summaryrefslogtreecommitdiffstats
path: root/routers/web
Commit message (Collapse)AuthorAgeFilesLines
* Add support mCaptcha as captcha provider (#20458)Gusted2022-08-103-0/+27
| | | | | https://mcaptcha.org/ Co-authored-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@users.noreply.github.com>
* Add an option to create new issues from "/issues" page (#20650)CodeDoctor2022-08-091-0/+6
|
* Add issue filter for Author (#20578)parnic2022-08-081-1/+9
| | | This adds a new filter option on the issues and pulls pages to filter by the author/poster/creator of the issue or PR
* Fix init mail render logic (#20704)KN4CK3R2022-08-081-4/+0
| | | This bug affects tests which are sending emails (#20307). Some tests reinitialise the web routes (like `TestNodeinfo`) which messed up the mail templates. There is no reason why the templates should be loaded in the routes method.
* Use request timeout for git service rpc (#20689)parnic2022-08-061-5/+6
| | | | | | | | | This enables git.Command's Run to optionally use the given context directly so its deadline will be respected. Otherwise, it falls back to the previous behavior of using the supplied timeout or a default timeout value of 360 seconds. repo's serviceRPC() calls now use the context's deadline (which is unset/unlimited) instead of the default 6-minute timeout. This means that large repo clones will no longer arbitrarily time out on the upload-pack step, and pushes can take longer than 6 minutes on the receive-pack step. Fixes #20680 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add default commit messages to PR for squash merge (#20618)Tyrone Yeh2022-08-031-0/+2
| | | | | | Keep the same behavior as 1.16 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Rework mailer settings (#18982)Clar Fon2022-08-021-1/+1
| | | | | | | | | | | * `PROTOCOL`: can be smtp, smtps, smtp+startls, smtp+unix, sendmail, dummy * `SMTP_ADDR`: domain for SMTP, or path to unix socket * `SMTP_PORT`: port for SMTP; defaults to 25 for `smtp`, 465 for `smtps`, and 587 for `smtp+startls` * `ENABLE_HELO`, `HELO_HOSTNAME`: reverse `DISABLE_HELO` to `ENABLE_HELO`; default to false + system hostname * `FORCE_TRUST_SERVER_CERT`: replace the unclear `SKIP_VERIFY` * `CLIENT_CERT_FILE`, `CLIENT_KEY_FILE`, `USE_CLIENT_CERT`: clarify client certificates here Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Support localized README (#20508)Gary Wang2022-08-012-69/+117
| | | | | | | | | | | | | | | | * Support localized README * Slightly simplify getting the readme file and add some tests. Ensure that i18n also works for docs/ etc. Signed-off-by: Andrew Thornton <art27@cantab.net> * Update modules/markup/renderer.go * Update modules/markup/renderer.go * Update modules/markup/renderer.go Co-authored-by: Andrew Thornton <art27@cantab.net>
* Add disable download source configuration (#20548)Lunny Xiao2022-07-311-1/+8
| | | | | Add configuration to enable/disable download source from UI. Co-authored-by: zeripath <art27@cantab.net>
* Add missing Tabs on organisation/package view (Frontport #20539) (#20540)65432022-07-311-0/+16
| | | hotfix #20106
* Rework file highlight rendering and fix yaml copy-paste (#19967)silverwind2022-07-301-13/+13
| | | | | | | | | | | * Rework file highlight rendering and fix yaml copy-paste * use Split+Trim to replace tag parser * remove unnecessary bytes.Count * remove newLineInHTML = "&#10;" Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add new API endpoints for push mirrors management (#19841)Mohamed Sekour2022-07-301-9/+9
| | | | | | | | | | | - Add a new push mirror to specific repository - Sync now ( send all the changes to the configured push mirrors ) - Get list of all push mirrors of a repository - Get a push mirror by ID - Delete push mirror by ID Signed-off-by: Mohamed Sekour <mohamed.sekour@exfo.com> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* WebAuthn CredentialID field needs to be increased in size (#20530)zeripath2022-07-301-2/+1
| | | | | | | | | | | | | WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix #20457 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Added email notification option to receive all own messages (#20179)Tyrone Yeh2022-07-281-1/+2
| | | | | | Sometimes users want to receive email notifications of messages they create or reply to, Added an option to personal preferences to allow users to choose Closes #20149
* Add Docker /v2/_catalog endpoint (#20469)KN4CK3R2022-07-282-0/+13
| | | | | | | | | | | | | * Added properties for packages. * Fixed authenticate header format. * Added _catalog endpoint. * Check owner visibility. * Extracted condition. * Added test for _catalog. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix possible panic when repository is empty (#20509)Lunny Xiao2022-07-281-4/+8
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show hint to link package to repo when viewing empty repo package list (#20504)Norwin2022-07-271-0/+4
| | | | | | | * show hint to link package to repo on empty repo package listing * reword
* Hide internal package versions (#20492)KN4CK3R2022-07-273-13/+22
| | | | | * Hide internal versions from most searches. * Added test.
