aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web
Commit message (Collapse)AuthorAgeFilesLines
...
* Refactor some frontend problems (#32646)wxiaoguang2024-11-262-3/+3
| | | | | | | | | | | 1. correct the modal usage on "admin email list" page (then `web_src/js/features/admin/emails.ts` is removed) 2. use `addDelegatedEventListener` instead of `jQuery().on` 3. more jQuery related changes and remove jQuery from `web_src/js/features/common-button.ts` 4. improve `confirmModal` to make it support header, and remove incorrect double-escaping 5. fix more typescript related types 6. fine tune devtest pages and add more tests
* Add github compatible tarball download API endpoints (#32572)Lunny Xiao2024-11-251-2/+12
| | | | Fix #29654 Fix #32481
* Refactor markup render system (#32612)wxiaoguang2024-11-2415-180/+96
| | | | | | | | | | This PR removes (almost) all path tricks, and introduces "renderhelper" package. Now we can clearly see the rendering behaviors for comment/file/wiki, more details are in "renderhelper" tests. Fix #31411 , fix #18592, fix #25632 and maybe more problems. (ps: fix #32608 by the way)
* Update the list of watchers and stargazers when clicking watch/unwatch or ↵Yarden Shoham2024-11-222-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | star/unstar (#32570) We make sure the user cards are updated - Fixes https://github.com/go-gitea/gitea/issues/32561 I also removed `ctx.Data["PageIsWatchers"] = true` and `ctx.Data["PageIsStargazers"] = true` as they are not used anywhere. # Before ![before](https://github.com/user-attachments/assets/e3bc3235-35eb-4eda-862d-bdf2510282ea) # After ![after](https://github.com/user-attachments/assets/bc0488a5-8399-4cf6-95c9-17328a9702eb) --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Fix get reviewers' bug (#32415)Lunny Xiao2024-11-221-4/+4
| | | | | | | | | | This PR rewrites `GetReviewer` function and move it to service layer. Reviewers should not be watchers, so that this PR removed all watchers from reviewers. When the repository is under an organization, the pull request unit read permission will be checked to resolve the bug of #32394 Fix #32394
* Refactor markup render system (#32589)wxiaoguang2024-11-2217-188/+137
| | | | This PR mainly moves some code and introduces `RenderContext.WithXxx` functions
* Enhancing Gitea OAuth2 Provider with Granular Scopes for Resource Access ↵Marcell Mars2024-11-221-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#32573) Resolve #31609 This PR was initiated following my personal research to find the lightest possible Single Sign-On solution for self-hosted setups. The existing solutions often seemed too enterprise-oriented, involving many moving parts and services, demanding significant resources while promising planetary-scale capabilities. Others were adequate in supporting basic OAuth2 flows but lacked proper user management features, such as a change password UI. Gitea hits the sweet spot for me, provided it supports more granular access permissions for resources under users who accept the OAuth2 application. This PR aims to introduce granularity in handling user resources as nonintrusively and simply as possible. It allows third parties to inform users about their intent to not ask for the full access and instead request a specific, reduced scope. If the provided scopes are **only** the typical ones for OIDC/OAuth2—`openid`, `profile`, `email`, and `groups`—everything remains unchanged (currently full access to user's resources). Additionally, this PR supports processing scopes already introduced with [personal tokens](https://docs.gitea.com/development/oauth2-provider#scopes) (e.g. `read:user`, `write:issue`, `read:group`, `write:repository`...) Personal tokens define scopes around specific resources: user info, repositories, issues, packages, organizations, notifications, miscellaneous, admin, and activitypub, with access delineated by read and/or write permissions. The initial case I wanted to address was to have Gitea act as an OAuth2 Identity Provider. To achieve that, with this PR, I would only add `openid public-only` to provide access token to the third party to authenticate the Gitea's user but no further access to the API and users resources. Another example: if a third party wanted to interact solely with Issues, it would need to add `read:user` (for authorization) and `read:issue`/`write:issue` to manage Issues. My approach is based on my understanding of how scopes can be utilized, supported by examples like [Sample Use Cases: Scopes and Claims](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims) on auth0.com. I renamed `CheckOAuthAccessToken` to `GetOAuthAccessTokenScopeAndUserID` so now it returns AccessTokenScope and user's ID. In the case of additional scopes in `userIDFromToken` the default `all` would be reduced to whatever was asked via those scopes. The main difference is the opportunity to reduce the permissions from `all`, as is currently the case, to what is provided by the additional scopes described above. Screenshots: ![Screenshot_20241121_121405](https://github.com/user-attachments/assets/29deaed7-4333-4b02-8898-b822e6f2463e) ![Screenshot_20241121_120211](https://github.com/user-attachments/assets/7a4a4ef7-409c-4116-9d5f-2fe00eb37167) ![Screenshot_20241121_120119](https://github.com/user-attachments/assets/aa52c1a2-212d-4e64-bcdf-7122cee49eb6) ![Screenshot_20241121_120018](https://github.com/user-attachments/assets/9eac318c-e381-4ea9-9e2c-3a3f60319e47) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add line-through for deleted branch on pull request view page (#32500)Lunny Xiao2024-11-211-0/+1
