summaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
...
* packages/generic: Do not restrict package versions to SemVer (#20414)Gergely Nagy2022-07-291-8/+6
| | | | | | | There are existing packages out there whose version do not conform to SemVer, yet, one would like to have them available in a generic package repository. To this end, remove the SemVer restriction on package versions when using the Generic package registry, and replace it with a check that simply makes sure the version isn't empty. Signed-off-by: Gergely Nagy <me@gergo.csillger.hu> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de>
* Added email notification option to receive all own messages (#20179)Tyrone Yeh2022-07-281-1/+2
| | | | | | Sometimes users want to receive email notifications of messages they create or reply to, Added an option to personal preferences to allow users to choose Closes #20149
* Add Docker /v2/_catalog endpoint (#20469)KN4CK3R2022-07-289-6/+73
| | | | | | | | | | | | | * Added properties for packages. * Fixed authenticate header format. * Added _catalog endpoint. * Check owner visibility. * Extracted condition. * Added test for _catalog. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix possible panic when repository is empty (#20509)Lunny Xiao2022-07-281-4/+8
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show hint to link package to repo when viewing empty repo package list (#20504)Norwin2022-07-271-0/+4
| | | | | | | * show hint to link package to repo on empty repo package listing * reword
* Hide internal package versions (#20492)KN4CK3R2022-07-279-28/+51
| | | | | * Hide internal versions from most searches. * Added test.
* fix enabling repo packages when projects are off (#20486)Norwin2022-07-261-1/+1
|
* Slightly simplify LastCommitCache (#20444)zeripath2022-07-255-23/+27
| | | | | | | | | | | The LastCommitCache code is a little complex and there is unnecessary duplication between the gogit and nogogit variants. This PR adds the LastCommitCache as a field to the git.Repository and pre-creates it in the ReferencesGit helpers etc. There has been some simplification and unification of the variant code. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add repository condition for issue count (#20454)Tyrone Yeh2022-07-241-0/+1
| | | | | | | | | | * Add repository condition for issue count * Update routers/web/user/home.go Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Prepend commit message to template content (#20429)Gusted2022-07-241-0/+13
| | | | | | | | | - When a repository has a pull request template, it will always override the current content. With this PR it will prepend content to the template content when appropriate. This is similar how GitHub(and GitLab I presume) does it and it saves developers time to not go open their commit and copy paste their will written commit message.
* Add Cache-Control header to html and api responses, add no-transform (#20432)silverwind2022-07-232-0/+3
| | | | | | | | | | | | `no-transform` allegedly disables CloudFlare auto-minify and we did not set caching headers on html or api requests, which seems good to have regardless. Transformation is still allowed for asset requests. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Add "X-Gitea-Object-Type" header for GET `/raw/` & `/media/` API (#20438)65432022-07-211-4/+10
|
* Dismiss prior pull reviews if done via web in review dismiss (#20197)65432022-07-192-5/+5
|
* Fix public org members displayed too many informations (#20403)Lunny Xiao2022-07-191-0/+1
|
* Set target on create release with existing tag (#20381)Gusted2022-07-151-0/+1
| | | | | | When you create a new release(e.g. via Tea) and specify a tag that already exists on the repository, Gitea will instead use the `UpdateRelease` functionality. However it currently doesn't set the Target field. This PR fixes that.
* Initialize cron last (#20373)zeripath2022-07-151-1/+3
| | | | | | Cron will try to run certain things at startup but these depend on multiple things being set-up. Therefore we should initialize cron last. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow access to the Public Organization Member lists with minimal ↵a10121127962022-07-152-6/+6
| | | | | | | | | | | permissions (#20330) Examining Organization membership should not necessarily require sign-in if the organization is public and the members are public. Therefore we should adjust `/org/{org}/members` to not require login. Fix #7501 Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: zeripath <art27@cantab.net>
* Fix commit status icon when in subdirectory (#20285)silverwind2022-07-151-7/+7
| | | | | | When viewing a subdirectory and the latest commit to that directory in the table, the commit status icon incorrectly showed the status of the HEAD commit instead of the latest for that directory.
* Add option to purge users (#18064)zeripath2022-07-143-18/+8
| | | | | | | Add the ability to purge users when deleting them. Close #15588 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add missing return for when topic isn't found (#20351)Gusted2022-07-131-0/+1
| | | Add missing return to DeleteTopic API when the topic is not found.
