summaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
...
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-2436-155/+194
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Make CORS work for oauth2 handlers (#28184)wxiaoguang2023-11-232-0/+6
| | | | | | Fix #25473 Although there was `m.Post("/login/oauth/access_token", CorsHandler()...`, it never really worked, because it still lacks the "OPTIONS" handler.
* Revert "Fix EOL handling in web editor" (#28101)Nanguan Lin2023-11-221-1/+1
| | | | Reverts go-gitea/gitea#27141 close #28097
* Fix swagger title (#28164)yp053272023-11-221-1/+1
| | | | ![image](https://github.com/go-gitea/gitea/assets/18380374/380859b2-a643-42fd-b53e-78c93c05c826) Don't know why there's a `.` behind. 🤔
* Add edit option for README.md (#28071)JakobDev2023-11-201-0/+4
| | | | | | | Fix #28059 ![grafik](https://github.com/go-gitea/gitea/assets/15185051/07adc216-954e-486b-bfda-df3bc15f2089)
* Fix project counter in organization/individual profile (#28068)yp053272023-11-181-0/+17
| | | | | | | | | | | | | | Fix #28052 Before: ![image](https://github.com/go-gitea/gitea/assets/18380374/5f299983-4b38-4d68-ac0e-4be3c62c0558) ![image](https://github.com/go-gitea/gitea/assets/18380374/f0e12afd-483b-4882-80e9-0261beb3fe0c) After: ![image](https://github.com/go-gitea/gitea/assets/18380374/47cccb7b-bb35-4a7d-9c5b-83133be0323a) ![image](https://github.com/go-gitea/gitea/assets/18380374/77825c0c-4bf2-4762-83a2-1a5a173cc22d)
* Fix viewing wiki commit on empty repo (#28040)JakobDev2023-11-141-1/+0
| | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1758 For some weird reason we need to cast this nil.
* Dont leak private users via extensions (#28023)65432023-11-131-0/+5
|
* Improve profile for Organizations (#27982)yp053272023-11-133-11/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes some problems in #27955: - autofocus of the search box before: if access the home page will jump to the search box ![image](https://github.com/go-gitea/gitea/assets/18380374/7f100e8d-2bd6-4563-85ba-d6008ffc71d7) after: will not jump to the search box ![image](https://github.com/go-gitea/gitea/assets/18380374/9aab382c-8ebe-4d18-b990-4adbb6c341ad) - incorrect display of overview tab before: ![image](https://github.com/go-gitea/gitea/assets/18380374/b24c79e8-9b79-4576-9276-43bd19172043) after: ![image](https://github.com/go-gitea/gitea/assets/18380374/7aab5827-f086-4874-bd84-39bd81b872f3) - improve the permission check to the private profile repo In #26295, we simply added access control to the private profile. But if user have access to the private profile repo , we should also display the profile. - add a button which can jump to the repo list? I agree @wxiaoguang 's opinion here: https://github.com/go-gitea/gitea/pull/27955#issuecomment-1803178239 But it seems that this feature is sponsored. So can we add a button which can quickly jump to the repo list or just move profile to the `overview` page? --------- Co-authored-by: silverwind <me@silverwind.io>
* Enable system users search via the API (#28013)Earl Warren2023-11-131-12/+26
| | | | | Refs: https://codeberg.org/forgejo/forgejo/issues/1403 (cherry picked from commit dd4d17c159eaf8b642aa9e6105b0532e25972bb7)
* Add Profile Readme for Organisations (#27955)65432023-11-091-0/+26
| | | | | | | | | | | | | | | | | https://blog.gitea.com/release-of-1.20.0/#-user-profile-readme-23260 (#23260) did introduce Profile Readme for Users. This makes it usable for Organisations: ![image](https://github.com/go-gitea/gitea/assets/24977596/464ab58b-a952-414b-8a34-6deaeb4f7d35) --- *Sponsored by Kithara Software GmbH* --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Allow to set explore page default sort (#27951)65432023-11-095-14/+21
| | | | | | | as title --- *Sponsored by Kithara Software GmbH*
* Fix citation error when the file size is larger than 1024 bytes (#27958)yp053272023-11-081-5/+2
| | | | | | Mentioned in: https://github.com/go-gitea/gitea/pull/27931#issuecomment-1798016960 Same to #25131, so use the same method to fix this problem.
