summaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
* fix incorrect repo url when changed the case of ownername (#25733) (#25881)Giteabot2023-07-151-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | Backport #25733 by @hiifong When only the casing of the username changes, update the owner name of the repo, and keep the original logic consistent with other conditions. example: assume your username is `gitea`, lowercase username is `gitea` too, repo URL is `.../gitea/{repo}`. You change your username to `Gitea`, `GiTea` or something like that, as long as the lowercase username is still `gitea`, the repo URL remained `.../gitea/{repo}`. this pr keeps the new username consistent with the repo URL. Before: ![image](https://github.com/go-gitea/gitea/assets/89133723/84177296-f0ff-4176-84f1-1f9ec3f5b86f) ![image](https://github.com/go-gitea/gitea/assets/89133723/8f8f4a12-ecdd-4dec-af89-85c009b0ccfe) After: ![image](https://github.com/go-gitea/gitea/assets/89133723/0564edb6-9467-405a-8cd4-d6f70e6f614b) ![image](https://github.com/go-gitea/gitea/assets/89133723/554ecd6e-e5a1-43bc-a46d-99e988c2ff58) Co-authored-by: hiifong <i@hiif.ong>
* Add support for different Maven POM encoding (#25873) (#25890)Giteabot2023-07-141-1/+7
| | | | | | | | | | Backport #25873 by @KN4CK3R Fixes #25853 - Maven POM files aren't always UTF-8 encoded. - Reject the upload of unparsable POM files Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix incorrect release count (#25879) (#25887)Giteabot2023-07-141-1/+0
| | | | | | | | | | | | | | | | | | | | | | Backport #25879 by @yp05327 Release count is not correct: https://try.gitea.io/yp05327/testrepo/tags ![image](https://github.com/go-gitea/gitea/assets/18380374/07f97c62-d450-4ccb-b3f2-3e0af9d9fc52) https://try.gitea.io/yp05327/testrepo/releases ![image](https://github.com/go-gitea/gitea/assets/18380374/6f1d55a4-bb68-445d-84b9-90552a40f403) https://try.gitea.io/yp05327/testrepo/releases/tag/testtag ![image](https://github.com/go-gitea/gitea/assets/18380374/09ab5d51-52b6-4621-a571-3100198eb260) We already have correct release count, no need to calculate it again. https://github.com/go-gitea/gitea/blob/c5e187c389b35b9e080a3187b93a775a3c81e585/modules/context/repo.go#L547 Co-authored-by: yp05327 <576951401@qq.com>
* Fix empty project displayed in issue sidebar (#25802) (#25854)Giteabot2023-07-122-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25802 by @yp05327 You can confirm this issue in https://try.gitea.io/yp05327/testrepo/issues/2 Before: ![image](https://github.com/go-gitea/gitea/assets/18380374/1ab476dc-2f9b-4c85-9e87-105fc73af1ee) After: ![image](https://github.com/go-gitea/gitea/assets/18380374/786f984d-5c27-4eff-b3d9-159f68034ce4) This issue comes from the change in #25468. `LoadProject` will always return at least one record, so we use `ProjectID` to check whether an issue is linked to a project in the old code. As other `issue.LoadXXX` functions, we need to check the return value from `xorm.Session.Get`. In recent unit tests, we only test `issueList.LoadAttributes()` but don't test `issue.LoadAttributes()`. So I added a new test for `issue.LoadAttributes()` in this PR. Co-authored-by: yp05327 <576951401@qq.com> Co-authored-by: Denys Konovalov <privat@denyskon.de>
* Show correct SSL Mode on "install page" (#25818) (#25838)Giteabot2023-07-121-0/+1
| | | | | | | | | | Backport #25818 by @wxiaoguang Fix #25817 ![image](https://github.com/go-gitea/gitea/assets/2114189/49f7b85d-c229-41b5-86fd-58cd812eaca6) Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix incorrect oldest sort in project list (#25806) (#25835)Giteabot2023-07-122-2/+2
| | | | | | | | | | | | | Backport #25806 by @yp05327 sort type `oldest` should be `Asc`. Added a test for this. I see we have `SearchOrderBy` in db model, but we are using many different ways to define the sort type. ~Maybe we can improve this later.~ ↑ Improved in this PR Co-authored-by: yp05327 <576951401@qq.com>
* For API attachments, use API URL (#25639) (#25814)Giteabot2023-07-108-36/+36