* fix enabling repo packages when projects are off (#20486)Norwin2022-07-261-1/+1
|
* Slightly simplify LastCommitCache (#20444)zeripath2022-07-253-14/+4
| | | | | | | | | | | The LastCommitCache code is a little complex and there is unnecessary duplication between the gogit and nogogit variants. This PR adds the LastCommitCache as a field to the git.Repository and pre-creates it in the ReferencesGit helpers etc. There has been some simplification and unification of the variant code. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add repository condition for issue count (#20454)Tyrone Yeh2022-07-241-0/+1
| | | | | | | | | | * Add repository condition for issue count * Update routers/web/user/home.go Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Prepend commit message to template content (#20429)Gusted2022-07-241-0/+13
| | | | | | | | | - When a repository has a pull request template, it will always override the current content. With this PR it will prepend content to the template content when appropriate. This is similar how GitHub(and GitLab I presume) does it and it saves developers time to not go open their commit and copy paste their will written commit message.
* Add Cache-Control header to html and api responses, add no-transform (#20432)silverwind2022-07-231-0/+1
| | | | | | | | | | | | `no-transform` allegedly disables CloudFlare auto-minify and we did not set caching headers on html or api requests, which seems good to have regardless. Transformation is still allowed for asset requests. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Dismiss prior pull reviews if done via web in review dismiss (#20197)65432022-07-191-1/+1
|
* Fix public org members displayed too many informations (#20403)Lunny Xiao2022-07-191-0/+1
|
* Allow access to the Public Organization Member lists with minimal ↵a10121127962022-07-152-6/+6
| | | | | | | | | | | permissions (#20330) Examining Organization membership should not necessarily require sign-in if the organization is public and the members are public. Therefore we should adjust `/org/{org}/members` to not require login. Fix #7501 Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: zeripath <art27@cantab.net>
* Fix commit status icon when in subdirectory (#20285)silverwind2022-07-151-7/+7
| | | | | | When viewing a subdirectory and the latest commit to that directory in the table, the commit status icon incorrectly showed the status of the HEAD commit instead of the latest for that directory.
