aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web
Commit message (Collapse)AuthorAgeFilesLines
...
* Add label/author/assignee filters to the user/org home issue list (#32779)wxiaoguang2024-12-117-174/+136
| | | | | | | | | | Replace #26661, fix #25979 Not perfect, but usable and much better than before. Since it is quite complex, I am not quite sure whether there would be any regression, if any, I will fix in first time. I have tested the related pages many times: issue list, milestone issue list, project view, user issue list, org issue list.
* Refactor issue filter (labels, poster, assignee) (#32771)wxiaoguang2024-12-104-40/+9
| | | | | | | | | | | | Rewrite a lot of legacy strange code, remove duplicate code, remove jquery, and make these filters reusable. Let's forget the old code, new code affects: * issue list open/close switch * issue list filter (label, author, assignee) * milestone list open/close switch * milestone issue list filter (label, author, assignee) * project view (label, assignee)
* Make RepoActionView.vue support `##[group]` (#32770)wxiaoguang2024-12-101-3/+7
|
* Refactor issue list (#32755)wxiaoguang2024-12-083-49/+73
| | | | | 1. add backend support for filtering "poster" and "assignee" * due to the limits, there is no frontend support at the moment 2. rewrite TS code without jquery, now there are 14 jQuery files left:
* Fix compare page bug view as anonymous (#32754)Lunny Xiao2024-12-081-1/+3
| | | | Fix a bug introduced from https://github.com/go-gitea/gitea/pull/32403/files#diff-dc86301f15109eee38296d469630672193e0587ad1485fdd8f503bf4c789cf7eR692
* Split issue/pull view router function as multiple smaller functions (#32749)Lunny Xiao2024-12-082-298/+356
| | | | This PR splits issue/pull view function into multiple smaller functions. It also removed duplicated branches load.
* fix: render job title as commit message (#32748)metiftikci2024-12-081-13/+19
| | | | | | | resolves #32724 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* fix(project): add title to project view page (#32747)metiftikci2024-12-071-0/+1
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Support "merge upstream branch" (Sync fork) (#32741)wxiaoguang2024-12-064-134/+179
| | | | | | | | | Add basic "sync fork" support (GitHub-like) <details> ![image](https://github.com/user-attachments/assets/e71473f4-4518-48c7-b9e2-fedfcd564fc3) </details>
* GitHub like repo home page (#32213)yp053272024-12-068-801/+882
| | | | | | | Move some components (description, license, release, language stats) to sidebar --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make wiki pages visit fast (#32732)Lunny Xiao2024-12-061-10/+21
|
* Refactor RepoActionView.vue, add `::group::` support (#32713)wxiaoguang2024-12-063-56/+160
| | | | | | | 1. make it able to "force reload", then the previous pending request won't block the new request 2. make it support `::group::` 3. add some TS types (but there are still many variables untyped, this PR is large enough, the remaining types could be added in the future)
* Issue time estimate, meaningful time tracking (#23113)Illya Marchenko2024-12-053-12/+42
| | | | | | | | | | | | | Redesign the time tracker side bar, and add "time estimate" support (in "1d 2m" format) Closes #23112 --------- Co-authored-by: stuzer05 <stuzer05@gmail.com> Co-authored-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add Arch package registry (#32692)KN4CK3R2024-12-041-7/+24
| | | | | | | | | | | | | | | | | | | | | | | Close #25037 Close #31037 This PR adds a Arch package registry usable with pacman. ![grafik](https://github.com/user-attachments/assets/81cdb0c2-02f9-4733-bee2-e48af6b45224) Rewrite of #25396 and #31037. You can follow [this tutorial](https://wiki.archlinux.org/title/Creating_packages) to build a package for testing. Docs PR: https://gitea.com/gitea/docs/pulls/111 Co-authored-by: [d1nch8g@ion.lc](mailto:d1nch8g@ion.lc) Co-authored-by: @ExplodingDragon --------- Co-authored-by: dancheg97 <dancheg97@fmnx.su> Co-authored-by: dragon <ExplodingFKL@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix mentionable users when writing issue comments (#32715)wxiaoguang2024-12-045-15/+19
| | | Fix #32702
* Fix delete branch perm checking (#32654)Lunny Xiao2024-12-041-31/+32
|
* Refactor markdown editor and use it for milestone description editor (#32688)wxiaoguang2024-12-041-0/+2
| | | | | | | | | | Refactor markdown editor to clarify its "preview" behavior and remove jQuery code. Close #15045 --------- Co-authored-by: silverwind <me@silverwind.io>
* Fix issue title rendering and refactor legacy function names (#32703)wxiaoguang2024-12-041-2/+2
| | | | | | | | Fix #32700, regression of recent markup refactoring And by the way, clarify many legacy problems: 1. Some "RenderXxx" functions do not really "render", they only call "post processors" 2. Merge "RenderEmoji | RenderCodeBlock", they are all for "simple issue title"
* Quick fix for license file name (#32696)Lunny Xiao2024-12-031-0/+4
|
* Allow to disable the password-based login (sign-in) form (#32687)wxiaoguang2024-12-021-31/+17
| | | | | | | | | | | | | | Usually enterprise/organization users would like to only allow OAuth2 login. This PR adds a new config option to disable the password-based login form. It is a simple and clear approach and won't block the future login-system refactoring works. Fix a TODO in #24821 Replace #21851 Close #7633 , close #13606
* Move GetFeeds to service layer (#32526)Lunny Xiao2024-11-294-4/+8
| | | Move GetFeeds from models to service layer, no code change.
