aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web
Commit message (Collapse)AuthorAgeFilesLines
...
* Support repo license (#24872)yp053272024-10-014-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Close #278 Close #24076 ## Solutions: - Use [google/licenseclassifier](https://github.com/google/licenseclassifier/) Test result between [google/licensecheck](https://github.com/google/licensecheck) and [go-license-detector](https://github.com/go-enry/go-license-detector): https://github.com/go-gitea/gitea/pull/24872#issuecomment-1560361167 Test result between [google/licensecheck](https://github.com/google/licensecheck) and [google/licenseclassifier](https://github.com/google/licenseclassifier/): https://github.com/go-gitea/gitea/pull/24872#issuecomment-1576092178 - Generate License Convert Name List to avoid import license templates with same contents Gitea automatically get latest license data from[ spdx/license-list-data](https://github.com/spdx/license-list-data). But unfortunately, some license templates have same contents. #20915 [click here to see the list](https://github.com/go-gitea/gitea/pull/24872#issuecomment-1584141684) So we will generate a list of these license templates with same contents and create a new file to save the result when using `make generate-license`. (Need to decide the save path) - Save License info into a new table `repo_license` Can easily support searching repo by license in the future. ## Screen shot Single License: ![image](https://github.com/go-gitea/gitea/assets/18380374/41260bd7-0b4c-4038-8592-508706cffa9f) Multiple Licenses: ![image](https://github.com/go-gitea/gitea/assets/18380374/34ce2f73-7e18-446b-9b96-ecc4fb61bd70) Triggers: - [x] Push commit to default branch - [x] Create repo - [x] Mirror repo - [x] When Default Branch is changed, licenses should be updated Todo: - [x] Save Licenses info in to DB when there's a change to license file in the commit - [x] DB Migration - [x] A nominal test? - [x] Select which library to use(https://github.com/go-gitea/gitea/pull/24872#issuecomment-1560361167) - [x] API Support - [x] Add repo license table - ~Select license in settings if there are several licenses(Not recommended)~ - License board(later, not in this PR) ![image](https://github.com/go-gitea/gitea/assets/18380374/2c3c3bf8-bcc2-4c6d-8ce0-81d1a9733878) --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: 6543 <m.huber@kithara.com> Co-authored-by: a1012112796 <1012112796@qq.com> Co-authored-by: techknowlogick <techknowlogick@gitea.com>
* Notify the user when the file path contains leading or trailing spaces and ↵charles2024-09-241-1/+1
| | | | | fix the error message for invalid file names. (#31507) close #31478
* Display head branch more comfortable on pull request view (#32000)Lunny Xiao2024-09-241-1/+13
| | | | | | | | | | This PR do some minor improvements for head branch display on pull request view UI. - [x] Remove the link if the head branch has been deleted with a tooltip, so that users will not result in a 404 page - [x] Display a label if this pull request is an agit based one. ![图片](https://github.com/user-attachments/assets/872f26b6-f1cf-4427-9e41-e3a5b176dfa4)
* Allow set branch protection in an empty repository (#32095)Lunny Xiao2024-09-241-1/+1
|
* Fix Bug in Issue/pulls list (#32081)cloudchamb3r2024-09-241-0/+1
| | | | | | | | | | | | | | | | fix #32080 ## After ### for opened issues <img width="1199" alt="Screenshot 2024-09-19 at 6 29 31 PM" src="https://github.com/user-attachments/assets/86cf48ad-5e4b-4dcb-8abe-4d7fd74e0aec"> ### for closed issues <img width="1208" alt="Screenshot 2024-09-19 at 6 29 37 PM" src="https://github.com/user-attachments/assets/a16bc545-bfcf-49a4-be52-3e7334910482"> ### for all issues <img width="1340" alt="Screenshot 2024-09-20 at 12 07 12 PM" src="https://github.com/user-attachments/assets/b2309c8f-e59d-44e9-ae3b-bf54e1196169">
* Fix rename branch permission bug (#32066)Lunny Xiao2024-09-221-2/+1