* Fix various typos (#20338)luzpaz2022-07-127-11/+11
| | | | | | | * Fix various typos Found via `codespell -q 3 -S ./options/locale,./options/license,./public/vendor -L actived,allways,attachements,ba,befores,commiter,pullrequest,pullrequests,readby,splitted,te,unknwon` Co-authored-by: zeripath <art27@cantab.net>
* Add write check for creating Commit status (#20332)Gusted2022-07-121-1/+1
| | | | | | - Add write code checks for creating new commit status - Regression #5314 Co-authored-by: zeripath <art27@cantab.net>
* Add spectral linter for Swagger (#20321)silverwind2022-07-112-4/+1
| | | | | | | | | | [spectral](https://github.com/stoplightio/spectral) lints openapi/swagger files for mistakes of which it has identified a few and which I've fixed. I had to put it into `lint-frontend` because it depends on node_modules so can not run on Drone during the backend target. I plan to refactor these targets later to `lint-js` and `lint-go` so that they are categorized based on the tool dependencies.
* Refactor SSH init code, fix directory creation for TrustedUserCAKeys file ↵wxiaoguang2022-07-101-10/+2
| | | | | | | | | | | | | | | | (#20299) * Refactor SSH init code, fix directory creation for TrustedUserCAKeys file * Update modules/ssh/init.go Co-authored-by: zeripath <art27@cantab.net> * fix lint copyright * Update modules/ssh/init.go Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Implement sync push mirror on commit (#19411)Chongyi Zheng2022-07-082-8/+10
| | | | | | | | | Support synchronizing with the push mirrors whenever new commits are pushed or synced from pull mirror. Related Issues: #18220 Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Only show Followers that current user can access (#20220)zeripath2022-07-052-8/+8
| | | | | | | | Users who are following or being followed by a user should only be displayed if the viewing user can see them. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Check if project has the same repository id with issue when assign project ↵Lunny Xiao2022-06-305-6/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | to issue (#20133) * Check if project has the same repository id with issue when assign project to issue * Check if issue's repository id match project's repository id * Add more permission checking * Remove invalid argument * Fix errors * Add generic check * Remove duplicated check * Return error + add check for new issues * Apply suggestions from code review Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: 6543 <6543@obermui.de>
* Refactor `i18n` to `locale` (#20153)Gusted2022-06-273-3/+3
| | | | | | | | | | | * Refactor `i18n` to `locale` - Currently we're using the `i18n` variable naming for the `locale` struct. This contains locale's specific information and cannot be used for general i18n purpose, therefore refactoring it to `locale` makes more sense. - Ref: https://github.com/go-gitea/gitea/pull/20096#discussion_r906699200 * Update routers/install/install.go
* Hide notify mail setting ui if not enabled (#20138)Lunny Xiao2022-06-281-0/+1
|
* Add missing parameter for error in log message (#20144)Gusted2022-06-271-1/+1
| | | | | - Adds a `%v` for the last parameter, `err`. Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Remove U2F support (#20141)Gusted2022-06-263-15/+3
| | | | | | - Completely remove U2F support from 1.18.0, 1.17.0 will be the last release that U2F is somewhat supported. Users who used U2F would already be warned about using U2F for a while now and should hopefully already be migrated. But starting 1.18 definitely remove it.
* Make better use of i18n (#20096)Gusted2022-06-268-21/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Prototyping * Start work on creating offsets * Modify tests * Start prototyping with actual MPH * Twiddle around * Twiddle around comments * Convert templates * Fix external languages * Fix latest translation * Fix some test * Tidy up code * Use simple map * go mod tidy * Move back to data structure - Uses less memory by creating for each language a map. * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Add some comments * Fix tests * Try to fix tests * Use en-US as defacto fallback * Use correct slices * refactor (#4) * Remove TryTr, add log for missing translation key * Refactor i18n - Separate dev and production locale stores. - Allow for live-reloading in dev mode. Co-authored-by: zeripath <art27@cantab.net> * Fix live-reloading & check for errors * Make linter happy * live-reload with periodic check (#5) * Fix tests Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Use neutral language in comments and docs (#20135)Gusted2022-06-251-1/+1
| | | - Replace `his/her` to `their`, as it's more neutral language.
* Add sitemap support (#18407)Daniil Gentili2022-06-254-2/+105
|
* Allow manager logging to set SQL (#20064)zeripath2022-06-242-0/+8
| | | | | | | | | | | This PR adds a new manager command to switch on SQL logging and to turn it off. ``` gitea manager logging log-sql gitea manager logging log-sql --off ``` Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix wrong login requirement routers (#20101)Lunny Xiao2022-06-231-1/+1
|
* Respect setting.UI.FeedPagingNum (#20094)Jimmy Praet2022-06-232-0/+2
| | | Fixes #20080
* Release page show all tags in compare dropdown (#20070)65432022-06-211-1/+8
| | | address #19936
* Catch the error before the response is processed by goth. (#20000)SteveTheEngineer2022-06-201-12/+20
| | | | | | | The code introduced by #18185 gets the error from response after it was processed by goth. That is incorrect, as goth (and golang.org/x/oauth) doesn't really care about the error, and it sends a token request with an empty authorization code to the server anyway, which always results in a `oauth2: cannot fetch token: 400 Bad Request` error from goth. It means that unless the "state" parameter is omitted from the error response (which is required to be present, according to [RFC 6749, Section 4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)) or the page is reloaded (makes the session invalid), a 500 Internal Server Error page will be displayed. This fixes it by handling the error before the request is passed to goth.