| | | | | | | | | | | | | Base branch deleted ![图片](https://github.com/user-attachments/assets/bc45aa33-d514-47c8-885a-de9732f2f3d5) branch deleted comment ![图片](https://github.com/user-attachments/assets/83729bbb-2ee8-4bd3-b6f1-780d2daad3d4) Head branch deleted ![图片](https://github.com/user-attachments/assets/90120b22-34a9-4387-aae9-5c882e8d421a)
* Support HTTP POST requests to `/userinfo`, aligning to OpenID Core ↵Marcell Mars2024-11-201-1/+1
| | | | | | | | | specification (#32578) This PR adds support for the HTTP POST requests to `/userinfo` endpoint. While the OpenID Core specification says both are supported and recommends using HTTP GET. ref: https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
* Use user.FullName in Oauth2 id_token response (#32542)Baltazár Radics2024-11-182-21/+2
| | | | This makes `/login/oauth/authorize` behave the same way as the `/login/oauth/userinfo` endpoint.
* Refactor push mirror find and add check for updating push mirror (#32539)Lunny Xiao2024-11-181-36/+15
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor markup render system (#32533)wxiaoguang2024-11-181-1/+1
| | | | | Remove unmaintainable sanitizer rules. No need to add special "class" regexp rules anymore, use RenderInternal.SafeAttr instead, more details (and examples) are in the tests
* Refactor find forks and fix possible bugs that weak permissions check (#32528)Lunny Xiao2024-11-181-12/+11
| | | | | | | | | | | - Move models/GetForks to services/FindForks - Add doer as a parameter of FindForks to check permissions - Slight performance optimization for get forks API with batch loading of repository units - Add tests for forking repository to organizations --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use better name for userinfo structure (#32544)Lunny Xiao2024-11-181-11/+11
|
* Fix and refactor markdown rendering (#32522)wxiaoguang2024-11-165-9/+6
|
* Fix oauth2 error handle not return immediately (#32514)Lunny Xiao2024-11-151-0/+2
|
* Refactor render system (#32492)wxiaoguang2024-11-145-15/+9
| | | | | | | | | | | | | | | | | | | There were too many patches to the Render system, it's really difficult to make further improvements. This PR clears the legacy problems and fix TODOs. 1. Rename `RenderContext.Type` to `RenderContext.MarkupType` to clarify its usage. 2. Use `ContentMode` to replace `meta["mode"]` and `IsWiki`, to clarify the rendering behaviors. 3. Use "wiki" mode instead of "mode=gfm + wiki=true" 4. Merge `renderByType` and `renderByFile` 5. Add more comments ---- The problem of "mode=document": in many cases it is not set, so many non-comment places use comment's hard line break incorrectly
* Fix LFS route mock, realm, middleware names (#32488)wxiaoguang2024-11-133-54/+51
| | | | | | | | | | 1. move "internal-lfs" route mock to "common-lfs" 2. fine tune tests 3. fix "realm" strings, according to RFC: https://datatracker.ietf.org/doc/html/rfc2617: * realm = "realm" "=" realm-value * realm-value = quoted-string 4. clarify some names of the middlewares, rename `ignXxx` to `optXxx` to match `reqXxx`, and rename ambiguous `requireSignIn` to `reqGitSignIn`
* Disable Oauth check if oauth disabled (#32368)Lunny Xiao2024-11-121-32/+38
| | | | | | | | Fix #32367 --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor LFS SSH and internal routers (#32473)wxiaoguang2024-11-121-17/+1
| | | | | | | | | | | | | | | | | | Gitea instance keeps reporting a lot of errors like "LFS SSH transfer connection denied, pure SSH protocol is disabled". When starting debugging the problem, there are more problems found. Try to address most of them: * avoid unnecessary server side error logs (change `fail()` to not log them) * figure out the broken tests/user2/lfs.git (added comments) * avoid `migratePushMirrors` failure when a repository doesn't exist (ignore them) * avoid "Authorization" (internal&lfs) header conflicts, remove the tricky "swapAuth" and use "X-Gitea-Internal-Auth" * make internal token comparing constant time (it wasn't a serous problem because in a real world it's nearly impossible to timing-attack the token, but good to fix and backport) * avoid duplicate routers (introduce AddOwnerRepoGitLFSRoutes) * avoid "internal (private)" routes using session/web context (they should use private context) * fix incorrect "path" usages (use "filepath") * fix incorrect mocked route point handling (need to check func nil correctly) * split some tests from "git general tests" to "git misc tests" (to keep "git_general_test.go" simple) Still no correct result for Git LFS SSH tests. So the code is kept there (`tests/integration/git_lfs_ssh_test.go`) and a FIXME explains the details.
