summaryrefslogtreecommitdiffstats
path: root/routers/web/web.go
Commit message (Collapse)AuthorAgeFilesLines
* Fix init mail render logic (#20704)KN4CK3R2022-08-081-4/+0
| | | This bug affects tests which are sending emails (#20307). Some tests reinitialise the web routes (like `TestNodeinfo`) which messed up the mail templates. There is no reason why the templates should be loaded in the routes method.
* Add disable download source configuration (#20548)Lunny Xiao2022-07-311-1/+8
| | | | | Add configuration to enable/disable download source from UI. Co-authored-by: zeripath <art27@cantab.net>
* Slightly simplify LastCommitCache (#20444)zeripath2022-07-251-0/+2
| | | | | | | | | | | The LastCommitCache code is a little complex and there is unnecessary duplication between the gogit and nogogit variants. This PR adds the LastCommitCache as a field to the git.Repository and pre-creates it in the ReferencesGit helpers etc. There has been some simplification and unification of the variant code. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow access to the Public Organization Member lists with minimal ↵a10121127962022-07-151-1/+6
| | | | | | | | | | | permissions (#20330) Examining Organization membership should not necessarily require sign-in if the organization is public and the members are public. Therefore we should adjust `/org/{org}/members` to not require login. Fix #7501 Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: zeripath <art27@cantab.net>
* Fix various typos (#20338)luzpaz2022-07-121-1/+1
| | | | | | | * Fix various typos Found via `codespell -q 3 -S ./options/locale,./options/license,./public/vendor -L actived,allways,attachements,ba,befores,commiter,pullrequest,pullrequests,readby,splitted,te,unknwon` Co-authored-by: zeripath <art27@cantab.net>
* Check if project has the same repository id with issue when assign project ↵Lunny Xiao2022-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | to issue (#20133) * Check if project has the same repository id with issue when assign project to issue * Check if issue's repository id match project's repository id * Add more permission checking * Remove invalid argument * Fix errors * Add generic check * Remove duplicated check * Return error + add check for new issues * Apply suggestions from code review Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de>
* Add sitemap support (#18407)Daniil Gentili2022-06-251-0/+3
|
* Fix wrong login requirement routers (#20101)Lunny Xiao2022-06-231-1/+1
|
* Add more linters to improve code readability (#19989)Wim2022-06-201-2/+2
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* Allow render HTML with css/js external links (#19017)Lunny Xiao2022-06-161-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Allow render HTML with css/js external links * Fix bug because of filename escape chars * Fix lint * Update docs about new configuration item * Fix bug of render HTML in sub directory * Add CSP head for displaying iframe in rendering file * Fix test * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Some improvements * some improvement * revert change in SanitizerDisabled of external renderer * Add sandbox for iframe and support allow-scripts and allow-same-origin * refactor * fix * fix lint * fine tune * use single option RENDER_CONTENT_MODE, use sandbox=allow-scripts * fine tune CSP * Apply suggestions from code review Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Unify repo settings & show better error (#19828)Gusted2022-06-121-2/+4
| | | | * Unify context data * Actually show invalid url in error
* fixed comment typo (#19944)xkcdstickfigure2022-06-111-1/+1
|
* Auto merge pull requests when all checks succeeded via WebUI (#19648)65432022-06-111-0/+1
| | | | | | | | Add WebUI part of Auto merge feature close #19621 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* Feature: Find files in repo (#15028)Roger Luo2022-06-091-0/+6
| | | | | | | | | | | | | | | | * Create finding files page ui in repo page * Get tree entries for find repo files. * Move find files JS to individual file. * gen swagger. * Add enry.IsVendor to exclude entries Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Move `/info` outside authorization (#19888)Gusted2022-06-041-1/+5
| | | | | | | | | | - To use the web's API to get information about a issue/pull on a repository, doesn't require authorization(nor that the repository isn't archived). - Regressed by: #19318 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Adding button to link accounts from user settings (#19792)Mai-Lapyst2022-05-291-4/+4
| | | | | * Adding button to link accounts from user settings * Only display button to link user accounts when at least one OAuth2 provider is active
* Add Webfinger endpoint (#19462)KN4CK3R2022-05-091-2/+10
| | | | | This adds the [Webfinger](https://webfinger.net/) endpoint for federation. Supported schemes are `acct` and `mailto`. The profile and avatar url are returned as metadata.