* Unify two factor check (#27915)KN4CK3R2023-11-061-36/+0
| | | | | | | | Fixes #27819 We have support for two factor logins with the normal web login and with basic auth. For basic auth the two factor check was implemented at three different places and you need to know that this check is necessary. This PR moves the check into the basic auth itself.
* Revert #27870 (#27917)KN4CK3R2023-11-061-1/+1
| | | | | Now that we have #27798 we don't need the check from #27870 anymore. With the check it's not possible to remove an inactive auth source from the user.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-034-20/+42
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Fix http protocol auth (#27875)Lunny Xiao2023-11-024-14/+47
|
* Filter inactive auth sources (#27870)KN4CK3R2023-11-021-1/+1
| | | | | | | | | | | | Fix nil access for inactive auth sources. > Render failed, failed to render template: user/settings/security/security, error: template error: builtin(static):user/settings/security/accountlinks:32:20 : executing "user/settings/security/accountlinks" at <$providerData.IconHTML>: nil pointer evaluating oauth2.Provider.IconHTML Code tries to access the auth source of an `ExternalLoginUser` but the list contains only the active auth sources.
* Clean up template locale usage (#27856)wxiaoguang2023-10-312-8/+8
| | | | | | | | | | | | | | | | | After many refactoring PRs for the "locale" and "template context function", now the ".locale" is not needed for web templates any more. This PR does a clean up for: 1. Remove `ctx.Data["locale"]` for web context. 2. Use `ctx.Locale` in `500.tmpl`, for consistency. 3. Add a test check for `500 page` locale usage. 4. Remove the `Str2html` and `DotEscape` from mail template context data, they are copy&paste errors introduced by #19169 and #16200 . These functions are template functions (provided by the common renderer), but not template data variables. 5. Make email `SendAsync` function mockable (I was planning to add more tests but it would make this PR much too complex, so the tests could be done in another PR)
* Fix/upload artifact error windows (#27802)FuXiaoHei2023-10-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From issue https://github.com/go-gitea/gitea/issues/27314 When act_runner in `host` mode on Windows. `upload_artifact@v3` actions use `path.join` to generate `itemPath` params when uploading artifact chunk. `itemPath` is encoded as `${artifact_name}\${artifact_path}`. <del>It's twice query escaped from ${artifact_name}/${artifact_path} that joined by Windows slash \.</del> **So we need convert Windows slash to linux**. In https://github.com/go-gitea/gitea/issues/27314, runner shows logs from `upload_artifact@v3` like with `%255C`: ``` [artifact-cases/test-artifact-cases] | ::error::Unexpected response. Unable to upload chunk to http://192.168.31.230:3000/api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%255Css.json ``` But in gitea server at the same time, But shows `%5C` ``` 2023/10/27 19:29:51 ...eb/routing/logger.go:102:func1() [I] router: completed PUT /api/actions_pipeline/_apis/pipelines/workflows/6/artifacts/34d628a422db9367c869d3fb36be81f5/upload?itemPath=more-files%5Css.json for 192.168.31.230:55340, 400 Bad Request in 17.6ms @ <autogenerated>:1(actions.artifactRoutes.uploadArtifact-fm) ``` I found `%255C` is escaped by `https://github.com/actions/upload-artifact/blob/main/dist/index.js#L2329`. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Allow pull requests Manually Merged option to be used by non-admins (#27780)Brecht Van Lommel2023-10-301-3/+5
| | | | | | | | | | | | Currently this feature is only available to admins, but there is no clear reason why. If a user can actually merge pull requests, then this seems fine as well. This is useful in situations where direct pushes to the repository are commonly done by developers. --------- Co-authored-by: delvh <dev.lh@web.de>
* Fix bad method call when deleting user secrets via API (#27829)Jean-Baptiste Gomond2023-10-291-1/+1
| | | | | Fixed a little mistake when you deleting user secrets via the API. Found it when working on #27725. It should be backported to 1.21 I think.
