summaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
* Fix leaving organization bug on user settings -> orgs (#21983) (#22438)zeripath2023-01-161-2/+9
| | | | | | | | | | | | Backport #21983 Fix #21772 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: 花墨 <shanee@live.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Prevent panic on looking at api "git" endpoints for empty repos (#22457) ↵zeripath2023-01-151-1/+1
| | | | | | | | | | | | | | (#22458) Backport #22457 The API endpoints for "git" can panic if they are called on an empty repo. We can simply allow empty repos for these endpoints without worry as they should just work. Fix #22452 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Prepend refs/heads/ to issue template refs (#20461) (#22427)zeripath2023-01-131-0/+4
| | | | | Backport #20461 Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix: update settings table on install (#22326) (#22327)John Olheiser2023-01-031-4/+7
| | | | | Backport #22326 Signed-off-by: jolheiser <john.olheiser@gmail.com>
* fix: code search title translation (#22285) (#22316)John Olheiser2023-01-031-1/+1
| | | | | | | Backport #22285 Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Add `sync_on_commit` option for push mirrors api (#22271) (#22292)Chongyi Zheng2022-12-311-4/+5
| | | Backport of #22271
* Fix key signature error page (#22229) (#22230)Gusted2022-12-301-3/+9
| | | | | | | | | | | | | | | - Backport of #22229 - When the GPG key contains an error, such as an invalid signature or an email address that does not match the user.A page will be shown that says you must provide a signature for the token. - This page had two errors: one had the wrong translation key and the other tried to use an undefined variable [`.PaddedKeyID`](https://github.com/go-gitea/gitea/blob/e81ccc406bf723a5a58d685e7782f281736affd4/models/asymkey/gpg_key.go#L65-L72), which is a function implemented on the `GPGKey` struct, given that we don't have that, we use [`KeyID`](https://github.com/go-gitea/gitea/blob/e81ccc406bf723a5a58d685e7782f281736affd4/routers/web/user/setting/keys.go#L102) which is [the fingerprint of the publickey](https://pkg.go.dev/golang.org/x/crypto/openpgp/packet#PublicKey.KeyIdString) and is a valid way for opengpg to refer to a key.
* refactor auth interface to return error when verify failure (#22119) (#22259)Lunny Xiao2022-12-294-17/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | backport #22119 This PR changed the Auth interface signature from `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User` to `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)`. There is a new return argument `error` which means the verification condition matched but verify process failed, we should stop the auth process. Before this PR, when return a `nil` user, we don't know the reason why it returned `nil`. If the match condition is not satisfied or it verified failure? For these two different results, we should have different handler. If the match condition is not satisfied, we should try next auth method and if there is no more auth method, it's an anonymous user. If the condition matched but verify failed, the auth process should be stop and return immediately. This will fix #20563 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Jason Song <i@wolfogre.com>
* Use complete SHA to create and query commit status (#22244) (#22257)Jason Song2022-12-283-1/+31
| | | | | | | | | | | | | Backport #22244. Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove ReverseProxy authentication from the API (#22219) (#22251)Lunny Xiao2022-12-271-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | backport from #22219 Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace #22077 Close #22221 Close #22077 Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>
* Allow empty assignees on pull request edit (#22150) (#22214)KN4CK3R2022-12-221-0/+5
| | | | | Backport of #22150 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Normalize NuGet package version on upload (#22186) (#22200)KN4CK3R2022-12-212-20/+4
| | | | | Backport of #22186 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Ensure that plain files are rendered correctly even when containing ↵zeripath2022-12-191-16/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ambiguous characters (#22017) (#22160) Backport #22017 As recognised in #21841 the rendering of plain text files is somewhat incorrect when there are ambiguous characters as the html code is double escaped. In fact there are several more problems here. We have a residual isRenderedHTML which is actually simply escaping the file - not rendering it. This is badly named and gives the wrong impression. There is also unusual behaviour whether the file is called a Readme or not and there is no way to get to the source code if the file is called README. In reality what should happen is different depending on whether the file is being rendered a README at the bottom of the directory view or not. 1. If it is rendered as a README on a directory - it should simply be escaped and rendered as `<pre>` text. 2. If it is rendered as a file then it should be rendered as source code. This PR therefore does: 1. Rename IsRenderedHTML to IsPlainText 2. Readme files rendered at the bottom of the directory are rendered without line numbers 3. Otherwise plain text files are rendered as source code. Replace #21841 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix condition for is_internal (#22095) (#22132)KN4CK3R2022-12-141-2/+3
| | | | | | | | | | | Backport of #22095 I changed it to a static condition because it needs a new version of xorm which is only available in 1.19. This change is valid because `SearchLatestVersions` is never called to list internal versions and there will no change to this behaviour in <1.19. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix sorting admin user list by last login (#22081) (#22107)aceArt-GmbH2022-12-131-0/+4
|
* Fix permission check on issue/pull lock (#22113)Lunny Xiao2022-12-121-3/+2
| | | backport #22110
* Workaround for container registry push/pull errors (#21862) (#22068)KN4CK3R2022-12-103-4/+68
| | | | | Backport of #21862 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix ListBranches to handle empty case (#21921) (#22024)Lunny Xiao2022-12-041-26/+34
| | | | | | | | Fix #21910 Backport #21921 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Multiple improvements for comment edit diff (#21990) (#22007)silverwind2022-12-021-4/+9