* Allow to mark files in a PR as viewed (#19007)delvh2022-05-071-0/+1
| | | Users can now mark files in PRs as viewed, resulting in them not being shown again by default when they reopen the PR again.
* Add health check endpoint (#18465)ttys32022-05-041-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * chore: add health check endpoint docs: update document about health check fix: fix up Sqlite3 ping. current ping will success even if the db file is missing fix: do not expose privacy information in output field * refactor: remove HealthChecker struct * Added `/api/healthz` to install routes. This was needed for using /api/healthz endpoint in Docker healthchecks, otherwise, Docker would never become healthy if using healthz endpoint and users would not be able to complete the installation of Gitea. * Update modules/cache/cache.go * fine tune * Remove unnecessary test code. Now there are 2 routes for installation (and maybe more in future) Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Marcos de Oliveira <marcossantos@furb.br>
* Add "Allow edits from maintainer" feature (#18002)qwerty2872022-04-281-3/+5
| | | | | | | | | | | | | | | | | Adds a feature [like GitHub has](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork) (step 7). If you create a new PR from a forked repo, you can select (and change later, but only if you are the PR creator/poster) the "Allow edits from maintainers" option. Then users with write access to the base branch get more permissions on this branch: * use the update pull request button * push directly from the command line (`git push`) * edit/delete/upload files via web UI * use related API endpoints You can't merge PRs to this branch with this enabled, you'll need "full" code write permissions. This feature has a pretty big impact on the permission system. I might forgot changing some things or didn't find security vulnerabilities. In this case, please leave a review or comment on this PR. Closes #17728 Co-authored-by: 6543 <6543@obermui.de>
* Fix middleware function's placements for some `/user/...` (#19377)Gusted2022-04-121-5/+5
| | | | | - Add reqSignIn to `/user/task/{task}` as it specific to a logged in user currently not-logged in user could cause a NPE. - Move `/user/stopwatch` & `/user/search` middleware before the actual function is called, because functions are executed in order and currently hadn't any effect and could as well cause a NPE due to that. - Remove `/user/active` reqSignIn middleware, because when you want to active a account you're not "signed in" so it doesn't make sense to add that middleware.
* Remove dependent on session auth for api/v1 routers (#19321)Lunny Xiao2022-04-081-3/+16
| | | | | | | | | | | * Remove dependent on session auth for api/v1 routers * Remove unnecessary session on API context * remove missed header * fix test * fix missed api/v1
* Never use /api/v1 from Gitea UI Pages (#19318)Lunny Xiao2022-04-071-1/+15
| | | | | | | | | | | | | Reusing `/api/v1` from Gitea UI Pages have pros and cons. Pros: 1) Less code copy Cons: 1) API/v1 have to support shared session with page requests. 2) You need to consider for each other when you want to change something about api/v1 or page. This PR moves all dependencies to API/v1 from UI Pages. Partially replace #16052
* Fix global packages enabled avaiable (#19276)Lunny Xiao2022-03-311-19/+25
| | | Fix #19275
* Add Goroutine stack inspector to admin/monitor (#19207)zeripath2022-03-311-0/+1
| | | | | | | | | | | | | | | | | | | Continues on from #19202. Following the addition of pprof labels we can now more easily understand the relationship between a goroutine and the requests that spawn them. This PR takes advantage of the labels and adds a few others, then provides a mechanism for the monitoring page to query the pprof goroutine profile. The binary profile that results from this profile is immediately piped in to the google library for parsing this and then stack traces are formed for the goroutines. If the goroutine is within a context or has been created from a goroutine within a process context it will acquire the process description labels for that process. The goroutines are mapped with there associate pids and any that do not have an associated pid are placed in a group at the bottom as unbound. In this way we should be able to more easily examine goroutines that have been stuck. A manager command `gitea manager processes` is also provided that can export the processes (with or without stacktraces) to the command line. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add Package Registry (#16510)KN4CK3R2022-03-301-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Added package store settings. * Added models. * Added generic package registry. * Added tests. * Added NuGet package registry. * Moved service index to api file. * Added NPM package registry. * Added Maven package registry. * Added PyPI package registry. * Summary is deprecated. * Changed npm name. * Sanitize project url. * Allow only scoped packages. * Added user interface. * Changed method name. * Added missing migration file. * Set page info. * Added documentation. * Added documentation links. * Fixed wrong error message. * Lint template files. * Fixed merge errors. * Fixed unit test storage path. * Switch to json module. * Added suggestions. * Added package webhook. * Add package api. * Fixed swagger file. * Fixed enum and comments. * Fixed NuGet pagination. * Print test names. * Added api tests. * Fixed access level. * Fix User unmarshal. * Added RubyGems package registry. * Fix lint. * Implemented io.Writer. * Added support for sha256/sha512 checksum files. * Improved maven-metadata.xml support. * Added support for symbol package uploads. * Added tests. * Added overview docs. * Added npm dependencies and keywords. * Added no-packages information. * Display file size. * Display asset count. * Fixed filter alignment. * Added package icons. * Formatted instructions. * Allow anonymous package downloads. * Fixed comments. * Fixed postgres test. * Moved file. * Moved models to models/packages. * Use correct error response format per client. * Use simpler search form. * Fixed IsProd. * Restructured data model. * Prevent empty filename. * Fix swagger. * Implemented user/org registry. * Implemented UI. * Use GetUserByIDCtx. * Use table for dependencies. * make svg * Added support for unscoped npm packages. * Add support for npm dist tags. * Added tests for npm tags. * Unlink packages if repository gets deleted. * Prevent user/org delete if a packages exist. * Use package unlink in repository service. * Added support for composer packages. * Restructured package docs. * Added missing tests. * Fixed generic content page. * Fixed docs. * Fixed swagger. * Added missing type. * Fixed ambiguous column. * Organize content store by sha256 hash. * Added admin package management. * Added support for sorting. * Add support for multiple identical versions/files. * Added missing repository unlink. * Added file properties. * make fmt * lint * Added Conan package registry. * Updated docs. * Unify package names. * Added swagger enum. * Use longer TEXT column type. * Removed version composite key. * Merged package and container registry. * Removed index. * Use dedicated package router. * Moved files to new location. * Updated docs. * Fixed JOIN order. * Fixed GROUP BY statement. * Fixed GROUP BY #2. * Added symbol server support. * Added more tests. * Set NOT NULL. * Added setting to disable package registries. * Moved auth into service. * refactor * Use ctx everywhere. * Added package cleanup task. * Changed packages path. * Added container registry. * Refactoring * Updated comparison. * Fix swagger. * Fixed table order. * Use token auth for npm routes. * Enabled ReverseProxy auth. * Added packages link for orgs. * Fixed anonymous org access. * Enable copy button for setup instructions. * Merge error * Added suggestions. * Fixed merge. * Handle "generic". * Added link for TODO. * Added suggestions. * Changed temporary buffer filename. * Added suggestions. * Apply suggestions from code review Co-authored-by: Thomas Boerger <thomas@webhippie.de> * Update docs/content/doc/packages/nuget.en-us.md Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Thomas Boerger <thomas@webhippie.de>
* Refactor repo clone button and repo clone links, fix JS error on empty repo ↵wxiaoguang2022-03-291-0/+1