* Move some functions from issue.go to standalone files (#32468)Lunny Xiao2024-11-118-3146/+3298
| | | | | | | Just functions move, no code change. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Calculate `PublicOnly` for org membership only once (#32234)65432024-11-112-7/+9
| | | | | | | | | | Refactoring of #32211 this move the PublicOnly() filter calcuation next to the DB querys and let it be decided by the Doer --- *Sponsored by Kithara Software GmbH*
* Refactor sidebar assignee&milestone&project selectors (#32465)wxiaoguang2024-11-113-260/+228
| | | | | | | | | | | | | | | | | | | Follow #32460 Now the code could be much clearer than before and easier to maintain. A lot of legacy code is removed. Manually tested. This PR is large enough, that fine tunes could be deferred to the future if there is no bug found or design problem. Screenshots: <details> ![image](https://github.com/user-attachments/assets/35f4ab7b-1bc0-4bad-a73c-a4569328303c) </details>
* Refactor sidebar label selector (#32460)wxiaoguang2024-11-105-93/+113
| | | Introduce `issueSidebarLabelsData` to handle all sidebar labels related data.
* Add reviewers selection to new pull request (#32403)Calvin K2024-11-093-66/+141
| | | | | | | | | | Users could add reviewers when creating new PRs. --------- Co-authored-by: splitt3r <splitt3r@users.noreply.github.com> Co-authored-by: Sebastian Sauer <sauer.sebastian@gmail.com> Co-authored-by: bb-ben <70356237+bboerben@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor issue page info (#32445)wxiaoguang2024-11-081-3/+3
| | | Fix a longstanding TODO since 2021 (#14826) / 2018 (#2531)
* Move AddCollabrator and CreateRepositoryByExample to service layer (#32419)Lunny Xiao2024-11-071-3/+2
| | | | | | - [x] Move `CreateRepositoryByExample` to service layer - [x] Move `AddCollabrator` to service layer - [x] Add a new parameter for `AddCollabrator` so that changing mode immediately after that will become unnecessary.
* Fix milestone deadline and date related problems (#32339)Lunny Xiao2024-11-053-28/+10
| | | | | | | | | Use zero instead of 9999-12-31 for deadline Fix #32291 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Refactor RepoRefByType (#32413)wxiaoguang2024-11-052-7/+7
| | | | | 1. clarify the "filepath" could(should) contain "{ref}" 2. remove unclear RepoRefLegacy and RepoRefAny, use RepoRefUnknown to guess 3. by the way, avoid using AppURL
* Refactor template ctx and render utils (#32422)wxiaoguang2024-11-053-5/+6
| | | Clean up the templates
* Refactor DateUtils and merge TimeSince (#32409)wxiaoguang2024-11-042-5/+3
| | | Follow #32383 and #32402
* Fix git error handling (#32401)wxiaoguang2024-11-021-1/+1
|
* Replace DateTime with DateUtils (#32383)wxiaoguang2024-11-021-2/+2
|
* improve performance of diffs (#32393)Rowan Bohde2024-11-023-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | This has two major changes that significantly reduce the amount of work done for large diffs: * Kill a running git process when reaching the maximum number of files in a diff, preventing it from processing the entire diff. * When loading a diff with the URL param `file-only=true`, skip loading stats. This speeds up loading both hidden files of a diff and sections of a diff when clicking the "Show More" button. A couple of minor things from profiling are also included: * Reuse existing repo in `PrepareViewPullInfo` if head and base are the same. The performance impact is going to depend heavily on the individual diff and the hardware it runs on, but when testing locally on a diff changing 100k+ lines over hundreds of files, I'm seeing a roughly 75% reduction in time to load the result of "Show More" --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix `missing signature key` error when pulling Docker images with ↵Zettat1232024-10-315-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `SERVE_DIRECT` enabled (#32365) Fix #28121 I did some tests and found that the `missing signature key` error is caused by an incorrect `Content-Type` header. Gitea