups scope/claim to OIDC/OAuth2 Provider (#17367)Nico Schieder2021-10-221-5/+50
| | | | | | | | | | | * Add groups scope/claim to OICD/OAuth2 Add support for groups claim as part of the OIDC/OAuth2 flow. Groups is a list of "org" and "org:team" strings to allow clients to authorize based on the groups a user is part of. Signed-off-by: Nico Schieder <code@nico-schieder.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix dashboard repolist alignment and repolisting (#17355)zeripath2021-10-191-0/+6
| | | | | | | | | | | | | | Unfortunately #17301 broke the restriction of the dashboard repolist to the user's repos because it stopped passing in the uid for the current user. This PR restores this. There is also a weird alignment problem - not caused by that PR - where the menu items in the repolist spread over multiple lines. This PR simply reduces the padding on these items and switches the justification of the flex elements to space-evenly. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add RSS/Atom feed support for user actions (#16002)65432021-10-162-38/+34
| | | Return rss/atom feed for user based on rss url suffix or Content-Type header.
* Update documents for Gitea behind reverse proxy. Fix some small bugs (some ↵wxiaoguang2021-10-151-1/+2
| | | | | | | | | | | URLs are generated without sub-path) (#17320) * Apache `ProxyPassReverse` only works for Location, Content-Location and URI headers on HTTP redirect responses, it causes more problems than it resolves. Now all URLs generated by Gitee have the correct prefix AppSubURL. We do not need to set `ProxyPassReverse`. * fix url param * use AppSubURL instead of AppURL in api/v1 Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Frontend refactor: move Vue related code from `index.js` to `components` ↵wxiaoguang2021-10-151-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dir, and remove unused codes. (#17301) * frontend refactor * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Update templates/base/head.tmpl Co-authored-by: delvh <dev.lh@web.de> * Update docs/content/doc/developers/guidelines-frontend.md Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> * fix typo * fix typo * refactor PageData to pageData * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Simply for the visual difference. Co-authored-by: delvh <dev.lh@web.de> * Revert "Apply suggestions from code review" This reverts commit 4d78ad9b0e96ca180e0823de17659a2e0814c099. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* Don't panic if we fail to parse U2FRegistration data (#17304)David Jimenez2021-10-141-1/+1
| | | | | | | | | * Don't panic if we fail to parse a U2FRegistration data Downgrade logging statement from Fatal to Error so that errors parsing U2FRegistration data does not panic; instead, the invalid key will be skipped and we will attempt to parse the next one, if available. Signed-off-by: David Jimenez <dvejmz@sgfault.com>
* AutoRegistration is supposed to be working with disabled registration (#17219)Viktor Kuzmin2021-10-111-1/+1
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
* Avatar refactor, move avatar code from `models` to `models.avatars`, remove ↵wxiaoguang2021-10-061-67/+17
| | | | | | | | | | | | | | | | duplicated code (#17123) Why this refactor The goal is to move most files from `models` package to `models.xxx` package. Many models depend on avatar model, so just move this first. And the existing logic is not clear, there are too many function like `AvatarLink`, `RelAvatarLink`, `SizedRelAvatarLink`, `SizedAvatarLink`, `MakeFinalAvatarURL`, `HashedAvatarLink`, etc. This refactor make everything clear: * user.AvatarLink() * user.AvatarLinkWithSize(size) * avatars.GenerateEmailAvatarFastLink(email, size) * avatars.GenerateEmailAvatarFinalLink(email, size) And many duplicated code are deleted in route handler, the handler and the model share the same avatar logic now.