* Add more linters to improve code readability (#19989)Wim2022-06-2020-26/+24
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* fix delete pull head ref for DeleteIssue (#20032)a10121127962022-06-191-0/+5
| | | | | | | | | | | | | * fix delete pull head ref for DeleteIssue fix #19655 Signed-off-by: a1012112796 <1012112796@qq.com> * add different help message for delete pull request Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: 6543 <6543@obermui.de>
* User keypairs and HTTP signatures for ActivityPub federation using go-ap ↵Anthony Wang2022-06-195-0/+238
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#19133) * go.mod: add go-fed/{httpsig,activity/pub,activity/streams} dependency go get github.com/go-fed/activity/streams@master go get github.com/go-fed/activity/pub@master go get github.com/go-fed/httpsig@master * activitypub: implement /api/v1/activitypub/user/{username} (#14186) Return informations regarding a Person (as defined in ActivityStreams https://www.w3.org/TR/activitystreams-vocabulary/#dfn-person). Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: add the public key to Person (#14186) Refs: https://github.com/go-gitea/gitea/issues/14186 Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: go-fed conformant Clock instance Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: signing http client Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: implement the ReqSignature middleware Signed-off-by: Loïc Dachary <loic@dachary.org> * activitypub: hack_16834 Signed-off-by: Loïc Dachary <loic@dachary.org> * Fix CI checks-backend errors with go mod tidy Signed-off-by: Anthony Wang <ta180m@pm.me> * Change 2021 to 2022, properly format package imports Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt and make generate-swagger Signed-off-by: Anthony Wang <ta180m@pm.me> * Use Gitea JSON library, add assert for pkp Signed-off-by: Anthony Wang <ta180m@pm.me> * Run make fmt again, fix err var redeclaration Signed-off-by: Anthony Wang <ta180m@pm.me> * Remove LogSQL from ActivityPub person test Signed-off-by: Anthony Wang <ta180m@pm.me> * Assert if json.Unmarshal succeeds Signed-off-by: Anthony Wang <ta180m@pm.me> * Cleanup, handle invalid usernames for ActivityPub person GET request Signed-off-by: Anthony Wang <ta180m@pm.me> * Rename hack_16834 to user_settings Signed-off-by: Anthony Wang <ta180m@pm.me> * Use the httplib module instead of http for GET requests * Clean up whitespace with make fmt * Use time.RFC1123 and make the http.Client proxy-aware * Check if digest algo is supported in setting module * Clean up some variable declarations * Remove unneeded copy * Use system timezone instead of setting.DefaultUILocation * Use named constant for httpsigExpirationTime * Make pubKey IRI #main-key instead of /#main-key * Move /#main-key to #main-key in tests * Implemented Webfinger endpoint. * Add visible check. * Add user profile as alias. * Add actor IRI and remote interaction URL to WebFinger response * fmt * Fix lint errors * Use go-ap instead of go-fed * Run go mod tidy to fix missing modules in go.mod and go.sum * make fmt * Convert remaining code to go-ap * Clean up go.sum * Fix JSON unmarshall error * Fix CI errors by adding @context to Person() and making sure types match * Correctly decode JSON in api_activitypub_person_test.go * Force CI rerun * Fix TestActivityPubPersonInbox segfault * Fix lint error * Use @mariusor's suggestions for idiomatic go-ap usage * Correctly add inbox/outbox IRIs to person * Code cleanup * Remove another LogSQL from ActivityPub person test * Move httpsig algos slice to an init() function * Add actor IRI and remote interaction URL to WebFinger response * Update TestWebFinger to check for ActivityPub IRI in aliases * make fmt * Force CI rerun * WebFinger: Add CORS header and fix Href -> Template for remote interactions The CORS header is needed due to https://datatracker.ietf.org/doc/html/rfc7033#section-5 and fixes some Peertube <-> Gitea federation issues * make lint-backend * Make sure Person endpoint has Content-Type application/activity+json and includes PreferredUsername, URL, and Icon Setting the correct Content-Type is essential for federating with Mastodon * Use UTC instead of GMT * Rename pkey to pubKey * Make sure HTTP request Date in GMT * make fmt * dont drop err * Make sure API responses always refer to username in original case Copied from what I wrote on #19133 discussion: Handling username case is a very tricky issue and I've already encountered a Mastodon <-> Gitea federation bug due to Gitea considering Ta180m and ta180m to be the same user while Mastodon thinks they are two different users. I think the best way forward is for Gitea to only use the original case version of the username for federation so other AP software don't get confused. * Move httpsig algs constant slice to modules/setting/federation.go * Add new federation settings to app.example.ini and config-cheat-sheet * Return if marshalling error * Make sure Person IRIs are generated correctly This commit ensures that if the setting.AppURL is something like "http://127.0.0.1:42567" (like in the integration tests), a trailing slash will be added after that URL. * If httpsig verification fails, fix Host header and try again This fixes a very rare bug when Gitea and another AP server (confirmed to happen with Mastodon) are running on the same machine, Gitea fails to verify incoming HTTP signatures. This is because the other AP server creates the sig with the public Gitea domain as the Host. However, when Gitea receives the request, the Host header is instead localhost, so the signature verification fails. Manually changing the host header to the correct value and trying the veification again fixes the bug. * Revert "If httpsig verification fails, fix Host header and try again" This reverts commit f53e46c721a037c55facb9200106a6b491bf834c. The bug was actually caused by nginx messing up the Host header when reverse-proxying since I didn't have the line `proxy_set_header Host $host;` in my nginx config for Gitea. * Go back to using ap.IRI to generate inbox and outbox IRIs * use const for key values * Update routers/web/webfinger.go * Use ctx.JSON in Person response to make code cleaner * Revert "Use ctx.JSON in Person response to make code cleaner" This doesn't work because the ctx.JSON() function already sends the response out and it's too late to edit the headers. This reverts commit 95aad988975be3393c76094864ed6ba962157e0c. * Use activitypub.ActivityStreamsContentType for Person response Content Type * Limit maximum ActivityPub request and response sizes to a configurable setting * Move setting key constants to models/user/setting_keys.go * Fix failing ActivityPubPerson integration test by checking the correct field for username * Add a warning about changing settings that can break federation * Add better comments * Don't multiply Federation.MaxSize by 1<<20 twice * Add more better comments * Fix failing ActivityPubMissingPerson test We now use ctx.ContextUser so the message printed out when a user does not exist is slightly different * make generate-swagger For some reason I didn't realize that /templates/swagger/v1_json.tmpl was machine-generated by make generate-swagger... I've been editing it by hand for three months! 🤦 * Move getting the RFC 2616 time to a separate function * More code cleanup * Update go-ap to fix empty liked collection and removed unneeded HTTP headers * go mod tidy * Add ed25519 to httpsig algorithms * Use go-ap/jsonld to add @context and marshal JSON * Change Gitea user agent from the default to Gitea/Version * Use ctx.ServerError and remove all remote interaction code from webfinger.go
* Stop spurious APIFormat stopwatches logs (#20008)zeripath2022-06-171-1/+3
| | | | | | | | | If there are dangling stopwatches with missing issues there will be repeated logging of Unable to APIFormat stopwatches. These are unhelpful and instead we should only log if the error is not an issue not exist error. And we should also prevent an error on missing issue in GetActiveStopwatch too Signed-off-by: Andrew Thornton <art27@cantab.net>
* move agit dependcy (#19998)Lunny Xiao2022-06-171-2/+13
|
* Fix Readme render bug (#19992)Lunny Xiao2022-06-171-1/+1
| | | | | Fix #19988 Co-authored-by: zeripath <art27@cantab.net>
* Use DisplayName() instead of FullName in Oauth provider (#19991)oGi4i2022-06-162-1/+20
| | | | | Use DisplayName() in Oauth as this provides a fallback if FullName is not set. Closes #19382
* fix permission check for delete tag (#19985)a10121127962022-06-165-1/+38
| | | | | | | fix #19970 by the way, fix some error response about protected tags. Signed-off-by: a1012112796 <1012112796@qq.com>
* Allow render HTML with css/js external links (#19017)Lunny Xiao2022-06-164-18/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Allow render HTML with css/js external links * Fix bug because of filename escape chars * Fix lint * Update docs about new configuration item * Fix bug of render HTML in sub directory * Add CSP head for displaying iframe in rendering file * Fix test * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Some improvements * some improvement * revert change in SanitizerDisabled of external renderer * Add sandbox for iframe and support allow-scripts and allow-same-origin * refactor * fix * fix lint * fine tune * use single option RENDER_CONTENT_MODE, use sandbox=allow-scripts * fine tune CSP * Apply suggestions from code review Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* In code search, get code unit accessible repos in one (main) query (#19764)Hugo Hoitink2022-06-161-87/+57
| | | | | | | | | | * When non-admin users use code search, get code unit accessible repos in one main query * Modified some comments to match the changes * Removed unnecessary check for Access Mode in Collaboration table Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Remove tab/TabName usage where it's not needed (#19973)Lauris BH2022-06-151-0/+1
| | | `tab` query argument and `TabName` in context is used only in profile so remove it from all other places where it's not used anymore.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 05:30:02 +0000