* Allow users with write permission to run actions (#32644)Pedro Nishiyama2024-11-282-3/+3
| | | | | --- I have a use case where I need a team to be able to run actions without admin access.
* Validate OAuth Redirect URIs (#32643)Rowan Bohde2024-11-281-2/+15
| | | | | | | This fixes a TODO in the code to validate the RedirectURIs when adding or editing an OAuth application in user settings. This also includes a refactor of the user settings tests to only create the DB once per top-level test to avoid reloading fixtures.
* Move team related functions to service layer (#32537)Lunny Xiao2024-11-273-17/+15
| | | | | There are still some functions under `models` after last big refactor about `models`. This change will move all team related functions to service layer with no code change.
* Add priority to protected branch (#32286)65432024-11-272-0/+11
| | | | | | | | | | | | | | | | | | | ## Solves Currently for rules to re-order them you have to alter the creation date. so you basicly have to delete and recreate them in the right order. This is more than just inconvinient ... ## Solution Add a new col for prioritization ## Demo WebUI Video https://github.com/user-attachments/assets/92182a31-9705-4ac5-b6e3-9bb74108cbd1 --- *Sponsored by Kithara Software GmbH*
* Fix: passkey login not working anymore (#32623)hiifong2024-11-262-7/+20
| | | | | | | Quick fix #32595, use authenticator auth flags to login --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor some frontend problems (#32646)wxiaoguang2024-11-262-3/+3
| | | | | | | | | | | 1. correct the modal usage on "admin email list" page (then `web_src/js/features/admin/emails.ts` is removed) 2. use `addDelegatedEventListener` instead of `jQuery().on` 3. more jQuery related changes and remove jQuery from `web_src/js/features/common-button.ts` 4. improve `confirmModal` to make it support header, and remove incorrect double-escaping 5. fix more typescript related types 6. fine tune devtest pages and add more tests
* Add github compatible tarball download API endpoints (#32572)Lunny Xiao2024-11-251-2/+12
| | | | Fix #29654 Fix #32481
* Refactor markup render system (#32612)wxiaoguang2024-11-2415-180/+96
| | | | | | | | | | This PR removes (almost) all path tricks, and introduces "renderhelper" package. Now we can clearly see the rendering behaviors for comment/file/wiki, more details are in "renderhelper" tests. Fix #31411 , fix #18592, fix #25632 and maybe more problems. (ps: fix #32608 by the way)
* Update the list of watchers and stargazers when clicking watch/unwatch or ↵Yarden Shoham2024-11-222-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | star/unstar (#32570) We make sure the user cards are updated - Fixes https://github.com/go-gitea/gitea/issues/32561 I also removed `ctx.Data["PageIsWatchers"] = true` and `ctx.Data["PageIsStargazers"] = true` as they are not used anywhere. # Before ![before](https://github.com/user-attachments/assets/e3bc3235-35eb-4eda-862d-bdf2510282ea) # After ![after](https://github.com/user-attachments/assets/bc0488a5-8399-4cf6-95c9-17328a9702eb) --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Fix get reviewers' bug (#32415)Lunny Xiao2024-11-221-4/+4
| | | | | | | | | | This PR rewrites `GetReviewer` function and move it to service layer. Reviewers should not be watchers, so that this PR removed all watchers from reviewers. When the repository is under an organization, the pull request unit read permission will be checked to resolve the bug of #32394 Fix #32394
* Refactor markup render system (#32589)wxiaoguang2024-11-2217-188/+137
| | | | This PR mainly moves some code and introduces `RenderContext.WithXxx` functions