* Fix wrong i18n keys (#17150)Lunny Xiao2021-09-252-5/+5
| | | Co-authored-by: 6543 <6543@obermui.de>
* Move twofactor to models/login (#17143)Lunny Xiao2021-09-254-43/+43
|
* Move login related structs and functions to models/login (#17093)Lunny Xiao2021-09-2410-51/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Move login related structs and functions to models/login * Fix test * Fix lint * Fix lint * Fix lint of windows * Fix lint * Fix test * Fix test * Only load necessary fixtures when preparing unit tests envs * Fix lint * Fix test * Fix test * Fix error log * Fix error log * Fix error log * remove unnecessary change * fix error log * merge main branch
* refactor: move from io/ioutil to io and os package (#17109)Eng Zer Jun2021-09-222-5/+4
| | | | | | | | | The io/ioutil package has been deprecated as of Go 1.16, see https://golang.org/doc/go1.16#ioutil. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Move db related basic functions to models/db (#17075)Lunny Xiao2021-09-196-14/+17
| | | | | | | | | | | | | | | | | | | | | | | | | * Move db related basic functions to models/db * Fix lint * Fix lint * Fix test * Fix lint * Fix lint * revert unnecessary change * Fix test * Fix wrong replace string * Use *Context * Correct committer spelling and fix wrong replaced words Co-authored-by: zeripath <art27@cantab.net>
* Notifications API: respond with updated notifications (#17064)Norwin2021-09-171-1/+1
| | | | | | | | | * notifications api: return updated notifications in response * make generate-swagger * openapi fix Co-authored-by: zeripath <art27@cantab.net>
* Make LDAP be able to skip local 2FA (#16954)zeripath2021-09-173-4/+14
| | | | | | This PR extends #16594 to allow LDAP to be able to be set to skip local 2FA too. The technique used here would be extensible to PAM and SMTP sources. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add setting to OAuth handlers to skip local 2FA authentication (#16594)zeripath2021-09-101-8/+12
| | | | | | | | This PR adds a setting to OAuth and OpenID login sources to allow the source to skip local 2FA authentication. Fix #13939 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add Cache-Control to avatar redirects (#16973)silverwind2021-09-061-3/+9
| | | | | | | | | | | | | | * Add Cache-Control to avatar redirects This does seem to do the trick to make the Avatar redirects cachable in Chrome. In Firefox, it does not seem to work, thought and I found no way to suppress the requests to the original URLs, I even tried setting an Etag to no avail. Related discussion in https://github.com/go-gitea/gitea/issues/16964. Co-authored-by: zeripath <art27@cantab.net>
* Correctly return the number of Repositories for Organizations (#16807)zeripath2021-09-011-1/+1
| | | | | | | | | | | | | | | Calculate and return the number of Repositories on the dashboard Organization list. This PR restores some of the logic that was removed in #14032 to calculate the number of repos on the dashboard orgs list. Fix #16648 Replaces #16799 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* In Render tolerate not being passed a context (#16842)zeripath2021-08-282-0/+2
| | | | | | | | | | | | | | | | | | | * In Render tolerate not being passed a context It is possible for RenderString to be passed to an external renderer if markdown is set to be rendered by an external renderer. No context is currently sent to these meaning that this will error out. Fix #16835 Signed-off-by: Andrew Thornton <art27@cantab.net> * Add Context to Repo calls for RenderString All calls from routers can easily add the context - so add it. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Decoupled code from DefaultSigningKey (#16743)KN4CK3R2021-08-272-18/+18
| | | Decoupled code from `DefaultSigningKey`. Makes testing a little bit easier and is cleaner.
* Add EdDSA JWT signing algorithm (#16786)Aliaksandr Mianzhynski2021-08-252-2/+2
| | | | | | | | * Add EdDSA signing algorithm * Fix typo Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Added introspection endpoint. (#16752)KN4CK3R2021-08-201-55/+43
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix wrong user in OpenID response (#16736)KN4CK3R2021-08-192-10/+85
| | | | | * Fixed usage of wrong user. * Added tests.
* Related refactors to ctx.FormX functions (#16567)65432021-08-114-9/+7
| | | | | | | * use FormTrim if posible * speedup goGet * only convert if nessesary
* Rename ctx.Form() to ctx.FormString() and move code into own file (#16571)65432021-08-119-50/+50
| | | | | | | Followup from #16562 prepare for #16567 * Rename ctx.Form() to ctx.FormString() * Reimplement FormX func to need less code and cpu cycles * Move code into own file
* Add microsoft oauth2 providers (#16544)zeripath2021-08-051-4/+13
| | | | | | | | | | | | | | | | | * Clean up oauth2 providers Signed-off-by: Andrew Thornton <art27@cantab.net> * Add AzureAD, AzureADv2, MicrosoftOnline OAuth2 providers Signed-off-by: Andrew Thornton <art27@cantab.net> * Apply suggestions from code review * remove unused Scopes Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Rename context.Query to context.Form (#16562)Lunny Xiao2021-07-2914-75/+75
|