| | | | | | | | | | | | | | Backport #21990 - Use explicit avatar size so when JS copies the HTML, the size gets copied with it - Replace icon font use with SVG - Improve styling and diff rendering - Sort lists in `svg.js` Fixes: https://github.com/go-gitea/gitea/issues/21924 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Prevent NPE if trying to restore an already restored deleted branch (#21940) ↵zeripath2022-11-251-0/+4
| | | | | | | | | | | | | | (#21944) Backport #21940 If a deleted-branch has already been restored, a request to restore it again will cause a NPE. This PR adds detection for this case, but also disables buttons when they're clicked in order to help prevent accidental repeat requests. Fix #21930 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add support for HEAD requests in Maven registry (#21834) (#21929)KN4CK3R2022-11-2517-32/+120
| | | | | Backport of #21834 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix setting HTTP headers after write (#21833) (#21877)KN4CK3R2022-11-224-31/+25
| | | | | Backport of #21833 Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Load GitRepo in API before deleting issue (#21720) (#21796)Jason Song2022-11-131-1/+1
| | | | | | | | | | | | | | Backport #21720. Fix #20921. The `ctx.Repo.GitRepo` has been used in deleting issues when the issue is a PR. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Set last login when activating account (#21731) (#21755)Jason Song2022-11-111-0/+7
| | | | | | | | | | | | Backport #21731. Fix #21698. Set the last login time to the current time when activating the user successfully. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Revert unrelated changes for SMTP auth (#21767) (#21768)wxiaoguang2022-11-101-1/+1
| | | | | | | | | | | Backport #21767 The purpose of #18982 is to improve the SMTP mailer, but there were some unrelated changes made to the SMTP auth in https://github.com/go-gitea/gitea/pull/18982/commits/d60c43869420f5fc43ad19b454c9ae50dad65964 This PR reverts these unrelated changes, fix #21744 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix dashboard ignored system setting cache (#21621) (#21759)Lunny Xiao2022-11-101-2/+5
| | | | | | | | backport #21621 This is a performance regression from #18058 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Remove semver compatible flag and change pypi to an array of test cases ↵Wayne Starr2022-11-092-4/+47
| | | | | | | | | | | | (#21708) (#21730) Backport (#21708) This addresses #21707 and adds a second package test case for a non-semver compatible version (this might be overkill though since you could also edit the old package version to have an epoch in front and see the error, this just seemed more flexible for the future). Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Allow local package identifiers for PyPI packages (#21690) (#21727)Wayne Starr2022-11-091-2/+9
| | | | | | | | Backport (#21690) Fixes #21683 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix token generation when using INTERNAL_TOKEN_URI (#21669) (#21670)wxiaoguang2022-11-031-5/+9
| | | | | | | | | | | | Backport #21669 Fix https://github.com/go-gitea/gitea/issues/21666 Caused by https://github.com/go-gitea/gitea/pull/19663 Before: when install, the INTERNAL_TOKEN was always generated and saved. But the internal token may be already there by INTERNAL_TOKEN_URI After: INTERNAL_TOKEN_URI file must be non-empty. When install, skip internal token generation if the token exists.
* Sync git hooks when config file path changed (#21619) (#21626)Jason Song2022-10-301-3/+13
| | | | | | | | | | | Backport #21619 . A patch to #17335. Just like AppPath, Gitea writes its own CustomConf into git hook scripts too. If Gitea's CustomConf changes, then the git push may fail. Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: zeripath <art27@cantab.net>
* Fix 500 on PR files API (#21602) (#21607)qwerty2872022-10-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | Fixes an 500 error/panic if using the changed PR files API with pages that should return empty lists because there are no items anymore. `start-end` is then < 0 which ends in panic. Backport https://github.com/go-gitea/gitea/pull/21602 <!-- Please check the following: 1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for bug fixes. 2. Read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md 3. Describe what your pull request does and which issue you're targeting (if any) --> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: delvh <dev.lh@web.de>
* Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551)delvh2022-10-2413-25/+25
| | | | | | | | | Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix package access for admins and inactive users (#21580)KN4CK3R2022-10-241-0/+2
| | | | | | | | I noticed an admin is not allowed to upload packages for other users because `ctx.IsSigned` was not set. I added a check for `user.IsActive` and `user.ProhibitLogin` too because both was not checked. Tests enforce this now. Co-authored-by: Lauris BH <lauris@nix.lv>
* Allow for resolution of NPM registry paths that match upstream (#21568)Wayne Starr2022-10-242-0/+45
| | | | | | | | | | | | This PR fixes issue #21567 allowing for package tarball URLs to match the upstream registry (and GitLab/JFrog Artifactory URLs). It uses a regex to parse the filename (which contains the NPM version) and does a fuzzy search to pull it out. The regex was built/expanded from http://json.schemastore.org/package, https://github.com/Masterminds/semver, and https://docs.npmjs.com/cli/v6/using-npm/semver and is testable here: https://regex101.com/r/OydBJq/5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Record OAuth client type at registration (#21316)M Hickford2022-10-243-15/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* adapt README_{Country}.md stype name in localizedExtensions (#21486)a10121127962022-10-242-5/+5
| | | | | | | | This stype name is also used in many repos, example: [``README_ZH.md``](https://github.com/go-gitea/gitea/blob/main/README_ZH.md) Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Refactor git command arguments and make all arguments to be safe to be used ↵wxiaoguang2022-10-238-11/+11
| | | | | | | (#21535) Follow #21464 Make all git command arguments strictly safe. Most changes are one-to-one replacing, keep all existing logic.