| | | | | | The previous implementation requires admin permission to rename branches which should be write permission. Fix #31993
* Fix wrong last modify time (#32102)Lunny Xiao2024-09-211-1/+2
|
* Refactor CSRF protector (#32057)wxiaoguang2024-09-181-0/+2
| | | | | | Remove unused CSRF options, decouple "new csrf protector" and "prepare" logic, do not redirect to home page if CSRF validation falis (it shouldn't happen in daily usage, if it happens, redirecting to home doesn't help either but just makes the problem more complex for "fetch")
* Included tag search capabilities (#32045)Bruno Sofiato2024-09-181-3/+13
| | | | | | | | | | | | | | | | | | | | | Resolves #31998 The first screenshot shows the tag page without any filter being applied: ![image](https://github.com/user-attachments/assets/eac0e51c-9e48-42b2-bb1c-a25896ca40cb) The second one, shows the page when the given filter returns no tag: ![image](https://github.com/user-attachments/assets/98df191e-1a7b-4947-b0ef-4987a0293c3e) The last one shows a single tag being filtered: ![image](https://github.com/user-attachments/assets/79c7e05e-8c86-4f06-b17e-15818b7b9291) Signed-off-by: Bruno Sofiato <bruno.sofiato@gmail.com>
* Use a common message template instead of a special one (#31878)Lunny Xiao2024-09-141-1/+1
|
* Add option to filter board cards by labels and assignees (#31999)Lauris BH2024-09-129-25/+171
| | | | | | | | | | | | | | | Works in both organization and repository project boards Fixes #21846 Replaces #21963 Replaces #27117 ![image](https://github.com/user-attachments/assets/1837ace8-3de2-444f-a153-e166bd0da2c0) **Note** that implementation was made intentionally to work same as in issue list so that URL can be bookmarked for quick access with predefined filters in URL
* Failed authentications are logged to level Warning (#32016)Daniel2024-09-111-4/+4
| | | | | | | PR for issue #31968 Replaces PR #31983 to comply with gitea's error definition Failed authentications are now logged to level `Warning` instead of `Info`.
* Support migration from AWS CodeCommit (#31981)Zettat1232024-09-111-0/+4
| | | | | | | | | | | | | | | | | | | | This PR adds support for migrating repos from [AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html). The access key ID and secret access key are required to get repository information and pull requests. And [HTTPS Git credentials](https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-gc.html) are required to clone the repository. <img src="https://github.com/user-attachments/assets/82ecb2d0-8d43-42b0-b5af-f5347a13b9d0" width="680" /> The AWS CodeCommit icon is from [AWS Architecture Icons](https://aws.amazon.com/architecture/icons/). <img src="https://github.com/user-attachments/assets/3c44d21f-d753-40f5-9eae-5d3589e0d50d" width="320" />
* bump to go 1.23 (#31855)techknowlogick2024-09-104-4/+5
|
* Save initial signup information for users to aid in spam prevention (#31852)techknowlogick2024-09-092-2/+6
| | | | | | | | | | | | | | This will allow instance admins to view signup pattern patterns for public instances. It is modelled after discourse, mastodon, and MediaWiki's approaches. Note: This has privacy implications, but as the above-stated open-source projects take this approach, especially MediaWiki, which I have no doubt looked into this thoroughly, it is likely okay for us, too. However, I would be appreciative of any feedback on how this could be improved. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Distinguish official vs non-official reviews, add tool tips, and upgr… ↵william-allspice2024-09-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#31924) This Pull Request is a follow up to https://github.com/go-gitea/gitea/pull/31886: 1. Adds a UI indicator between official (green) and unofficial (grey) approved pull requests on the Pull Request page (as suggested by @kdumontnu ) 2. Adds tooltips adding clarity to the type and status of a review on the Pull Request page (as suggested by @kdumontnu) 3. Updates text adding more clarity to required approvals (as suggested by @kdumontnu) 4. Updates