* Enhancing Gitea OAuth2 Provider with Granular Scopes for Resource Access ↵Marcell Mars2024-11-221-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#32573) Resolve #31609 This PR was initiated following my personal research to find the lightest possible Single Sign-On solution for self-hosted setups. The existing solutions often seemed too enterprise-oriented, involving many moving parts and services, demanding significant resources while promising planetary-scale capabilities. Others were adequate in supporting basic OAuth2 flows but lacked proper user management features, such as a change password UI. Gitea hits the sweet spot for me, provided it supports more granular access permissions for resources under users who accept the OAuth2 application. This PR aims to introduce granularity in handling user resources as nonintrusively and simply as possible. It allows third parties to inform users about their intent to not ask for the full access and instead request a specific, reduced scope. If the provided scopes are **only** the typical ones for OIDC/OAuth2—`openid`, `profile`, `email`, and `groups`—everything remains unchanged (currently full access to user's resources). Additionally, this PR supports processing scopes already introduced with [personal tokens](https://docs.gitea.com/development/oauth2-provider#scopes) (e.g. `read:user`, `write:issue`, `read:group`, `write:repository`...) Personal tokens define scopes around specific resources: user info, repositories, issues, packages, organizations, notifications, miscellaneous, admin, and activitypub, with access delineated by read and/or write permissions. The initial case I wanted to address was to have Gitea act as an OAuth2 Identity Provider. To achieve that, with this PR, I would only add `openid public-only` to provide access token to the third party to authenticate the Gitea's user but no further access to the API and users resources. Another example: if a third party wanted to interact solely with Issues, it would need to add `read:user` (for authorization) and `read:issue`/`write:issue` to manage Issues. My approach is based on my understanding of how scopes can be utilized, supported by examples like [Sample Use Cases: Scopes and Claims](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims) on auth0.com. I renamed `CheckOAuthAccessToken` to `GetOAuthAccessTokenScopeAndUserID` so now it returns AccessTokenScope and user's ID. In the case of additional scopes in `userIDFromToken` the default `all` would be reduced to whatever was asked via those scopes. The main difference is the opportunity to reduce the permissions from `all`, as is currently the case, to what is provided by the additional scopes described above. Screenshots: ![Screenshot_20241121_121405](https://github.com/user-attachments/assets/29deaed7-4333-4b02-8898-b822e6f2463e) ![Screenshot_20241121_120211](https://github.com/user-attachments/assets/7a4a4ef7-409c-4116-9d5f-2fe00eb37167) ![Screenshot_20241121_120119](https://github.com/user-attachments/assets/aa52c1a2-212d-4e64-bcdf-7122cee49eb6) ![Screenshot_20241121_120018](https://github.com/user-attachments/assets/9eac318c-e381-4ea9-9e2c-3a3f60319e47) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add line-through for deleted branch on pull request view page (#32500)Lunny Xiao2024-11-211-0/+1
| | | | | | | | | | | | | Base branch deleted ![图片](https://github.com/user-attachments/assets/bc45aa33-d514-47c8-885a-de9732f2f3d5) branch deleted comment ![图片](https://github.com/user-attachments/assets/83729bbb-2ee8-4bd3-b6f1-780d2daad3d4) Head branch deleted ![图片](https://github.com/user-attachments/assets/90120b22-34a9-4387-aae9-5c882e8d421a)
* Support HTTP POST requests to `/userinfo`, aligning to OpenID Core ↵Marcell Mars2024-11-201-1/+1
| | | | | | | | | specification (#32578) This PR adds support for the HTTP POST requests to `/userinfo` endpoint. While the OpenID Core specification says both are supported and recommends using HTTP GET. ref: https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
* Use user.FullName in Oauth2 id_token response (#32542)Baltazár Radics2024-11-182-21/+2
| | | | This makes `/login/oauth/authorize` behave the same way as the `/login/oauth/userinfo` endpoint.