| | | | | | | Backport #25639 by @lunny Fix #25257 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Make "install page" respect environment config (#25648) (#25799)wxiaoguang2023-07-101-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25648 Replace #25580 Fix #19453 The problem was: when users set "GITEA__XXX__YYY" , the "install page" doesn't respect it. So, to make the result consistent and avoid surprising end users, now the "install page" also writes the environment variables to the config file. And, to make things clear, there are enough messages on the UI to tell users what will happen. There are some necessary/related changes to `environment-to-ini.go`: * The "--clear" flag is removed and it was incorrectly written there. The "clear" operation should be done if INSTALL_LOCK=true * The "--prefix" flag is removed because it's never used, never documented and it only causes inconsistent behavior. The only conflict during backport is "ui divider" in templates/install.tmpl
* Fix notification list bugs (#25781) (#25787)Giteabot2023-07-091-1/+1
| | | | | | | | | | | | | Backport #25781 by @wxiaoguang Fix #25627 1. `ctx.Data["Link"]` should use relative URL but not AppURL 2. The `data-params` is incorrect because it doesn't contain "page". JS can simply use "window.location.search" to construct the AJAX URL 3. The `data-xxx` and `id` in notification_subscriptions.tmpl were copied&pasted, they don't have affect. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Test if container blob is accessible before mounting (#22759) (#25784)Giteabot2023-07-091-7/+15
| | | | | | | | | | | Backport #22759 by @KN4CK3R related #16865 This PR adds an accessibility check before mounting container blobs. Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: silverwind <me@silverwind.io>
* Check `ctx.Written()` for `GetActionIssue` (#25698) (#25711)Giteabot2023-07-065-11/+20
| | | | | | | | | Backport #25698 by @wolfogre Fix #25697. Just avoid panic, maybe there's another bug to trigger this case. Co-authored-by: Jason Song <i@wolfogre.com>
* Fix tags header and pretty format numbers (#25624) (#25694)Giteabot2023-07-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25624 by @lunny This casused by #23465 Before release disabled <img width="1320" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/190a1c81-daa5-41bc-91ac-c9a0bf629b5f"> release enabled <img width="1320" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/a0372c31-727c-4ee0-a6b9-30e502498d90"> After release disabled <img width="1304" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/a747ea80-a3d9-4792-8f6d-e8955da78b9e"> release enabled <img width="1290" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/7c0bc43a-9149-4148-859d-35839aeb60ca"> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Replace `interface{}` with `any` (#25686) (#25687)silverwind2023-07-0477-212/+212
| | | | Same perl replacement as https://github.com/go-gitea/gitea/pull/25686 but for 1.20 to ease future backporting.
* Fix the nil pointer when assigning issues to projects (#25665) (#25677)Giteabot2023-07-042-6/+10
| | | | | | | | Backport #25665 by @Zettat123 Fixes #25649 Caused by #25468 Co-authored-by: Zettat123 <zettat123@gmail.com>
* Log the real reason when authentication fails (but don't show the user) ↵Giteabot2023-07-033-12/+31
| | | | | | | | | (#25414) (#25660) Backport #25414 by @lunny Fix #24498 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix bug of branches API with tests(#25578) (#25579)Lunny Xiao2023-07-031-2/+35
| | | | | | Backport #25578 This PR added a repository's check when creating/deleting branches via API. Mirror repository and archive repository cannot do that.
* Make "cancel" buttons have proper type in modal forms (#25618) (#25641)wxiaoguang2023-07-031-0/+10
| | | | | | | | | | | Replace #25446, fix #25438 All "cancel" buttons which do not have "type" should not submit the form, should not be triggered by "Enter". This is a complete fix for all modal dialogs. The major change is "modules/aria/modal.js", "devtest" related code is for demo/test purpose.
