summaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
...
* Don't run push mirrors for archived repos (#27140)JakobDev2024-01-242-9/+9
| | | | | | Fixes https://codeberg.org/forgejo/forgejo/issues/612 At the moment push mirrors are still run if a repo is archived. This PR fixes this.
* Prevent anonymous container access if `RequireSignInView` is enabled (#28877)KN4CK3R2024-01-211-5/+14
| | | | | Fixes #28875 If `RequireSignInView` is enabled, the ghost user has no access rights.
* Revert adding htmx until we finaly decide to add it (#28879)65432024-01-212-17/+3
|
* Don't do a full page load when clicking the follow button (#28872)Yarden Shoham2024-01-201-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | - Use htmx to perform the button request - `hx-headers='{"x-csrf-token": "{{.CsrfToken}}"}'` to authenticate (we should probably learn to reuse this) - `hx-post="{{.ContextUser.HomeLink}}?action=follow"` to send a POST request to follow the user - `hx-target="#profile-avatar-card"` to target the card div for replacement - `hx-swap="outerHTML"` to replace the card (as opposed to its inner content) with the new card that shows the new follower count and button color - Change the backend response to return a `<div>` tag (the card) instead of a redirect to the user page # Before ![before](https://github.com/go-gitea/gitea/assets/20454870/86899d15-41c9-42ed-bd85-253b9caac7f8) # After ![after](https://github.com/go-gitea/gitea/assets/20454870/59455d96-548c-4a81-a5b0-fab1dc1e87ef) Signed-off-by: Yarden Shoham <git@yardenshoham.com>
* Don't do a full page load when clicking the subscribe button (#28871)Yarden Shoham2024-01-201-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Refactor the form around the subscribe button into its own template - Use htmx to perform the form submission - `hx-boost="true"` to prevent the default form submission behavior of a full page load - `hx-sync="this:replace"` to replace the current request (in case the button is clicked again before the response is returned) - `hx-target="this"` to replace the form tag with the new form tag - `hx-push-url="false"` to disable a change to the URL - `hx-swap="show:no-scroll"` to preserve the scroll position - Change the backend response to return a `<form>` tag instead of a redirect to the issue page - Include `htmx.org` in javascript imports This change introduces htmx with the hope we could use it to make Gitea more reactive while keeping our "HTML rendered on the server" approach. # Before ![before](https://github.com/go-gitea/gitea/assets/20454870/4ec3e81e-4dbf-4338-9968-b0655c276d4c) # After ![after](https://github.com/go-gitea/gitea/assets/20454870/8c8841af-9bfe-40b2-b1cd-cd1f3c90ba4d) --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com>
* Set the `isPermaLink` attribute to `false` in the `guid` sub-element (#28860)Yarden Shoham2024-01-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Our `guid` is not a valid URL so according to the RSS spec the `isPermaLink` attribute needs to be set to `false`. Example: ```diff <item> <title>yardenshoham opened issue &lt;a href=&#34;https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2&#34;&gt;yardenshoham/test#2&lt;/a&gt;</title> <link>https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2</link> <description>2#hey</description> <content:encoded><![CDATA[2#hey]]></content:encoded> <author>yardenshoham</author> - <guid>355: https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2</guid> + <guid isPermaLink="false">355: https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2</guid> <pubDate>Tue, 16 Jan 2024 18:54:36 +0000</pubDate> </item> ``` References: - https://www.rssboard.org/rss-specification#ltguidgtSubelementOfLtitemgt - Fixes https://github.com/go-gitea/gitea/issues/28734 - https://github.com/gorilla/feeds/issues/78 - https://github.com/go-gitea/gitea/pull/21550 - https://github.com/gorilla/feeds/pull/107 Signed-off-by: Yarden Shoham <git@yardenshoham.com>
* Add support for sha256 repositories (#23894)Adam Majer2024-01-194-12/+13
| | | | | | | | | | | | | | | | Currently only SHA1 repositories are supported by Gitea. This adds support for alternate SHA256 with the additional aim of easier support for additional hash types in the future. Fixes: #13794 Limited by: https://github.com/go-git/go-git/issues/899 Depend on: #28138 <img width="776" alt="图片" src="https://github.com/go-gitea/gitea/assets/81045/5448c9a7-608e-4341-a149-5dd0069c9447"> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: 6543 <6543@obermui.de>
* Fix incorrect action duration time when rerun the job before executed once ↵yp053272024-01-191-0/+11