* Refactor push mirror find and add check for updating push mirror (#32539)Lunny Xiao2024-11-181-36/+15
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor markup render system (#32533)wxiaoguang2024-11-181-1/+1
| | | | | Remove unmaintainable sanitizer rules. No need to add special "class" regexp rules anymore, use RenderInternal.SafeAttr instead, more details (and examples) are in the tests
* Refactor find forks and fix possible bugs that weak permissions check (#32528)Lunny Xiao2024-11-181-12/+11
| | | | | | | | | | | - Move models/GetForks to services/FindForks - Add doer as a parameter of FindForks to check permissions - Slight performance optimization for get forks API with batch loading of repository units - Add tests for forking repository to organizations --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use better name for userinfo structure (#32544)Lunny Xiao2024-11-181-11/+11
|
* Fix and refactor markdown rendering (#32522)wxiaoguang2024-11-165-9/+6
|
* Fix oauth2 error handle not return immediately (#32514)Lunny Xiao2024-11-151-0/+2
|
* Refactor render system (#32492)wxiaoguang2024-11-145-15/+9
| | | | | | | | | | | | | | | | | | | There were too many patches to the Render system, it's really difficult to make further improvements. This PR clears the legacy problems and fix TODOs. 1. Rename `RenderContext.Type` to `RenderContext.MarkupType` to clarify its usage. 2. Use `ContentMode` to replace `meta["mode"]` and `IsWiki`, to clarify the rendering behaviors. 3. Use "wiki" mode instead of "mode=gfm + wiki=true" 4. Merge `renderByType` and `renderByFile` 5. Add more comments ---- The problem of "mode=document": in many cases it is not set, so many non-comment places use comment's hard line break incorrectly
* Fix LFS route mock, realm, middleware names (#32488)wxiaoguang2024-11-133-54/+51
| | | | | | | | | | 1. move "internal-lfs" route mock to "common-lfs" 2. fine tune tests 3. fix "realm" strings, according to RFC: https://datatracker.ietf.org/doc/html/rfc2617: * realm = "realm" "=" realm-value * realm-value = quoted-string 4. clarify some names of the middlewares, rename `ignXxx` to `optXxx` to match `reqXxx`, and rename ambiguous `requireSignIn` to `reqGitSignIn`
* Disable Oauth check if oauth disabled (#32368)Lunny Xiao2024-11-121-32/+38
| | | | | | | | Fix #32367 --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor LFS SSH and internal routers (#32473)wxiaoguang2024-11-121-17/+1
| | | | | | | | | | | | | | | | | | Gitea instance keeps reporting a lot of errors like "LFS SSH transfer connection denied, pure SSH protocol is disabled". When starting debugging the problem, there are more problems found. Try to address most of them: * avoid unnecessary server side error logs (change `fail()` to not log them) * figure out the broken tests/user2/lfs.git (added comments) * avoid `migratePushMirrors` failure when a repository doesn't exist (ignore them) * avoid "Authorization" (internal&lfs) header conflicts, remove the tricky "swapAuth" and use "X-Gitea-Internal-Auth" * make internal token comparing constant time (it wasn't a serous problem because in a real world it's nearly impossible to timing-attack the token, but good to fix and backport) * avoid duplicate routers (introduce AddOwnerRepoGitLFSRoutes) * avoid "internal (private)" routes using session/web context (they should use private context) * fix incorrect "path" usages (use "filepath") * fix incorrect mocked route point handling (need to check func nil correctly) * split some tests from "git general tests" to "git misc tests" (to keep "git_general_test.go" simple) Still no correct result for Git LFS SSH tests. So the code is kept there (`tests/integration/git_lfs_ssh_test.go`) and a FIXME explains the details.
* Move some functions from issue.go to standalone files (#32468)Lunny Xiao2024-11-118-3146/+3298
| | | | | | | Just functions move, no code change. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Calculate `PublicOnly` for org membership only once (#32234)65432024-11-112-7/+9
| | | | | | | | | | Refactoring of #32211 this move the PublicOnly() filter calcuation next to the DB querys and let it be decided by the Doer --- *Sponsored by Kithara Software GmbH*
* Refactor sidebar assignee&milestone&project selectors (#32465)wxiaoguang2024-11-113-260/+228
| | | | | | | | | | | | | | | | | | | Follow #32460 Now the code could be much clearer than before and easier to maintain. A lot of legacy code is removed. Manually tested. This PR is large enough, that fine tunes could be deferred to the future if there is no bug found or design problem. Screenshots: <details> ![image](https://github.com/user-attachments/assets/35f4ab7b-1bc0-4bad-a73c-a4569328303c) </details>
* Refactor sidebar label selector (#32460)wxiaoguang2024-11-105-93/+113
| | | Introduce `issueSidebarLabelsData` to handle all sidebar labels related data.
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-15 07:15:13 +0000