* Restrict `[actions].DEFAULT_ACTIONS_URL` to only `github` or `self` (#25581) ↵Giteabot2023-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#25604) Backport #25581 by @wolfogre Resolve #24789 ## :warning: BREAKING :warning: Before this, `DEFAULT_ACTIONS_URL` cound be set to any custom URLs like `https://gitea.com` or `http://your-git-server,https://gitea.com`, and the default value was `https://gitea.com`. But now, `DEFAULT_ACTIONS_URL` supports only `github`(`https://github.com`) or `self`(the root url of current Gitea instance), and the default value is `github`. If it has configured with a URL, an error log will be displayed and it will fallback to `github`. Actually, what we really want to do is always make it `https://github.com`, however, this may not be acceptable for some instances of internal use, so there's extra support for `self`, but no more, even `https://gitea.com`. Please note that `uses: https://xxx/yyy/zzz` always works and it does exactly what it is supposed to do. Although it's breaking, I belive it should be backported to `v1.20` due to some security issues. Follow-up on the runner side: - https://gitea.com/gitea/act_runner/pulls/262 - https://gitea.com/gitea/act/pulls/70 Co-authored-by: Jason Song <i@wolfogre.com>
* Redirect to package after version deletion (#25594) (#25599)KN4CK3R2023-06-301-1/+7
| | | | | | | | | | | | | Related #25559 Current behaviour: 1. Deletion of a package version 2. Redirect to the owners package list New behaviour: 1. Deletion of a package version 2.1. If there are more versions available, redirect to the package again 2.2. If there are no versions available, redirect to the owners package list
* Use correct response code in push mirror creation response in v1_json.tmpl ↵Giteabot2023-06-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | (#25476) (#25571) Backport #25476 by @GeorgDangl In the process of doing a bit of automation via the API, we've discovered a _small_ issue in the Swagger definition. We tried to create a push mirror for a repository, but our generated client raised an exception due to an unexpected status code. When looking at this function: https://github.com/go-gitea/gitea/blob/3c7f5ed7b5bff347198cbb26492e6354ea42733b/routers/api/v1/repo/mirror.go#L236-L240 We see it defines `201 - Created` as response: https://github.com/go-gitea/gitea/blob/3c7f5ed7b5bff347198cbb26492e6354ea42733b/routers/api/v1/repo/mirror.go#L260-L262 But it actually returns `200 - OK`: https://github.com/go-gitea/gitea/blob/3c7f5ed7b5bff347198cbb26492e6354ea42733b/routers/api/v1/repo/mirror.go#L373 So I've just updated the Swagger definitions to match the code😀 Co-authored-by: Georg Dangl <10274404+GeorgDangl@users.noreply.github.com>
* Fix bugs related to notification endpoints (#25548) (#25562)Giteabot2023-06-283-4/+4
| | | | | | | | | | Backport #25548 by @Zettat123 This PR - fixes #25545 - fixes two incorrect `reqToken()` in `/notifications` endpoints (caused by #24767) Co-authored-by: Zettat123 <zettat123@gmail.com>
* Improve loadprojects for issue list (#25468) (#25493)Giteabot2023-06-263-5/+15
|
* Improve wiki sidebar and TOC (#25460) (#25477)Giteabot2023-06-241-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25460 by @wxiaoguang Close #20976 Close #20975 1. Fix the bug: the TOC in footer was incorrectly rendered as main content's TOC 2. Fix the layout: on mobile, the TOC is put above the main content, while the sidebar is put below the main content 3. Auto collapse the TOC on mobile ps: many styles of "wiki.css" are moved from old css files, so leave nits to following PRs. ### for desktop ![image](https://github.com/go-gitea/gitea/assets/2114189/6c84201c-0648-465a-99e6-c53cdaee53c0) ### for mobile ![image](https://github.com/go-gitea/gitea/assets/2114189/9cb4fdfe-b6ab-4e6f-ae82-219ddb8fa27e) ### other changed pages <details> ![image](https://github.com/go-gitea/gitea/assets/2114189/ef077736-2c3e-4e3d-82fe-d9bf1ebcca98) ![image](https://github.com/go-gitea/gitea/assets/2114189/bb528429-ad5f-4258-a5c4-05f997c624ea) </details> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor path & config system (#25330) (#25416)wxiaoguang2023-06-224-86/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25330 # The problem There were many "path tricks": * By default, Gitea uses its program directory as its work path * Gitea tries to use the "work path" to guess its "custom path" and "custom conf (app.ini)" * Users might want to use other directories as work path * The non-default work path should be passed to Gitea by GITEA_WORK_DIR or "--work-path" * But some Gitea