* Add option to purge users (#18064)zeripath2022-07-142-17/+7
| | | | | | | Add the ability to purge users when deleting them. Close #15588 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix various typos (#20338)luzpaz2022-07-124-7/+7
| | | | | | | * Fix various typos Found via `codespell -q 3 -S ./options/locale,./options/license,./public/vendor -L actived,allways,attachements,ba,befores,commiter,pullrequest,pullrequests,readby,splitted,te,unknwon` Co-authored-by: zeripath <art27@cantab.net>
* Implement sync push mirror on commit (#19411)Chongyi Zheng2022-07-081-6/+8
| | | | | | | | | Support synchronizing with the push mirrors whenever new commits are pushed or synced from pull mirror. Related Issues: #18220 Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Only show Followers that current user can access (#20220)zeripath2022-07-051-4/+4
| | | | | | | | Users who are following or being followed by a user should only be displayed if the viewing user can see them. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Check if project has the same repository id with issue when assign project ↵Lunny Xiao2022-06-304-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | to issue (#20133) * Check if project has the same repository id with issue when assign project to issue * Check if issue's repository id match project's repository id * Add more permission checking * Remove invalid argument * Fix errors * Add generic check * Remove duplicated check * Return error + add check for new issues * Apply suggestions from code review Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de>
* Refactor `i18n` to `locale` (#20153)Gusted2022-06-271-1/+1
| | | | | | | | | | | * Refactor `i18n` to `locale` - Currently we're using the `i18n` variable naming for the `locale` struct. This contains locale's specific information and cannot be used for general i18n purpose, therefore refactoring it to `locale` makes more sense. - Ref: https://github.com/go-gitea/gitea/pull/20096#discussion_r906699200 * Update routers/install/install.go
* Hide notify mail setting ui if not enabled (#20138)Lunny Xiao2022-06-281-0/+1
|
* Remove U2F support (#20141)Gusted2022-06-263-15/+3
| | | | | | - Completely remove U2F support from 1.18.0, 1.17.0 will be the last release that U2F is somewhat supported. Users who used U2F would already be warned about using U2F for a while now and should hopefully already be migrated. But starting 1.18 definitely remove it.
* Make better use of i18n (#20096)Gusted2022-06-268-21/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Prototyping * Start work on creating offsets * Modify tests * Start prototyping with actual MPH * Twiddle around * Twiddle around comments * Convert templates * Fix external languages * Fix latest translation * Fix some test * Tidy up code * Use simple map * go mod tidy * Move back to data structure - Uses less memory by creating for each language a map. * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Add some comments * Fix tests * Try to fix tests * Use en-US as defacto fallback * Use correct slices * refactor (#4) * Remove TryTr, add log for missing translation key * Refactor i18n - Separate dev and production locale stores. - Allow for live-reloading in dev mode. Co-authored-by: zeripath <art27@cantab.net> * Fix live-reloading & check for errors * Make linter happy * live-reload with periodic check (#5) * Fix tests Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Use neutral language in comments and docs (#20135)Gusted2022-06-251-1/+1
| | | - Replace `his/her` to `their`, as it's more neutral language.
* Add sitemap support (#18407)Daniil Gentili2022-06-254-2/+105
|
* Fix wrong login requirement routers (#20101)Lunny Xiao2022-06-231-1/+1
|
* Respect setting.UI.FeedPagingNum (#20094)Jimmy Praet2022-06-232-0/+2
| | | Fixes #20080
* Release page show all tags in compare dropdown (#20070)65432022-06-211-1/+8
| | | address #19936
* Catch the error before the response is processed by goth. (#20000)SteveTheEngineer2022-06-201-12/+20
| | | | | | | The code introduced by #18185 gets the error from response after it was processed by goth. That is incorrect, as goth (and golang.org/x/oauth) doesn't really care about the error, and it sends a token request with an empty authorization code to the server anyway, which always results in a `oauth2: cannot fetch token: 400 Bad Request` error from goth. It means that unless the "state" parameter is omitted from the error response (which is required to be present, according to [RFC 6749, Section 4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)) or the page is reloaded (makes the session invalid), a 500 Internal Server Error page will be displayed. This fixes it by handling the error before the request is passed to goth.