| | | | | | | | | | | | | | | | | | (#28364) Fix #28323 Reason was mentioned here: https://github.com/go-gitea/gitea/issues/28323#issuecomment-1841867298 ### Changes: (maybe breaking) We can rerun jobs in Gitea, so there will be some problems in calculating duration time. In this PR, I use the exist `Started` and `Stopped` column to record the last run time instead of the total time, and add a new `PreviousDuration` column to record the previous duration time. You can also check the cost time of last run: ![image](https://github.com/go-gitea/gitea/assets/18380374/2ca39145-2c92-401a-b78b-43164f7ae061)
* Fix some RPM registry flaws (#28782)KN4CK3R2024-01-194-96/+115
| | | | | | | | | | | | | | | | | | | Related #26984 (https://github.com/go-gitea/gitea/pull/26984#issuecomment-1889588912) Fix admin cleanup message. Fix models `Get` not respecting default values. Rebuild RPM repository files after cleanup. Do not add RPM group to package version name. Force stable sorting of Alpine/Debian/RPM repository data. Fix missing deferred `Close`. Add tests for multiple RPM groups. Removed non-cached `ReplaceAllStringRegex`. If there are multiple groups available, it's stated in the package installation screen: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/8f132760-882c-4ab8-9678-77e47dfc4415)
* Fix uploaded artifacts should be overwritten (#28726)FuXiaoHei2024-01-172-3/+15
| | | | | | | | | | | Fix `Uploaded artifacts should be overwritten` https://github.com/go-gitea/gitea/issues/28549 When upload different content to uploaded artifact, it checks that content size is not match in db record with previous artifact size, then the new artifact is refused. Now if it finds uploading content size is not matching db record when receiving chunks, it updates db records to follow the latest size value.
* Retarget depending pulls when the parent branch is deleted (#28686)Viktor Kuzmin2024-01-172-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes you need to work on a feature which depends on another (unmerged) feature. In this case, you may create a PR based on that feature instead of the main branch. Currently, such PRs will be closed without the possibility to reopen in case the parent feature is merged and its branch is deleted. Automatic target branch change make life a lot easier in such cases. Github and Bitbucket behave in such way. Example: $PR_1$: main <- feature1 $PR_2$: feature1 <- feature2 Currently, merging $PR_1$ and deleting its branch leads to $PR_2$ being closed without the possibility to reopen. This is both annoying and loses the review history when you open a new PR. With this change, $PR_2$ will change its target branch to main ($PR_2$: main <- feature2) after $PR_1$ has been merged and its branch has been deleted. This behavior is enabled by default but can be disabled. For security reasons, this target branch change will not be executed when merging PRs targeting another repo. Fixes #27062 Fixes #18408 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: delvh <dev.lh@web.de>
* Remove trust model selection from repository creation on web page because it ↵Lunny Xiao2024-01-161-1/+1
| | | | | | | | | | | | | | | | | | can be changed in settings later (#28814) As more and more options can be set for creating the repository, I don't think we should put all of them into the creation web page which will make things look complicated and confusing. And I think we need some rules about how to decide which should/should not be put in creating a repository page. One rule I can imagine is if this option can be changed later and it's not a MUST on the creation, then it can be removed on the page. So I found trust model is the first one. This PR removed the trust model selections on creating a repository web page and kept others as before. This is also a preparation for #23894 which will add a choice about SHA1 or SHA256 that cannot be changed once the repository created.
* Show latest commit for file (#28067)JakobDev2024-01-151-23/+41
| | | | | | | | | If you view a file, you can now see the latest commit that changed that file. ![grafik](https://github.com/go-gitea/gitea/assets/15185051/272c3120-6db7-4f88-86e1-60080c9aabe5) --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de>
* Add ability to see open and closed issues at the same time (#28757)Gwyneth Morgan2024-01-151-10/+26
| | | | | | By clicking the currently active "Open" or "Closed" filter button in the issue list, the user can toggle that filter off in order to see all issues regardless of state. The URL "state" parameter will be set to "all" and the "Open"/"Closed" button will not show as active.
* Fix `GetCommitStatuses` (#28787)KN4CK3R2024-01-151-1/+4
| | | Fixes #28764.