processes are started without these values * The "serv" process started by OpenSSH server * The CLI sub-commands started by site admin * The paths are guessed by SetCustomPathAndConf again and again * The default values of "work path / custom path / custom conf" can be changed when compiling # The solution * Use `InitWorkPathAndCommonConfig` to handle these path tricks, and use test code to cover its behaviors. * When Gitea's web server runs, write the WORK_PATH to "app.ini", this value must be the most correct one, because if this value is not right, users would find that the web UI doesn't work and then they should be able to fix it. * Then all other sub-commands can use the WORK_PATH in app.ini to initialize their paths. * By the way, when Gitea starts for git protocol, it shouldn't output any log, otherwise the git protocol gets broken and client blocks forever. The "work path" priority is: WORK_PATH in app.ini > cmd arg --work-path > env var GITEA_WORK_DIR > builtin default The "app.ini" searching order is: cmd arg --config > cmd arg "work path / custom path" > env var "work path / custom path" > builtin default ## ⚠️ BREAKING If your instance's "work path / custom path / custom conf" doesn't meet the requirements (eg: work path must be absolute), Gitea will report a fatal error and exit. You need to set these values according to the error log.
* Fix `Permission` in API returned repository struct (#25388) (#25441)Giteabot2023-06-2212-39/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #25388 by @wolfogre The old code generates `structs.Repository.Permissions` with only `access.Permission.AccessMode`, however, it should check the units too, or the value could be incorrect. For example, `structs.Repository.Permissions.Push` could be false even the doer has write access to code unit. Should fix https://github.com/renovatebot/renovate/issues/14059#issuecomment-1047961128 (Not reported by it, I just found it when I was looking into this bug) --- Review tips: The major changes are - `modules/structs/repo.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-870406f6857117f8b03611c43fca0ab9ed6d6e76a2d0069a7c1f17e8fa9092f7 - `services/convert/repository.go` https://github.com/go-gitea/gitea/pull/25388/files#diff-7736f6d2ae894c9edb7729a80ab89aa183b888a26a811a0c1fdebd18726a7101 And other changes are passive. Co-authored-by: Jason Song <i@wolfogre.com>
* Show outdated comments in files changed tab (#24936) (#25428)sebastian-sauer2023-06-224-5/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #24936 If enabled show a clickable label in the comment. A click on the label opens the Conversation tab with the comment focussed - there you're able to view the old diff (or original diff the comment was created on). **Screenshots** ![image](https://github.com/go-gitea/gitea/assets/1135157/63ab9571-a9ee-4900-9f02-94ab0095f9e7) ![image](https://github.com/go-gitea/gitea/assets/1135157/78f7c225-8d76-46f5-acfd-9b8aab988a6c) When resolved and outdated: ![image](https://github.com/go-gitea/gitea/assets/1135157/6ece9ebd-c792-4aa5-9c35-628694e9d093) Option to enable/disable this (stored in user settings - default is disabled): ![image](https://github.com/go-gitea/gitea/assets/1135157/ed99dfe4-76dc-4c12-bd96-e7e62da50ab5) ![image](https://github.com/go-gitea/gitea/assets/1135157/e837a052-e92e-4a28-906d-9db5bacf93a6) fixes #24913 Co-authored-by: silverwind <me@silverwind.io>
* Use "utf8mb4" for MySQL by default (#25432)wxiaoguang2023-06-221-3/+0
| | | | | | TBH, I don't see much difference from `Remove "CHARSET" config option for MySQL, always use "utf8mb4"` #25413 Close #25413
* Fix blank dir message when uploading files from web editor (#25391) (#25400)Giteabot2023-06-201-1/+5
| | | | | | | Backport #25391 by @lunny Fix #7883 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix incorrect actions ref_name (#25358) (#25367)Giteabot2023-06-191-1/+1
| | | | | | | | | | Backport #25358 by @nephatrine Fix #25357 . Just a simple fix the result of `${{ gitea.ref_name }}` to show the shortened name rather than the full ref. Co-authored-by: Daniel Wolf <1461334+nephatrine@users.noreply.github.com>
* Write absolute AppDataPath to app.ini when installing (#25331) (#25347)Giteabot2023-06-181-0/+1
| | | | | | | | | | | Backport #25331 by @wxiaoguang If the APP_DATA_PATH isn't written into the config when installing, then its value is uncertain because some Gitea command doesn't run with correct WorkPath. This is a quick fix for #25330 and can be backported. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show if File is Executable (#25287) (#25300)Giteabot2023-06-161-0/+1