* Add more linters to improve code readability (#19989)Wim2022-06-2010-14/+12
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* fix delete pull head ref for DeleteIssue (#20032)a10121127962022-06-191-0/+5
| | | | | | | | | | | | | * fix delete pull head ref for DeleteIssue fix #19655 Signed-off-by: a1012112796 <1012112796@qq.com> * add different help message for delete pull request Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: 6543 <6543@obermui.de>
* User keypairs and HTTP signatures for ActivityPub federation using go-ap ↵Anthony Wang2022-06-191-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#19133) * go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master * activitypub: implement /api/v1/activitypub/user/{username} (#14186) Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: add the public key to Person (#14186) Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: go-fed conformant Clock instance Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: signing http client Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: implement the ReqSignature middleware Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: hack_16834 Signed-off-by: Loïc Dachary <loic@dachary.org> * Fix CI checks-backend errors with go mod tidy Signed-off-by: Anthony Wang <ta180m@pm.me> * Change 2021 to 2022, properly format package imports Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt and make generate-swagger Signed-off-by: Anthony Wang <ta180m@pm.me> * Use Gitea JSON library, add assert for pkp Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt again, fix err var redeclaration Signed-off-by: Anthony Wang <ta180m@pm.me> * Remove LogSQL from ActivityPub person test Signed-off-by: Anthony Wang <ta180m@pm.me> * Assert if json.Unmarshal succeeds Signed-off-by: Anthony Wang <ta180m@pm.me> * Cleanup, handle invalid usernames for ActivityPub person GET request Signed-off-by: Anthony Wang <ta180m@pm.me> * Rename hack_16834 to user_settings Signed-off-by: Anthony Wang <ta180m@pm.me> * Use the httplib module instead of http for GET requests * Clean up whitespace with make fmt * Use time.RFC1123 and make the http.Client proxy-aware * Check if digest algo is supported in setting module * Clean up some variable declarations * Remove unneeded copy * Use system timezone instead of setting.DefaultUILocation * Use named constant for httpsigExpirationTime * Make pubKey IRI #main-key instead of /#main-key * Move /#main-key to #main-key in tests * Implemented Webfinger endpoint. * Add visible check. * Add user profile as alias. * Add actor IRI and remote interaction URL to WebFinger response * fmt * Fix lint errors * Use go-ap instead of go-fed * Run go mod tidy to fix missing modules in go.mod and go.sum * make fmt * Convert remaining code to go-ap * Clean up go.sum * Fix JSON unmarshall error * Fix CI errors by adding @context to Person() and making sure types match * Correctly decode JSON in api_activitypub_person_test.go * Force CI rerun * Fix TestActivityPubPersonInbox segfault * Fix lint error * Use @mariusor's suggestions for idiomatic go-ap usage * Correctly add inbox/outbox IRIs to person * Code cleanup * Remove another LogSQL from ActivityPub person test * Move httpsig algos slice to an init() function * Add actor IRI and remote interaction URL to WebFinger response * Update TestWebFinger to check for ActivityPub IRI in aliases * make fmt * Force CI rerun * WebFinger: Add CORS header and fix Href -> Template for remote interactions The CORS header is needed due to https://datatracker.ietf.org/doc/html/rfc7033#section-5 and fixes some Peertube <-> Gitea federation issues * make lint-backend * Make sure Person endpoint has Content-Type application/activity+json and includes PreferredUsername, URL, and Icon Setting the correct Content-Type is essential for federating with Mastodon * Use UTC instead of GMT * Rename pkey to pubKey * Make sure HTTP request Date in GMT * make fmt * dont drop err * Make sure API responses always refer to username in original case Copied from what I wrote on #19133 discussion: Handling username case is a very tricky issue and I've already encountered a Mastodon <-> Gitea federation bug due to Gitea considering Ta180m and ta180m to be the same user while Mastodon thinks they are two different users. I think the best way forward is for Gitea to only use the original case version of the username for federation so other AP software don't get confused. * Move httpsig algs constant slice to modules/setting/federation.go * Add new federation settings to app.example.ini