correctly sets the `Content-Type` header when serving files. https://github.com/go-gitea/gitea/blob/348d1d0f322ca57c459acd902f54821d687ca804/routers/api/packages/container/container.go#L712-L717 However, when `SERVE_DIRECT` is enabled, the `Content-Type` header may be set to an incorrect value by the storage service. To fix this issue, we can use query parameters to override response header values. https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html <img width="600px" src="https://github.com/user-attachments/assets/f2ff90f0-f1df-46f9-9680-b8120222c555" /> In this PR, I introduced a new parameter to the `URL` method to support additional parameters. ``` URL(path, name string, reqParams url.Values) (*url.URL, error) ``` --- Most S3-like services support specifying the content type when storing objects. However, Gitea always use `application/octet-stream`. Therefore, I believe we also need to improve the `Save` method to support storing objects with the correct content type. https://github.com/go-gitea/gitea/blob/b7fb20e73e63b8edc9b90c52073e248bef428fcc/modules/storage/minio.go#L214-L221
* Fix suggestions for issues (#32380)wxiaoguang2024-10-301-19/+8
|
* refactor: remove redundant err declarations (#32381)Oleksandr Redko2024-10-303-3/+0
|
* Respect UI.ExploreDefaultSort setting again (#32357)65432024-10-302-2/+4
| | | | | | fix regression of https://github.com/go-gitea/gitea/pull/29430 --- *Sponsored by Kithara Software GmbH*
* Suggestions for issues (#32327)Anbraten2024-10-292-0/+94
| | | closes #16872
* Fix disable 2fa bug (#32320)Lunny Xiao2024-10-231-3/+6
|
* Make admins adhere to branch protection rules (#32248)Tim2024-10-231-0/+1
| | | | | | | | | | | | This introduces a new flag `BlockAdminMergeOverride` on the branch protection rules that prevents admins/repo owners from bypassing branch protection rules and merging without approvals or failing status checks. Fixes #17131 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Add `DISABLE_ORGANIZATIONS_PAGE` and `DISABLE_CODE_PAGE` settings for ↵Zettat1232024-10-226-28/+26
| | | | | | | | | | | | explore pages and fix an issue related to user search (#32288) These settings can allow users to only display the repositories explore page. Thanks to yp05327 and wxiaoguang ! --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make `owner/repo/pulls` handlers use "PR reader" permission (#32254)wxiaoguang2024-10-151-26/+29
| | | Fix #32253 (partially)
* Allow maintainers to view and edit files of private repos when "Allow ↵Zettat1232024-10-111-2/+0
| | | | | maintainers to edit" is enabled (#32215) Fix #31539
* Move admin routers from /admin to /-/admin (#32189)Lunny Xiao2024-10-1017-44/+44
| | | | | | | Resolve #32181 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor CSRF token (#32216)wxiaoguang2024-10-102-5/+7
|
* Fix incorrect "Target branch does not exist" in PR title (#32222)Zettat1232024-10-101-1/+1
|
* Enhance USER_DISABLED_FEATURES to allow disabling change username or full ↵Zisu Zhang2024-10-051-1/+15
| | | | | | | | | | | | | | | name (#31959) Fix #31958 Enhanced `USER_DISABLED_FEATURES`(also `EXTERNAL_USER_DISABLE_FEATURES`) option in `[admin]` section. Added following values: - `change_username`: Disable change username - `change_full_name`: Disable change full name --- Progress: - [x] Update code - [x] Update translations
* Fix javascript error when an anonymous user visiting migration page (#32144)Lunny Xiao2024-10-023-54/+45
| | | | | | | | | | | | This PR fixes javascript errors when an anonymous user visits the migration page. It also makes task view checking more restrictive. The router moved from `/user/task/{id}/status` to `/username/reponame/-/migrate/status` because it's a migrate status. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make oauth2 code clear. Move oauth2 provider code to their own ↵Lunny Xiao2024-10-023-850/+672
| | | | | | packages/files (#32148) Fix #30266 Replace #31533
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-22 15:22:27 +0000