| | | | | | | | | | | Backport #25287 by @JakobDev This simply shows if a File has the executable Permission ![grafik](https://github.com/go-gitea/gitea/assets/15185051/1d50c105-6d55-4ecc-808a-c9cd5559d238) Co-authored-by: JakobDev <jakobdev@gmx.de> Co-authored-by: silverwind <me@silverwind.io>
* Show OAuth2 errors to end users (#25261) (#25271)Giteabot2023-06-151-3/+19
| | | | | | | | | | | | | | | | Backport #25261 by @wxiaoguang Partially fix #23936 ![image](https://github.com/go-gitea/gitea/assets/2114189/8aa7f3ad-a5f0-42ce-a478-289a03bd08a3) ![image](https://github.com/go-gitea/gitea/assets/2114189/bb901e7d-485a-47a5-b68d-9ebe7013a6b2) ![image](https://github.com/go-gitea/gitea/assets/2114189/9a1ce0f3-f011-4baf-8e2f-cc6304bc9703) Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix profile render when the README.md size is larger than 1024 bytes (#25270)yp053272023-06-151-1/+1
| | | Backport #25131
* Fix all possible setting error related storages and added some tests ↵Giteabot2023-06-146-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#23911) (#25244) Backport #23911 by @lunny Follow up #22405 Fix #20703 This PR rewrites storage configuration read sequences with some breaks and tests. It becomes more strict than before and also fixed some inherit problems. - Move storage's MinioConfig struct into setting, so after the configuration loading, the values will be stored into the struct but not still on some section. - All storages configurations should be stored on one section, configuration items cannot be overrided by multiple sections. The prioioty of configuration is `[attachment]` > `[storage.attachments]` | `[storage.customized]` > `[storage]` > `default` - For extra override configuration items, currently are `SERVE_DIRECT`, `MINIO_BASE_PATH`, `MINIO_BUCKET`, which could be configured in another section. The prioioty of the override configuration is `[attachment]` > `[storage.attachments]` > `default`. - Add more tests for storages configurations. - Update the storage documentations. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Do not overwrite the log mode when installing (#25203) (#25209)Giteabot2023-06-131-2/+1
| | | | | | | Backport #25203 by @wxiaoguang Fix #24861 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix compatible for webhook ref type (#25195) (#25223)Giteabot2023-06-131-2/+2
| | | | | | | | Backport #25195 by @lunny Fix #25185 Caused by #24634 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix bug for code search if code is disabled (#25173) (#25181)Giteabot2023-06-091-1/+6
| | | | | | | Backport #25173 by @lunny Fix https://github.com/go-gitea/gitea/pull/24189/files#r1224144768 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix `MilestoneIDs` when querying issues (#25125) (#25141)Giteabot2023-06-081-6/+6
| | | | | | | Backport #25125 by @Zettat123 Fix #25114 Co-authored-by: Zettat123 <zettat123@gmail.com>
* fix swagger documentation for multiple files API endpoint (#25110)v1.20.0-rc0Denys Konovalov2023-06-071-2/+2
| | | | | | | | | | Fixes some issues with the swagger documentation for the new multiple files API endpoint (#24887) which were overlooked when submitting the original PR: 1. add some missing parameter descriptions 2. set correct `required` option for required parameters 3. change endpoint description to match it full functionality (every kind of file modification is supported, not just creating and updating)
* Clean up WebAuthn javascript code and remove JQuery code (#22697)zeripath2023-06-061-2/+4
| | | | | | | | | | | | | | | | | There were several issues with the WebAuthn registration and testing code and the style was very old javascript with jquery callbacks. This PR uses async and fetch to replace the JQuery code. Ref #22651 Signed-off-by: Andrew Thornton <art27@cantab.net> --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: silverwind <me@silverwind.io>
* Add ability to set multiple redirect URIs in OAuth application UI (#25072)Denys Konovalov2023-06-051-2/+3
| | | | | | | | | | | | | | | | | | | | OAuth applications can already have multiple redirect URIs if created/edited over API. This change allows for setting multiple redirect URIs through the UI as a comma-separated list (e. g. `https://example.org/redirect,https://redirect.example.org`) <details> <summary>Screenshots</summary> ![Bildschirmfoto vom 2023-06-04 17-14-40](https://github.com/go-gitea/gitea/assets/47871822/2206dc32-e7e4-4953-9ecb-e098890b3f54) ![Bildschirmfoto vom 2023-06-04 17-14-50](https://github.com/go-gitea/gitea/assets/47871822/cd97c73c-9310-44ee-a83a-b927a1ef94da) </details> Closes #25068