and config-cheat-sheet * Return if marshalling error * Make sure Person IRIs are generated correctly This commit ensures that if the setting.AppURL is something like "http://127.0.0.1:42567" (like in the integration tests), a trailing slash will be added after that URL. * If httpsig verification fails, fix Host header and try again This fixes a very rare bug when Gitea and another AP server (confirmed to happen with Mastodon) are running on the same machine, Gitea fails to verify incoming HTTP signatures. This is because the other AP server creates the sig with the public Gitea domain as the Host. However, when Gitea receives the request, the Host header is instead localhost, so the signature verification fails. Manually changing the host header to the correct value and trying the veification again fixes the bug. * Revert "If httpsig verification fails, fix Host header and try again" This reverts commit f53e46c721a037c55facb9200106a6b491bf834c. The bug was actually caused by nginx messing up the Host header when reverse-proxying since I didn't have the line `proxy_set_header Host $host;` in my nginx config for Gitea. * Go back to using ap.IRI to generate inbox and outbox IRIs * use const for key values * Update routers/web/webfinger.go * Use ctx.JSON in Person response to make code cleaner * Revert "Use ctx.JSON in Person response to make code cleaner" This doesn't work because the ctx.JSON() function already sends the response out and it's too late to edit the headers. This reverts commit 95aad988975be3393c76094864ed6ba962157e0c. * Use activitypub.ActivityStreamsContentType for Person response Content Type * Limit maximum ActivityPub request and response sizes to a configurable setting * Move setting key constants to models/user/setting_keys.go * Fix failing ActivityPubPerson integration test by checking the correct field for username * Add a warning about changing settings that can break federation * Add better comments * Don't multiply Federation.MaxSize by 1<<20 twice * Add more better comments * Fix failing ActivityPubMissingPerson test We now use ctx.ContextUser so the message printed out when a user does not exist is slightly different * make generate-swagger For some reason I didn't realize that /templates/swagger/v1_json.tmpl was machine-generated by make generate-swagger... I've been editing it by hand for three months! 🤦 * Move getting the RFC 2616 time to a separate function * More code cleanup * Update go-ap to fix empty liked collection and removed unneeded HTTP headers * go mod tidy * Add ed25519 to httpsig algorithms * Use go-ap/jsonld to add @context and marshal JSON * Change Gitea user agent from the default to Gitea/Version * Use ctx.ServerError and remove all remote interaction code from webfinger.go
* Stop spurious APIFormat stopwatches logs (#20008)zeripath2022-06-171-1/+3
| | | | | | | | | If there are dangling stopwatches with missing issues there will be repeated logging of Unable to APIFormat stopwatches. These are unhelpful and instead we should only log if the error is not an issue not exist error. And we should also prevent an error on missing issue in GetActiveStopwatch too Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix Readme render bug (#19992)Lunny Xiao2022-06-171-1/+1
| | | | | Fix #19988 Co-authored-by: zeripath <art27@cantab.net>
* Use DisplayName() instead of FullName in Oauth provider (#19991)oGi4i2022-06-162-1/+20
| | | | | Use DisplayName() in Oauth as this provides a fallback if FullName is not set. Closes #19382
* fix permission check for delete tag (#19985)a10121127962022-06-162-1/+11
| | | | | | | fix #19970 by the way, fix some error response about protected tags. Signed-off-by: a1012112796 <1012112796@qq.com>
* Allow render HTML with css/js external links (#19017)Lunny Xiao2022-06-164-18/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Allow render HTML with css/js external links * Fix bug because of filename escape chars * Fix lint * Update docs about new configuration item * Fix bug of render HTML in sub directory * Add CSP head for displaying iframe in rendering file * Fix test * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Some improvements * some improvement * revert change in SanitizerDisabled of external renderer * Add sandbox for iframe and support allow-scripts and allow-same-origin * refactor * fix * fix lint * fine tune * use single option RENDER_CONTENT_MODE, use sandbox=allow-scripts * fine tune CSP * Apply suggestions from code review Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-31 01:27:47 +0000