text on the branch settings page explaining what branch approval limitations (as suggested by @yp05327) Official approval: <img width="376" alt="Screenshot 2024-08-26 at 1 03 52 PM" src="https://github.com/user-attachments/assets/500f083d-bfc0-45c5-82b7-b98e20495696"> Unofficial approval: <img width="442" alt="Screenshot 2024-08-26 at 12 53 15 PM" src="https://github.com/user-attachments/assets/e8c565ff-5886-4ce1-8b79-a0fa26c282f7"> Rejected approval: <img width="452" alt="Screenshot 2024-08-26 at 12 53 06 PM" src="https://github.com/user-attachments/assets/aebc0e2f-7052-4dea-8098-7caa0db86617"> Stale approval: <img width="546" alt="Screenshot 2024-08-26 at 1 07 59 PM" src="https://github.com/user-attachments/assets/da599ff3-e35c-4fa3-8141-ed80b738dd77"> Requested review tooltip: <img width="434" alt="Screenshot 2024-08-26 at 12 53 22 PM" src="https://github.com/user-attachments/assets/460d163e-8724-43b6-8760-34b285da8fe2"> Updated text for approvals: <img width="991" alt="Screenshot 2024-08-26 at 12 54 00 PM" src="https://github.com/user-attachments/assets/ab3ff012-9742-4c1b-933d-21addcb89f2c"> Updated text for allowlisted/whitelisted approvals: <img width="990" alt="Screenshot 2024-08-26 at 1 01 40 PM" src="https://github.com/user-attachments/assets/1a5bae61-d9e0-4d96-b86f-92610b0940d1"> Protected branch settings text: <img width="1022" alt="Screenshot 2024-08-26 at 1 01 14 PM" src="https://github.com/user-attachments/assets/892ce208-e1c2-41f7-8fec-46d5a0e7e776"> Comments list: <img width="1048" alt="Screenshot 2024-08-28 at 9 25 31 AM" src="https://github.com/user-attachments/assets/9c5c00c5-06cf-43b3-b413-4f7f673609b2"> --------- Co-authored-by: Kyle D. <kdumontnu@gmail.com>
* For consistency make repo search sort options case sensitive (#31951)65432024-09-051-2/+1
|
* Remove urls from translations (#31950)Denys Konovalov2024-09-025-8/+8
| | | | | | | Part of #27700 Removes all URLs from translation strings to easy up changing them in the future and to exclude people injecting malicious URLs through translations. First measure as long as #24402 is out of scope.
* nix wording nit in todo code comment65432024-09-011-1/+1
|
* Fix sort order for organization home and user profile page (#31921)yp053272024-09-012-50/+10
| | | | | | | | | | | | | | | | | | | | | | Fix #31916 In #30876, `sortOrder` has been changed into a map, but it is only implemented in explore. ~~But it seems that size sort order has no effect from long long ago,~~ not directly caused by the PR above. I think it is still caused by #29231. In #29231, it merged the sort orders from `templates/explore/repo_search.tmpl` and `templates/admin/repo/search.tmpl`. In `templates/admin/repo/search.tmpl`, it contains size sort orders, but not in `templates/explore/repo_search.tmpl`, which is used in non-admin pages. So `order by size` is added from #29231, but the handler was not added. --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix search team (#31923)Lunny Xiao2024-08-291-1/+6
| | | Fix #20658
* Split org Propfile README to a new tab `overview` (#31373)a10121127962024-08-275-36/+61
| | | | | | | | | | | | | | | | | like user profile, add a new overviw tab to show profile READEME when it is exist. replace #31349 (another solution option) example view: ![屏幕截图 2024-06-14 094116](https://github.com/go-gitea/gitea/assets/25342410/3303a1f2-ae02-48e0-9519-7fa11e65657f) ![屏幕截图 2024-06-14 094101](https://github.com/go-gitea/gitea/assets/25342410/7a4a5a48-dc2b-4ad4-b2a2-9ea4ab5d5808) --------- Signed-off-by: a1012112796 <1012112796@qq.com>
* Don't return 500 if mirror url contains special chars (#31859)Lunny Xiao2024-08-211-2/+4
| | | Fix #31640
* add CfTurnstileSitekey context data to all captcha templates (#31874)Rowan Bohde2024-08-192-0/+4
| | | | | | | | In the OpenID flows, the "CfTurnstileSitekey" wasn't populated, which caused those flows to fail if using Turnstile as the Captcha implementation. This adds the missing context variables, allowing Turnstile to be used in the OpenID flows.