* Redesign Scoped Access Tokens (#24767)Jack Hay2023-06-043-306/+375
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Adds the following high level access scopes, each with `read` and `write` levels: - `activitypub` - `admin` (hidden if user is not a site admin) - `misc` - `notification` - `organization` - `package` - `issue` - `repository` - `user` - Adds new middleware function `tokenRequiresScopes()` in addition to `reqToken()` - `tokenRequiresScopes()` is used for each high-level api section - _if_ a scoped token is present, checks that the required scope is included based on the section and HTTP method - `reqToken()` is used for individual routes - checks that required authentication is present (but does not check scope levels as this will already have been handled by `tokenRequiresScopes()` - Adds migration to convert old scoped access tokens to the new set of scopes - Updates the user interface for scope selection ### User interface example <img width="903" alt="Screen Shot 2023-05-31 at 1 56 55 PM" src="https://github.com/go-gitea/gitea/assets/23248839/654766ec-2143-4f59-9037-3b51600e32f3"> <img width="917" alt="Screen Shot 2023-05-31 at 1 56 43 PM" src="https://github.com/go-gitea/gitea/assets/23248839/1ad64081-012c-4a73-b393-66b30352654c"> ## tokenRequiresScopes Design Decision - `tokenRequiresScopes()` was added to more reliably cover api routes. For an incoming request, this function uses the given scope category (say `AccessTokenScopeCategoryOrganization`) and the HTTP method (say `DELETE`) and verifies that any scoped tokens in use include `delete:organization`. - `reqToken()` is used to enforce auth for individual routes that require it. If a scoped token is not present for a request, `tokenRequiresScopes()` will not return an error ## TODO - [x] Alphabetize scope categories - [x] Change 'public repos only' to a radio button (private vs public). Also expand this to organizations - [X] Disable token creation if no scopes selected. Alternatively, show warning - [x] `reqToken()` is missing from many `POST/DELETE` routes in the api. `tokenRequiresScopes()` only checks that a given token has the correct scope, `reqToken()` must be used to check that a token (or some other auth) is present. - _This should be addressed in this PR_ - [x] The migration should be reviewed very carefully in order to minimize access changes to existing user tokens. - _This should be addressed in this PR_ - [x] Link to api to swagger documentation, clarify what read/write/delete levels correspond to - [x] Review cases where more than one scope is needed as this directly deviates from the api definition. - _This should be addressed in this PR_ - For example: ```go m.Group("/users/{username}/orgs", func() { m.Get("", reqToken(), org.ListUserOrgs) m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions) }, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), context_service.UserAssignmentAPI()) ``` ## Future improvements - [ ] Add required scopes to swagger documentation - [ ] Redesign `reqToken()` to be opt-out rather than opt-in - [ ] Subdivide scopes like `repository` - [ ] Once a token is created, if it has no scopes, we should display text instead of an empty bullet point - [ ] If the 'public repos only' option is selected, should read categories be selected by default Closes #24501 Closes #24799 Co-authored-by: Jonathan Tran <jon@allspice.io> Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Use a separate admin page to show global stats, remove `actions` stat (#25062)wxiaoguang2023-06-032-4/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Before, Gitea shows the database table stats on the `admin dashboard` page. It has some problems: * `count(*)` is quite heavy. If tables have many records, this blocks loading the admin page blocks for a long time * Some users had even reported issues that they can't visit their admin page because this page causes blocking or `50x error (reverse proxy timeout)` * The `actions` stat is not useful. The table is simply too large. Does it really matter if it contains 1,000,000 rows or 9,999,999 rows? * The translation `admin.dashboard.statistic_info` is difficult to maintain. So, this PR uses a separate page to show the stats and removes the `actions` stat. ![image](https://github.com/go-gitea/gitea/assets/2114189/babf7c61-b93b-4a62-bfaa-22983636427e) ## :warning: BREAKING The `actions` Prometheus metrics collector has been removed for the reasons mentioned beforehand. Please do not rely on its output anymore.