* Require authentication for OAuth token refresh (#21421)M Hickford2022-10-231-0/+29
| | | | | | | | | | | | | | According to the OAuth spec https://datatracker.ietf.org/doc/html/rfc6749#section-6 when "Refreshing an Access Token" > The authorization server MUST ... require client authentication for confidential clients Fixes #21418 Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow package version sorting (#21453)KN4CK3R2022-10-231-1/+6
|
* Add link to user profile in markdown mention only if user exists (#21533)Yarden Shoham2022-10-232-1/+9
| | | | | | | | | | | Previously mentioning a user would link to its profile, regardless of whether the user existed. This change tests if the user exists and only if it does - a link to its profile is added. * Fixes #3444 Signed-off-by: Yarden Shoham <hrsi88@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Remove deleted repos from searchresult (#21512)Raymond2022-10-221-0/+12
| | | | | | | | | | | This prevents a 500 response, because null pointer exceptions in rendering the template. This happends bc the repoId is not in the repoMap because it is delete fix #19076 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Added check for disabled Packages (#21540)rock2dust2022-10-221-0/+1
| | | | | | | | | | At the moment, If admin disable Packages, still show the Packages on the admin dashboard This patch added a check to hide the Packages entry Signed-off-by: baronbunny <its@baronbunny.cn> Signed-off-by: baronbunny <its@baronbunny.cn>
* Decouple HookTask from Repository (#17940)KN4CK3R2022-10-213-5/+4
| | | | | | | | | | | | | At the moment a repository reference is needed for webhooks. With the upcoming package PR we need to send webhooks without a repository reference. For example a package is uploaded to an organization. In theory this enables the usage of webhooks for future user actions. This PR removes the repository id from `HookTask` and changes how the hooks are processed (see `services/webhook/deliver.go`). In a follow up PR I want to remove the usage of the `UniqueQueue´ and replace it with a normal queue because there is no reason to be unique. Co-authored-by: 6543 <6543@obermui.de>
* move invite by mail to services package (#21513)65432022-10-201-6/+1
| | | | | | followup #20307 close #21511 -> make it easy to also add API equivalent later ...
* Suppress `ExternalLoginUserNotExist` error (#21504)KN4CK3R2022-10-192-2/+8
| | | | | | | | Fixes #21202 Closes #21276 An `ExternalLoginUser` is not mandatory if the current user account was created with/by the external login source.
* Add team member invite by email (#20307)KN4CK3R2022-10-192-23/+147
| | | | | | | | | | | | | | | | | | | | | | | Allows to add (not registered) team members by email. related #5353 Invite by mail: ![grafik](https://user-images.githubusercontent.com/1666336/178154779-adcc547f-c0b7-4a2a-a131-4e41a3d9d3ad.png) Pending invitations: ![grafik](https://user-images.githubusercontent.com/1666336/178154882-9d739bb8-2b04-46c1-a025-c1f4be26af98.png) Email: ![grafik](https://user-images.githubusercontent.com/1666336/178164716-f2f90893-7ba6-4a5e-a3db-42538a660258.png) Join form: ![grafik](https://user-images.githubusercontent.com/1666336/178154840-aaab983a-d922-4414-b01a-9b1a19c5cef7.png) Co-authored-by: Jack Hay <jjphay@gmail.com>
* Fix read system configuration bug when installing (#21489)Lunny Xiao2022-10-181-13/+5
| | | | | Fix https://github.com/go-gitea/gitea/pull/18058#issuecomment-1280944311 Co-authored-by: 6543 <6543@obermui.de>
* Add some api integration tests (#18872)KN4CK3R2022-10-181-1/+1
| | | | | | | | | | depends on #18871 Added some api integration tests to help testing of #18798. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add system setting table with cache and also add cache supports for user ↵Lunny Xiao2022-10-177-187/+257
| | | | setting (#18058)
* Return 404 when user is not found on avatar (#21476)Gusted2022-10-161-0/+4
| | | | - Instead of returning a 500 Internal Server when the user wasn't found, return 404 Not found
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 12:55:32 +0000