* Rework markup link rendering (#26745)KN4CK3R2024-01-1515-125/+185
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #26548 This PR refactors the rendering of markup links. The old code uses `strings.Replace` to change some urls while the new code uses more context to decide which link should be generated. The added tests should ensure the same output for the old and new behaviour (besides the bug). We may need to refactor the rendering a bit more to make it clear how the different helper methods render the input string. There are lots of options (resolve links / images / mentions / git hashes / emojis / ...) but you don't really know what helper uses which options. For example, we currently support images in the user description which should not be allowed I think: <details> <summary>Profile</summary> https://try.gitea.io/KN4CK3R ![grafik](https://github.com/go-gitea/gitea/assets/1666336/109ae422-496d-4200-b52e-b3a528f553e5) </details> --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add branch protection setting for ignoring stale approvals (#28498)Jimmy Praet2024-01-152-0/+6
| | | | | | | | | | | | | | | | | | | | | | Fixes #27114. * In Gitea 1.12 (#9532), a "dismiss stale approvals" branch protection setting was introduced, for ignoring stale reviews when verifying the approval count of a pull request. * In Gitea 1.14 (#12674), the "dismiss review" feature was added. * This caused confusion with users (#25858), as "dismiss" now means 2 different things. * In Gitea 1.20 (#25882), the behavior of the "dismiss stale approvals" branch protection was modified to actually dismiss the stale review. For some users this new behavior of dismissing the stale reviews is not desirable. So this PR reintroduces the old behavior as a new "ignore stale approvals" branch protection setting. --------- Co-authored-by: delvh <dev.lh@web.de>
* Forbid removing the last admin user (#28337)yp053272024-01-153-2/+28
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Move more functions to db.Find (#28419)Lunny Xiao2024-01-1510-36/+67
| | | | | | | | | Following #28220 This PR move more functions to use `db.Find`. --------- Co-authored-by: delvh <dev.lh@web.de>
* Modernize merge button (#28140)Earl Warren2024-01-151-24/+21
| | | | | | | | | | | | | | | | - Make use of the `form-fetch-action` for the merge button, which will automatically prevent the action from happening multiple times and show a nice loading indicator as user feedback while the merge request is being processed by the server. - Adjust the merge PR code to JSON response as this is required for the `form-fetch-action` functionality. - Resolves https://codeberg.org/forgejo/forgejo/issues/774 - Likely resolves the cause of https://codeberg.org/forgejo/forgejo/issues/1688#issuecomment-1313044 (cherry picked from commit 4ec64c19507caefff7ddaad722b1b5792b97cc5a) Co-authored-by: Gusted <postmaster@gusted.xyz>
* Fix schedule tasks bugs (#28691)Lunny Xiao2024-01-123-20/+10
| | | | | | | | | | | | | | | | Fix #28157 This PR fix the possible bugs about actions schedule. ## The Changes - Move `UpdateRepositoryUnit` and `SetRepoDefaultBranch` from models to service layer - Remove schedules plan from database and cancel waiting & running schedules tasks in this repository when actions unit has been disabled or global disabled. - Remove schedules plan from database and cancel waiting & running schedules tasks in this repository when default branch changed.
* Fix issue dependencies (#27736)Nanguan Lin2024-01-122-56/+55
| | | | | | | | | | | | | | | | | | | | Fix #27722 Fix #27357 Fix #25837 1. Fix the typo `BlockingByDependenciesNotPermitted`, which causes the `not permitted message` not to show. The correct one is `Blocking` or `BlockedBy` 2. Rewrite the perm check. The perm check uses a very tricky way to avoid duplicate checks for a slice of issues, which is confusing. In fact, it's also the reason causing the bug. It uses `lastRepoID` and `lastPerm` to avoid duplicate checks, but forgets to assign the `lastPerm` at the end of the code block. So I rewrote this to avoid this trick. ![I U1AT{GNFY3 1HZ`6L{(2L](https://github.com/go-gitea/gitea/assets/70063547/79acd02a-a567-4316-ae0d-11c6461becf1) 3. It also reuses the `blocks` slice, which is even more confusing. So I rewrote this too. ![UARFPXRGGZQFB7J$2`R}5_R](https://github.com/go-gitea/gitea/assets/70063547/f21cff0f-d9ac-4ce4-ae4d-adffc98ecd99)
* Assign pull request to project during creation (#28227)Denys Konovalov2024-01-122-1/+13
| | | | | | | | | When creating a pull request, allow directly assigning it to a project, as it is already possible for issues. After: ![grafik](https://github.com/go-gitea/gitea/assets/47871822/01dc2b3d-d56a-4053-b2fc-138725d7633a)
* Support for grouping RPMs using paths (#26984)Exploding Dragon2024-01-122-30/+105
| | | | | | | | | | | | The current rpm repository places all packages in the same repository, and different systems (el7,f34) may hit packages that do not belong to this distribution ( #25304 ) , which now supports grouping of rpm. ![图片](https://github.com/go-gitea/gitea/assets/33776693/d1e1d99f-7799-4b2b-a19b-cb2a5c692914) Fixes #25304 . Fixes #27056 . Refactor: [#25866](https://github.com/go-gitea/gitea/pull/25866)
* Require token for GET subscription endpoint (#28765)Jack Hay2024-01-121-3/+3
| | | | | | | Fixes #28756 ## Changes - Require and check API token for `GET /repos/{owner}/{repo}/subscription` in order to populate `ctx.Doer`.