* Fix the missing repo count in new team page and edit team page (#27743)8532023-10-251-0/+8
| | | | | | | | | | | | | | | | | Follow #26942 Before: ![image](https://github.com/go-gitea/gitea/assets/8389962/ffe3e914-c71c-493f-965b-369f27c70b4b) ![image](https://github.com/go-gitea/gitea/assets/8389962/eaad4f07-b8ce-4564-b883-97938de5ed79) After: ![image](https://github.com/go-gitea/gitea/assets/8389962/353aeabe-caf4-4449-8330-d3a29f9bd326) ![image](https://github.com/go-gitea/gitea/assets/8389962/baf59bb6-2c74-4a56-a28c-1519bc3d2594)
* Do not force creation of _cargo-index repo on publish (#27266)merlleu2023-10-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | Hello there, Cargo Index over HTTP is now prefered over git for package updates: we should not force users who do not need the GIT repo to have the repo created/updated on each publish (it can still be created in the packages settings). The current behavior when publishing is to check if the repo exist and create it on the fly if not, then update it's content. Cargo HTTP Index does not rely on the repo itself so this will be useless for everyone not using the git protocol for cargo registry. This PR only disable the creation on the fly of the repo when publishing a crate. This is linked to #26844 (error 500 when trying to publish a crate if user is missing write access to the repo) because it's now optional. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Upgrade to golangci-lint@v1.55.0 (#27756)silverwind2023-10-244-11/+7
| | | https://github.com/golangci/golangci-lint/releases/tag/v1.55.0
* Fix `link-action` redirect network error (#27734)Nanguan Lin2023-10-232-6/+8
| | | | | | | | <img width="823" alt="image" src="https://github.com/go-gitea/gitea/assets/70063547/99da3d5a-c28a-4fd0-8ae0-88461a9142e2"> --------- Co-authored-by: 6543 <6543@obermui.de>
* Fix org team endpoint (#27721)Nanguan Lin2023-10-221-4/+4
| | | Fix #27711
* Replace -1 with GhostUserID (#27703)Nanguan Lin2023-10-201-1/+1
|
* Show total TrackedTime on issue/pull/milestone lists (#26672)65432023-10-191-36/+42
| | | | | | | | | | | | | | TODOs: - [x] write test for `GetIssueTotalTrackedTime` - [x] frontport kitharas template changes and make them mobile-friendly --- ![image](https://github.com/go-gitea/gitea/assets/24977596/6713da97-201f-4217-8588-4c4cec157171) ![image](https://github.com/go-gitea/gitea/assets/24977596/3a45aba8-26b5-4e6a-b97d-68bfc2bf9024) --- *Sponsored by Kithara Software GmbH*
* Delete repos of org when purge delete user (#27273)JakobDev2023-10-192-3/+3
| | | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/1514 I had to remove `RenameOrganization` to avoid circular import. We should really add some foreign keys to the database.
* Fix typo "GetLatestRunnerToken" (#27680)Jason Song2023-10-182-3/+3
|
* Remove unnecessary parameter (#27671)Lunny Xiao2023-10-181-1/+1
|
* Improve the list header in milestone page (#27302)yp053272023-10-182-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ui of list header in milestone page is not same as issue and pr list page. And they are using different template codes which can be merged into one. Before: ![image](https://github.com/go-gitea/gitea/assets/18380374/29eb426c-2dd6-4cf2-96e0-82339fb631bb) ![image](https://github.com/go-gitea/gitea/assets/18380374/b36c4dff-469a-4395-8a02-a8c54e17ab21) ![image](https://github.com/go-gitea/gitea/assets/18380374/d882c74a-451b-431d-b58e-3635a15d9718) ![image](https://github.com/go-gitea/gitea/assets/18380374/292cd38d-1b50-47f1-b32c-9b5de90ce5fb) After: ![image](https://github.com/go-gitea/gitea/assets/18380374/4529234e-67dc-4e17-9440-e638be4fbc41) ![image](https://github.com/go-gitea/gitea/assets/18380374/c15b4d86-0762-497b-b28d-72d09443d629) --------- Co-authored-by: puni9869 <80308335+puni9869@users.noreply.github.com>
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-1510-15/+16
| | | Target #27065
* Fix 404 when there is an internal version of package (#27615)Nanguan Lin2023-10-151-1/+1
| | | | close #27601 The Docker registry has an internal version, which leads to 404
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-1431-73/+73
| | | Last part of #27065
* Fix permissions for Token DELETE endpoint to match GET and POST (#27610)Evan Tobin2023-10-141-1/+1