* Add tag name in the commits list (#31082)Lunny Xiao2024-08-191-1/+11
| | | | | | | | | | | | | | | Fix #10036 This PR adds some labels for tags of this commit after the commit message on the commits table. The tag template is share as commit graph's. Desktop: <img width="1302" alt="image" src="https://github.com/go-gitea/gitea/assets/81045/ba94e1e6-2a3d-44f3-85a3-575fb5667c97"> Mobile: <img width="370" alt="image" src="https://github.com/go-gitea/gitea/assets/81045/e3eb1f44-3686-4012-aa9d-52cd88b22c0e">
* Actions support workflow dispatch event (#28163)胖梁2024-08-184-9/+462
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fix #23668 My plan: * In the `actions.list` method, if workflow is selected and IsAdmin, check whether the on event contains `workflow_dispatch`. If so, display a `Run workflow` button to allow the user to manually trigger the run. * Providing a form that allows users to select target brach or tag, and these parameters can be configured in yaml * Simple form validation, `required` input cannot be empty * Add a route `/actions/run`, and an `actions.Run` method to handle * Add `WorkflowDispatchPayload` struct to pass the Webhook event payload to the runner when triggered, this payload carries the `inputs` values and other fields, doc: [workflow_dispatch payload](https://docs.github.com/en/webhooks/webhook-events-and-payloads#workflow_dispatch) Other PRs * the `Workflow.WorkflowDispatchConfig()` method still return non-nil when workflow_dispatch is not defined. I submitted a PR https://gitea.com/gitea/act/pulls/85 to fix it. Still waiting for them to process. Behavior should be same with github, but may cause confusion. Here's a quick reminder. * [Doc](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch) Said: This event will `only` trigger a workflow run if the workflow file is `on the default branch`. * If the workflow yaml file only exists in a non-default branch, it cannot be triggered. (It will not even show up in the workflow list) * If the same workflow yaml file exists in each branch at the same time, the version of the default branch is used. Even if `Use workflow from` selects another branch ![image](https://github.com/go-gitea/gitea/assets/3114995/4bf596f3-426b-48e8-9b8f-0f6d18defd79) ```yaml name: Docker Image CI on: workflow_dispatch: inputs: logLevel: description: 'Log level' required: true default: 'warning' type: choice options: - info - warning - debug tags: description: 'Test scenario tags' required: false type: boolean boolean_default_true: description: 'Test scenario tags' required: true type: boolean default: true boolean_default_false: description: 'Test scenario tags' required: false type: boolean default: false environment: description: 'Environment to run tests against' type: environment required: true default: 'environment values' number_required_1: description: 'number ' type: number required: true default: '100' number_required_2: description: 'number' type: number required: true default: '100' number_required_3: description: 'number' type: number required: true default: '100' number_1: description: 'number' type: number required: false number_2: description: 'number' type: number required: false number_3: description: 'number' type: number required: false env: inputs_logLevel: ${{ inputs.logLevel }} inputs_tags: ${{ inputs.tags }} inputs_boolean_default_true: ${{ inputs.boolean_default_true }} inputs_boolean_default_false: ${{ inputs.boolean_default_false }} inputs_environment: ${{ inputs.environment }} inputs_number_1: ${{ inputs.number_1 }} inputs_number_2: ${{ inputs.number_2 }} inputs_number_3: ${{ inputs.number_3 }} inputs_number_required_1: ${{ inputs.number_required_1 }} inputs_number_required_2: ${{ inputs.number_required_2 }} inputs_number_required_3: ${{ inputs.number_required_3 }} jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - run: ls -la - run: env | grep inputs - run: echo ${{ inputs.logLevel }} - run: echo ${{ inputs.boolean_default_false }} ``` ![image](https://github.com/go-gitea/gitea/assets/3114995/a58a842d-a0ff-4618-bc6d-83a9596d07c8) ![image](https://github.com/go-gitea/gitea/assets/3114995/44a7cca5-7bd4-42a9-8723-91751a501c88) --------- Co-authored-by: TKaxv_7S <954067342@qq.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Avoid returning without written ctx when posting PR (#31843)Jason Song2024-08-161-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix #31625. If `pull_service.NewPullRequest` return an error which misses each `if` check, `CompareAndPullRequestPost` will return immediately, since it doesn't write the HTTP response, a 200 response with empty body will be sent to clients. ```go if err := pull_service.NewPullRequest(ctx, repo, pullIssue, labelIDs, attachments, pullRequest, assigneeIDs); err != nil { if repo_model.IsErrUserDoesNotHaveAccessToRepo(err) { ctx.Error(http.StatusBadRequest, "UserDoesNotHaveAccessToRepo", err.Error()) } else if git.IsErrPushRejected(err) { // ... ctx.JSONError(flashError) } else if errors.Is(err, user_model.ErrBlockedUser) { // ... ctx.JSONError(flashError) } else if errors.Is(err, issues_model.ErrMustCollaborator) { // ... ctx.JSONError(flashError) } return } ``` Not sure what kind of error can cause it to happen, so this PR just expose it. And we can fix it when users report that creating PRs failed with error responses. It's all my guess since I cannot reproduce the problem, but even if it's not related, the code here needs to be improved.
* Fix raw wiki links (#31825)Zettat1232024-08-162-10/+68
| | | | | | | | | | | | | | Fix #31395 This regression is introduced by #30273. To find out how GitHub handles this case, I did [some tests](https://github.com/go-gitea/gitea/issues/31395#issuecomment-2278929115). I use redirect in this PR instead of checking if the corresponding `.md` file exists when rendering the link because GitHub also uses redirect. With this PR, there is no need to resolve the raw wiki link when rendering a wiki page. If a wiki link points to a raw file, access will be redirected to the raw link.
* Add missing repository type filter parameters to pager (#31832)yp053272024-08-154-0/+61
| | | | | | | | | Fix #31807 ps: the newly added params's value will be changed. When the first time you selected the filter, the values of params will be `0` or `1` But in pager it will be `true` or `false`. So do we have `boolToInt` function?
* render plain text file if the LFS object doesn't exist (#31812)Rowan Bohde2024-08-151-4/+2
| | | | | | | | We had an issue where a repo was using LFS to store a file, but the user did not push the file. When trying to view the file, Gitea returned a 500 HTTP status code referencing `ErrLFSObjectNotExist`. It appears the intent was the render this file as plain text, but the conditional was flipped. I've also added a test to verify that the file is rendered as plain text.