| | | | | | | | | | | | | | | | | page (#19208) The last PR about clone buttons introduced an JS error when visiting an empty repo page: * https://github.com/go-gitea/gitea/pull/19028 * `Uncaught ReferenceError: isSSH is not defined`, because the variables are scoped and doesn't share between sub templates. This: 1. Simplify `templates/repo/clone_buttons.tmpl` and make code clear 2. Move most JS code into `initRepoCloneLink` 3. Remove unused `CloneLink.Git` 4. Remove `ctx.Data["DisableSSH"] / ctx.Data["ExposeAnonSSH"] / ctx.Data["DisableHTTP"]`, and only set them when is is needed (eg: deploy keys / ssh keys) 5. Introduce `Data["CloneButton*"]` to provide data for clone buttons and links 6. Introduce `Data["RepoCloneLink"]` for the repo clone link (not the wiki) 7. Remove most `ctx.Data["PageIsWiki"]` because it has been set in the `/wiki` middleware 8. Remove incorrect `quickstart` class in `migrating.tmpl`
* Let web and API routes have different auth methods group (#19168)Lunny Xiao2022-03-281-1/+26
| | | | | | | | | | | | | * remove the global methods but create dynamiclly * Fix lint * Fix windows lint * Fix windows lint * some improvements Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add `ContextUser` to http request context (#18798)KN4CK3R2022-03-261-3/+15
| | | | | This PR adds a middleware which sets a ContextUser (like GetUserByParams before) in a single place which can be used by other methods. For routes which represent a repo or org the respective middlewares set the field too. Also fix a bug in modules/context/org.go during refactoring.
* Update HTTP status codes to modern codes (#18063)KN4CK3R2022-03-231-4/+4
| | | | | | * 2xx/3xx/4xx/5xx -> http.Status... * http.StatusFound -> http.StatusTemporaryRedirect * http.StatusMovedPermanently -> http.StatusPermanentRedirect
* Use custom favicon when viewing static files if it exists (#19130)Abheek Dhawan2022-03-191-0/+5
| | | | | Redirect `/favicon.ico` to `/assets/img/favicon.png`. Fix #19109
* Add button for issue deletion (#19032)Otto Richter (fnetX)2022-03-091-0/+1
| | | | Co-authored-by: Norwin <noerw@users.noreply.github.com> Co-authored-by: 6543 <6543@obermui.de>
* Disable unnecessary OpenID/OAuth2 elements (#18491)Paweł Bogusławski2022-02-091-4/+11
| | | | | | | This mod fixes disabling unnecessary OpenID elements. Related: https://github.com/go-gitea/gitea/pull/13129 Author-Change-Id: IB#1115256
* Add apply-patch, basic revert and cherry-pick functionality (#17902)zeripath2022-02-091-0/+5
| | | | | | | | | | | | | | | This code adds a simple endpoint to apply patches to repositories and branches on gitea. This is then used along with the conflicting checking code in #18004 to provide a basic implementation of cherry-pick revert. Now because the buttons necessary for cherry-pick and revert have required us to create a dropdown next to the Browse Source button I've also implemented Create Branch and Create Tag operations. Fix #3880 Fix #17986 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Ensure that blob-excerpt links work for wiki (#18587)zeripath2022-02-051-1/+20
| | | | | | | | It appears that the blob-excerpt links do not work on the wiki - likely since their introduction. This PR adds support for the wiki on these links. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add packagist webhook (#18224)Dr. Tobias Quathamer2022-01-231-0/+4
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Pause queues (#15928)zeripath2022-01-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Start adding mechanism to return unhandled data Signed-off-by: Andrew Thornton <art27@cantab.net> * Create pushback interface Signed-off-by: Andrew Thornton <art27@cantab.net> * Add Pausable interface to WorkerPool and Manager Signed-off-by: Andrew Thornton <art27@cantab.net> * Implement Pausable and PushBack for the bytefifos Signed-off-by: Andrew Thornton <art27@cantab.net> * Implement Pausable and Pushback for ChannelQueues and ChannelUniqueQueues Signed-off-by: Andrew Thornton <art27@cantab.net> * Wire in UI for pausing Signed-off-by: Andrew Thornton <art27@cantab.net> * add testcases and fix a few issues Signed-off-by: Andrew Thornton <art27@cantab.net> * fix build Signed-off-by: Andrew Thornton <art27@cantab.net> * prevent "race" in the test Signed-off-by: Andrew Thornton <art27@cantab.net> * fix jsoniter mismerge Signed-off-by: Andrew Thornton <art27@cantab.net> * fix conflicts Signed-off-by: Andrew Thornton <art27@cantab.net> * fix format Signed-off-by: Andrew Thornton <art27@cantab.net> * Add warnings for no worker configurations and prevent data-loss with redis/levelqueue Signed-off-by: Andrew Thornton <art27@cantab.net> * Use StopTimer Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add config options to hide issue events (#17414)qwerty2872022-01-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add config option to hide issue events Adds a config option `HIDE_ISSUE_EVENTS` to hide most issue events (changed labels, milestones, projects...) on the issue detail page. If this is true, only the following events (comment types) are shown: * plain comments * closed/reopned/merged * reviews * Make configurable using a list * Add docs * Add missing newline * Fix merge issues * Allow changes per user settings * Fix lint * Rm old docs * Apply suggestions from code review * Use bitsets * Rm comment * fmt * Fix lint * Use variable/constant to provide key * fmt * fix lint * refactor * Add a prefix for user setting key * Add license comment * Add license comment * Update services/forms/user_form_hidden_comments.go Co-authored-by: Gusted <williamzijl7@hotmail.com> * check len == 0 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: 6543 <6543@obermui.de>
* format with gofumpt (#18184)65432022-01-201-7/+2
| | | | | | | | | | | * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt
* Refactor Router Logger (#17308)wxiaoguang2022-01-201-4/+5
| | | | | | Make router logger more friendly, show the related function name/file/line. [BREAKING] This PR substantially changes the logging format of the router logger. If you use this logging for monitoring e.g. fail2ban you will need to update this to match the new format.
* Support webauthn (#17957)Lunny Xiao2022-01-141-13/+8
| | | | | | | Migrate from U2F to Webauthn Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add replay of webhooks. (#18191)KN4CK3R2022-01-051-4/+13
|
* refactoring nits (#18188)65432022-01-051-1/+0
| | | | | | | * no octal for time values * rm artifact from refactoring Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove unused route "/tasks/trigger" (#18160)Gusted2022-01-031-2/+0
| | | ref: https://github.com/go-gitea/gitea/pull/18160#issuecomment-1004091325
* Refactor auth package (#17962)Lunny Xiao2022-01-021-81/+83
|
* Removed unused endpoint. (#18127)KN4CK3R2021-12-291-1/+0
|
* Instead of using routerCtx just escape the url before routing (#18086)zeripath2021-12-251-5/+0
| | | | | | | | | | | | | | | | A consequence of forcibly setting the RoutePath to the escaped url is that the auto routing to endpoints without terminal slashes fails (Causing #18060.) This failure raises the possibility that forcibly setting the RoutePath causes other unexpected behaviors too. Therefore, instead we should simply pre-escape the URL in the process registering handler. Then the request URL will be properly escaped for all the following calls. Fix #17938 Fix #18060 Replace #18062 Replace #17997 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add NotFound handler (#18062)zeripath2021-12-221-0/+10
| | | | | | | | | | | | | PR #17997 means that urls with terminal '/' are no longer immediately mapped to the url without a terminal slash. However, it has revealed that the NotFound handler appears to have been lost. This PR adds back in a NotFound handler that simply redirects to a path without the terminal slash or runs the NotFound handler. Fix #18060 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move POST /{username}/action/{action} to simply POST /{username} (#18045)zeripath2021-12-201-3/+1
| | | | | | | | | | The current code unfortunately requires that `action` be a reserved repository name as it prevents posts to change the settings for action repositories. However, we can simply change action handler to work on POST /{username} instead. Fix #18037 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Support open compare page directly (#17975)Lunny Xiao2021-12-171-0/+1
| | | | | | | | | * Support open compare page directly * simple code * Some improvements Co-authored-by: 6543 <6543@obermui.de>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 21:22:04 +0000