* Allow for PKCE flow without client secret + add docs (#25033)Denys Konovalov2023-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The PKCE flow according to [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure authorization without the requirement to provide a client secret for the OAuth app. It is implemented in Gitea since #5378 (v1.8.0), however without being able to omit client secret. Since #21316 Gitea supports setting client type at OAuth app registration. As public clients are already forced to use PKCE since #21316, in this PR the client secret check is being skipped if a public client is detected. As Gitea seems to implement PKCE authorization correctly according to the spec, this would allow for PKCE flow without providing a client secret. Also add some docs for it, please check language as I'm not a native English speaker. Closes #17107 Closes #25047
* Refactor INI package (first step) (#25024)wxiaoguang2023-06-021-10/+3
| | | | | | | | | The INI package has many bugs and quirks, and in fact it is unmaintained. This PR is the first step for the INI package refactoring: * Use Gitea's "config_provider" to provide INI access * Deprecate the INI package by golangci.yml rule
* Fix users cannot visit issue attachment bug (#25019)Lunny Xiao2023-05-311-5/+0
| | | | | Caused by #24362 Co-authored-by: Giteabot <teabot@gitea.io>
* Merge `new project` templates into one (#24985)delvh2023-05-313-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Additionally simplify the `new project` template slightly. Review hint: Disable whitespace changes. <details><summary>Before</summary> ## New repo project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/4de977e8-3688-45cd-8832-49b001e6f249) ## Edit repo project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/daaf353f-6c99-48bd-b37a-a3bc64459079) ## New user/org project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/6a5a3be5-f51a-4599-b75c-7adb9710d2fa) ## Edit user/org project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/a4768f49-cf46-4773-8a0f-54dfdcc1c1b8) </details> <details><summary>After</summary> ## New repo project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/3d0ac8a0-850a-4743-963c-71c66ef38d07) ## Edit repo project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/6b86a1cd-e360-4a9b-aaf7-af032d0d991a) ## New user/org project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/a7b0964c-e4c7-4924-842a-52a58499bc36) ## Edit user/org project ![grafik](https://github.com/go-gitea/gitea/assets/51889757/0fbc5605-afee-49bd-a44a-8646f8c55681) </details> --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Add user level action runners (#24995)HesterG2023-05-313-2/+17
| | | | | | | | | Used similar logic to organization. <img width="1437" alt="Screen Shot 2023-05-30 at 10 18 06" src="https://github.com/go-gitea/gitea/assets/17645053/49f3800a-44ae-4188-b1e6-91d49e3d7868"> <img width="1331" alt="Screen Shot 2023-05-30 at 10 31 18" src="https://github.com/go-gitea/gitea/assets/17645053/221b2068-e9b9-4e34-bb4a-d390594b2f35">
* Followup to pinned Issues (#24945)JakobDev2023-05-303-8/+26
| | | | | | | | | This addressees some things from #24406 that came up after the PR was merged. Mostly from @delvh. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: delvh <dev.lh@web.de>
* Fix admin config page error, use tests to cover the admin config and 500 ↵wxiaoguang2023-05-292-1/+42
| | | | | | | | | | error page (#24965) The admin config page has been broken for many many times, a little refactoring would make this page panic. So, add a test for it, and add another test to cover the 500 error page. Co-authored-by: Giteabot <teabot@gitea.io>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-05 06:44:57 +0000