* Add agit flow support in gitea (#14295)a10121127962021-07-281-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * feature: add agit flow support ref: https://git-repo.info/en/2020/03/agit-flow-and-git-repo/ example: ```Bash git checkout -b test echo "test" >> README.md git commit -m "test" git push origin HEAD:refs/for/master -o topic=test ``` Signed-off-by: a1012112796 <1012112796@qq.com> * fix lint * simplify code add fix some nits * update merge help message * Apply suggestions from code review. Thanks @jiangxin * add forced-update message * fix lint * splite writePktLine * add refs/for/<target-branch>/<topic-branch> support also * Add test code add fix api * fix lint * fix test * skip test if git version < 2.29 * try test with git 2.30.1 * fix permission check bug * fix some nit * logic implify and test code update * fix bug * apply suggestions from code review * prepare for merge Signed-off-by: Andrew Thornton <art27@cantab.net> * fix permission check bug - test code update - apply suggestions from code review @zeripath Signed-off-by: a1012112796 <1012112796@qq.com> * fix bug when target branch isn't exist * prevent some special push and fix some nits * fix lint * try splite * Apply suggestions from code review - fix permission check - handle user rename * fix version negotiation * remane * fix template * handle empty repo * ui: fix branch link under the title * fix nits Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add an abstract json layout to make it's easier to change json library (#16528)Lunny Xiao2021-07-243-6/+4
| | | | | | | | | | | * Add an abstract json layout to make it's easier to change json library * Fix import * Fix import sequence * Fix blank lines * Fix blank lines
* switch to maintained lib (#16532)techknowlogick2021-07-241-1/+1
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Refactor: Move login out of models (#16199)zeripath2021-07-245-22/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `models` does far too much. In particular it handles all `UserSignin`. It shouldn't be responsible for calling LDAP, SMTP or PAM for signing in. Therefore we should move this code out of `models`. This code has to depend on `models` - therefore it belongs in `services`. There is a package in `services` called `auth` and clearly this functionality belongs in there. Plan: - [x] Change `auth.Auth` to `auth.Method` - as they represent methods of authentication. - [x] Move `models.UserSignIn` into `auth` - [x] Move `models.ExternalUserLogin` - [x] Move most of the `LoginVia*` methods to `auth` or subpackages - [x] Move Resynchronize functionality to `auth` - Involved some restructuring of `models/ssh_key.go` to reduce the size of this massive file and simplify its files. - [x] Move the rest of the LDAP functionality in to the ldap subpackage - [x] Re-factor the login sources to express an interfaces `auth.Source`? - I've done this through some smaller interfaces Authenticator and Synchronizable - which would allow us to extend things in future - [x] Now LDAP is out of models - need to think about modules/auth/ldap and I think all of that functionality might just be moveable - [x] Similarly a lot Oauth2 functionality need not be in models too and should be moved to services/auth/source/oauth2 - [x] modules/auth/oauth2/oauth2.go uses xorm... This is naughty - probably need to move this into models. - [x] models/oauth2.go - mostly should be in modules/auth/oauth2 or services/auth/source/oauth2 - [x] More simplifications of login_source.go may need to be done - Allow wiring in of notify registration - *this can now easily be done - but I think we should do it in another PR* - see #16178 - More refactors...? - OpenID should probably become an auth Method but I think that can be left for another PR - Methods should also probably be cleaned up - again another PR I think. - SSPI still needs more refactors.* Rename auth.Auth auth.Method * Restructure ssh_key.go - move functions from models/user.go that relate to ssh_key to ssh_key - split ssh_key.go to try create clearer function domains for allow for future refactors here. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Update notification table with only latest data (#16445)zeripath2021-07-171-0/+2
| | | | | | | | | | When marking notifications read the results may be returned out of order or be delayed. This PR sends a sequence number to gitea so that the browser can ensure that only the results of the latest notification change are shown. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* add configuration option to restrict users by default (#16256)Richard Nienaber2021-07-151-4/+5
| | | | | | | | | | | | | | | | | | * add configuration option to restrict users by default * default IsRestricted permission only set on sign up setting this in the model messes with other workflows (e.g. syncing LDAP users) where the IsRestricted permission needs to be explicitly set and not overridden by a config value * fix formatting * Apply suggestions from code review * ensure newly created user is set to restricted * ensure imports are in the correct order Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix activation of primary email addresses (#16385)Meano2021-07-132-25/+32
| | | | | | | | | | | | | | | | * fix: primary email cannot be activated * Primary email should be activated together with user account when 'RegisterEmailConfirm' is enabled. * To fix the existing error state. When 'RegisterEmailConfirm' is enabled, the admin should have permission to modify the activations status of user email. And the user should be allowed to send activation to primary email. * Only judge whether email is primary from email_address table. * Improve logging and refactor isEmailActive Co-authored-by: zeripath <art27@cantab.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-28 08:56:59 +0000