* Support issue template assignees (#31083)Zettat1232024-08-121-0/+11
| | | Resolve #13955
* Show lock owner instead of repo owner on LFS setting page (#31788)Jason Song2024-08-111-0/+5
| | | | | | | | | | | | | Fix #31784. Before: <img width="1648" alt="image" src="https://github.com/user-attachments/assets/03f32545-4a85-42ed-bafc-2b193a5d8023"> After: <img width="1653" alt="image" src="https://github.com/user-attachments/assets/e5bcaf93-49cb-421f-aac1-5122bc488b02">
* Move repository visibility to danger zone in the settings area (#31126)Fábio Barkoski2024-08-111-9/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Moved repository visibility to the danger zone in the settings area. To change the visibility, it is necessary to go to the danger zone, click on the private/public button, and accept the change in the modal. Resolves: #23826 --- ## Screenshots <details> <summary>Before</summary> Private repo: ![Private repo](https://github.com/go-gitea/gitea/assets/65479069/4313492a-4854-48bc-9f47-974e3539d791) Public repo: ![Public repo](https://github.com/go-gitea/gitea/assets/65479069/1c45f6e4-ee93-4799-9331-e9d4a7e0f16a) </details> <details> <summary>After</summary> Make private: ![Screenshot from 2024-05-28 21-35-38](https://github.com/go-gitea/gitea/assets/65479069/4887e28a-0514-4990-aa69-bf3ddc7e6c7d) Make private modal ![Screenshot from 2024-06-13 23-55-55](https://github.com/go-gitea/gitea/assets/65479069/9f5a7604-069b-41a2-973b-ee2d58e85953) ![Screenshot from 2024-06-13 23-53-09](https://github.com/go-gitea/gitea/assets/65479069/06c22726-eab2-4bce-8df7-62849dcce974) Make public: ![Screenshot from 2024-05-28 21-34-27](https://github.com/go-gitea/gitea/assets/65479069/6d388f99-0356-48a0-9d85-320cdba55179) Make public modal ![Screenshot from 2024-06-13 23-53-37](https://github.com/go-gitea/gitea/assets/65479069/8944972e-f2d4-4aea-ba96-b892febb5ced) </details> --------- Co-authored-by: Kemal Zebari <60799661+kemzeb@users.noreply.github.com>
* Add warning message in merge instructions when `AutodetectManualMerge` was ↵a10121127962024-08-101-0/+2
| | | | | | | | | | | | | | | | | | | | not enabled (#31805) not enabled quick-f-i-x https://github.com/go-gitea/gitea/issues/31433 ? , maybe need more disscusion about better solutions. example view: ![image](https://github.com/user-attachments/assets/2af7e1e8-42b9-4473-89c7-12d4a9205d3f) adtion notes about how to enable `AutodetectManualMerge` ![image](https://github.com/user-attachments/assets/28f84317-367a-40d8-b50d-a19ef7c664d4) Signed-off-by: a1012112796 <1012112796@qq.com>
* Show latest run when visit /run/latest (#31808)FuXiaoHei2024-08-101-10/+19
| | | | | | | | | Proposal from https://github.com/go-gitea/gitea/issues/27911#issuecomment-2271982172 When visit latest run path, such as `/{user}/{repo}/actions/runs/latest`. It renders latest run instead of index=0 currently.
* Add issue comment when moving issues from one column to another of the ↵Lunny Xiao2024-08-093-2/+9
| | | | | | | | | | | | | | | | | project (#29311) Fix #27278 Replace #27816 This PR adds a meta-comment for an issue when dragging an issue from one column to another of a project. <img width="600" alt="image" src="https://github.com/go-gitea/gitea/assets/81045/5fc1d954-430e-4db0-aaee-a00006fa91f5"> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: yp05327 <576951401@qq.com>
* Fix wiki revision pagination (#31760)Lunny Xiao2024-08-031-0/+1
| | | | Fix #31755
* Clear up old Actions logs (#31735)Jason Song2024-08-021-0/+21
| | | | | | | | | | | | | | | | | Part of #24256. Clear up old action logs to free up storage space. Users will see a message indicating that the log has been cleared if they view old tasks. <img width="1361" alt="image" src="https://github.com/user-attachments/assets/9f0f3a3a-bc5a-402f-90ca-49282d196c22"> Docs: https://gitea.com/gitea/docs/pulls/40 --------- Co-authored-by: silverwind <me@silverwind.io>
* Fix the display of project type for deleted projects (#31732)yp053272024-07-301-1/+1
| | | | | | Fix: #31727 After: ![image](https://github.com/user-attachments/assets/1dfb4b31-3bd6-47f7-b126-650f33f453e2)
* Add permission check when creating PR (#31033)yp053272024-07-291-0/+10
| | | user should be a collaborator of the base repo to create a PR
* Hide the "Details" link of commit status when the user cannot access actions ↵Zettat1232024-07-289-5/+67