| | | | | | | | Fixes #27598 In #27080, the logic for the tokens endpoints were updated to allow admins to create and view tokens in other accounts. However, the same functionality was not added to the DELETE endpoint. This PR makes the DELETE endpoint function the same as the other token endpoints and adds unit tests
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-147-55/+54
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Don't show Link to TOTP if not set up (#27585)JakobDev2023-10-111-0/+8
|
* Replace ajax with fetch, improve image diff (#27267)silverwind2023-10-111-10/+17
| | | | | | | | | | | 1. Dropzone attachment removal, pretty simple replacement 2. Image diff: The previous code fetched every image twice, once via `img[src]` and once via `$.ajax`. Now it's only fetched once and a second time only when necessary. The image diff code was partially rewritten. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-1146-114/+116
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix the wrong HTTP response status code for duplicate packages (#27480)Nanguan Lin2023-10-1010-10/+10
| | | | | | | | fix #27470 (hope there is nothing missing 😢 ) --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* api: GetPullRequestCommits: return file list (#27483)Michael Santos2023-10-092-2/+34
| | | | | | | | Fixes https://github.com/go-gitea/gitea/issues/27481 ---- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix panic in storageHandler (#27446)Sergey Zolotarev2023-10-061-51/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | storageHandler() is written as a middleware but is used as an endpoint handler, and thus `next` is actually `nil`, which causes a null pointer dereference when a request URL does not match the pattern (where it calls `next.ServerHTTP()`). Example CURL command to trigger the panic: ``` curl -I "http://yourhost/gitea//avatars/a" ``` Fixes #27409 --- Note: the diff looks big but it's actually a small change - all I did was to remove the outer closure (and one level of indentation) ~and removed the HTTP method and pattern checks as they seem redundant because go-chi already does those checks~. You might want to check "Hide whitespace" when reviewing it. Alternative solution (a bit simpler): append `, misc.DummyOK` to the route declarations that utilize `storageHandler()` - this makes it return an empty response when the URL is invalid. I've tested this one and it works too. Or maybe it would be better to return a 400 error in that case (?)
* Remove redundant `len` check around loop (#27464)Eng Zer Jun2023-10-061-4/+2
| | | | | | | | | | | | | | | | | | | | This pull request is a minor code cleanup. From the Go specification (https://go.dev/ref/spec#For_range): > "1. For a nil slice, the number of iterations is 0." > "3. If the map is nil, the number of iterations is 0." `len` returns 0 if the slice or map is nil (https://pkg.go.dev/builtin#len). Therefore, checking `len(v) > 0` before a loop is unnecessary. --- At the time of writing this pull request, there wasn't a lint rule that catches these issues. The closest I could find is https://staticcheck.dev/docs/checks/#S103 Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Don't let API add 2 exclusive labels from same scope (#27433)JakobDev2023-10-051-1/+1
| | | Fixes #27380
* Refactor system setting (#27000)wxiaoguang2023-10-055-81/+31
| | | | | | | | | This PR reduces the complexity of the system setting system. It only needs one line to introduce a new option, and the option can be used anywhere out-of-box. It is still high-performant (and more performant) because the config values are cached in the config system.
* When comparing with an non-exist repository, return 404 but 500 (#27437)Lunny Xiao2023-10-041-1/+3
|
* Even more `db.DefaultContext` refactor (#27352)JakobDev2023-10-0337-77/+77
| | | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* Differentiate between `push` and `pull` `mirror sync in progress` (#27390)delvh2023-10-021-2/+2
| | | | | | | | | | | Previously, if you had both a push and a pull mirror, the message did not clarify if you've accidentally synchronized the wrong one. Additionally fixed two typos that were encountered while debugging. ## Screenshots ![grafik](https://github.com/go-gitea/gitea/assets/51889757/164d5d20-728d-4365-9cb5-c37e95857cdf) ![grafik](https://github.com/go-gitea/gitea/assets/51889757/90bfffd2-abd4-4847-b8e2-db4231700a6d)
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-22 09:04:56 +0000