| | | | | | | | | | | | | | | (#30156) Fix #26685 If a commit status comes from Gitea Actions and the user cannot access the repo's actions unit (the user does not have the permission or the actions unit is disabled), a 404 page will occur after clicking the "Details" link. We should hide the "Details" link in this case. <img src="https://github.com/go-gitea/gitea/assets/15528715/68361714-b784-4bb5-baab-efde4221f466" width="400px" />
* OIDC: case-insensitive comparison for auth scheme `Basic` (#31706)Shivaram Lingamneni2024-07-261-2/+2
| | | | | | | | | | | | | | @kylef pointed out on https://github.com/go-gitea/gitea/pull/31632 that [RFC7617](https://www.rfc-editor.org/rfc/rfc7617.html#section-2) mandates case-insensitive comparison of the scheme field `Basic`. #31632 copied a case-sensitive comparison from https://github.com/go-gitea/gitea/pull/6293. This PR fixes both comparisons. The issue only affects OIDC, since the implementation for normal Gitea endpoints is already correct: https://github.com/go-gitea/gitea/blob/930ca92d7ce80e8b0bdaf92e495026baf2a1d419/services/auth/basic.go#L55-L58
* add `username` to OIDC introspection response (#31688)Shivaram Lingamneni2024-07-251-2/+6
| | | | | | | | | This field is specified as optional here: https://datatracker.ietf.org/doc/html/rfc7662#section-2.2 It's used by some OIDC integrations, e.g. https://emersion.fr/blog/2022/irc-and-oauth2/ Co-authored-by: Giteabot <teabot@gitea.io>
* Support delete user email in admin panel (#31690)yp053272024-07-252-0/+31
| | | | | | | | | | | ![QQ_1721784609320](https://github.com/user-attachments/assets/23f08bf3-93f4-44d7-963d-10380ef8c1f1) ![QQ_1721784616403](https://github.com/user-attachments/assets/667cbd1e-5e21-4489-8d18-2a7be85190db) ![QQ_1721784626722](https://github.com/user-attachments/assets/495beb94-dfa2-481c-aa60-d5115cad1ae1) --------- Co-authored-by: Jason Song <i@wolfogre.com>
* Use GetDisplayName() instead of DisplayName() to generate rss feeds (#31687)Stanislas Dolcini2024-07-251-3/+3
| | | | | Fixes #31491 The RSS feed converted ignored the setting used in the application.
* fix OIDC introspection authentication (#31632)Shivaram Lingamneni2024-07-231-18/+28
| | | | | | | | | | | | | | | | | | | | | See discussion on #31561 for some background. The introspect endpoint was using the OIDC token itself for authentication. This fixes it to use basic authentication with the client ID and secret instead: * Applications with a valid client ID and secret should be able to successfully introspect an invalid token, receiving a 200 response with JSON data that indicates the token is invalid * Requests with an invalid client ID and secret should not be able to introspect, even if the token itself is valid Unlike #31561 (which just future-proofed the current behavior against future changes to `DISABLE_QUERY_AUTH_TOKEN`), this is a potential compatibility break (some introspection requests without valid client IDs that would previously succeed will now fail). Affected deployments must begin sending a valid HTTP basic authentication header with their introspection requests, with the username set to a valid client ID and the password set to the corresponding client secret.
* add skip secondary authorization option for public oauth2 clients (#31454)Denys Konovalov2024-07-192-12/+14
|
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-162-38/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Refactor webhook (#31587)wxiaoguang2024-07-101-1/+1
| | | | | | A more complete fix for #31588 1. Make "generic" code more readable 2. Clarify HTML or Markdown for the payload content
* Allow disabling authentication related user features (#31535)Rowan Bohde2024-07-0912-0/+118
| | | | | | | | | | | | | | | | | | | | We have some instances that only allow using an external authentication source for authentication. In this case, users changing their email, password, or linked OpenID connections will not have any effect, and we'd like to prevent showing that to them to prevent confusion. Included in this are several changes to support this: * A new setting to disable user managed authentication credentials (email, password & OpenID connections) * A new setting to disable user managed MFA (2FA codes & WebAuthn) * Fix an issue where some templates had separate logic for determining if a feature was disabled since it didn't check the globally disabled features * Hide more user setting pages in the navbar when their settings aren't enabled --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>