* Recommend/convert to use case-sensitive collation for MySQL/MSSQL (#28662)wxiaoguang2024-01-102-0/+31
| | | | | | | | | | | | | | | | | | Mainly for MySQL/MSSQL. It is important for Gitea to use case-sensitive database charset collation. If the database is using a case-insensitive collation, Gitea will show startup error/warning messages, and show the errors/warnings on the admin panel's Self-Check page. Make `gitea doctor convert` work for MySQL to convert the collations of database & tables & columns. * Fix #28131 ## :warning: BREAKING :warning: It is not quite breaking, but it's highly recommended to convert the database&table&column to a consistent and case-sensitive collation.
* Normalize oauth email username (#28561)Kyle D2024-01-033-6/+15
|
* Fix: system webhooks API bug (#28531)vincent2023-12-311-6/+17
| | | | - Fix the bug about admin/hooks API that `GET /admin/hooks` can only fetch system_hooks, `POST /admin/hooks` can only create default_hooks.
* Avoid cycle-redirecting user/login page (#28636)wxiaoguang2023-12-302-6/+5
| | | | Fix #28231, and remove some unused code. The `db.HasEngine` doesn't seem useful because the db engine is always initialized before web route.
* Refactor some legacy code and remove unused code (#28622)wxiaoguang2023-12-281-1/+2
| | | | | 1. use slices.Contains, remove Int64sContains 2. use HashEmail, remove base.EncodeMD5 3. remove BasicAuthEncode, IsLetter
* fix wrong link in user and organization profile when using relative url (#28617)katsu2023-12-273-15/+28
| | | | | | | | | | fix #28436. the doc https://docs.gitea.com/usage/profile-readme maybe also need to be updated to tell that the main branch is necessary,which means the following three conditions should be satisfied: - repo: **.profile** - branch: **[default branch]** - markdown: **README.md**
* Add get actions runner registration token for API routes, repo, org, user ↵Lunny Xiao2023-12-277-14/+184
| | | | | | | | | | and global level (#27144) Replace #23761 --------- Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Refactor deletion (#28610)delvh2023-12-254-12/+19
| | | | | | | | | | | | | | | | | | Introduce the new generic deletion methods - `func DeleteByID[T any](ctx context.Context, id int64) (int64, error)` - `func DeleteByIDs[T any](ctx context.Context, ids ...int64) error` - `func Delete[T any](ctx context.Context, opts FindOptions) (int64, error)` So, we no longer need any specific deletion method and can just use the generic ones instead. Replacement of #28450 Closes #28450 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor CORS handler (#28587)wxiaoguang2023-12-254-37/+43
| | | | | | | | | | | The CORS code has been unmaintained for long time, and the behavior is not correct. This PR tries to improve it. The key point is written as comment in code. And add more tests. Fix #28515 Fix #27642 Fix #17098
* Added instance-level variables (#28115)Jean-Baptiste Gomond2023-12-253-9/+31
| | | | | | | | | | | This PR adds instance-level variables, and so closes #27726 ![gitea_instance_variables_1](https://github.com/go-gitea/gitea/assets/8344487/ad409cd4-ce36-4c84-a764-34451b0fb63a) ![gitea_instance_variables_2](https://github.com/go-gitea/gitea/assets/8344487/426f0965-dec6-4560-948c-067cdeddd720) ![gitea_instance_variables_3](https://github.com/go-gitea/gitea/assets/8344487/cf1d7776-4938-4825-922e-cbbbf28a5f33)
* Include heap pprof in diagnosis report to help debugging memory leaks (#28596)wxiaoguang2023-12-231-0/+7
|
* Fix `status_check_contexts` matching bug (#28582)Zettat1232023-12-221-1/+9
| | | | | | | | | | | | | | | | Fix #28570 Follow #24633 --- Copied from https://github.com/go-gitea/gitea/issues/28570#issuecomment-1867327999 The feature introduced in #24633 should be compatible with `status_check_contexts`. However, if one or more of `status_check_contexts` is not a legal glob expressions, `glob.Compile` will fail and the contexts cannot match. https://github.com/go-gitea/gitea/blob/21229ed2c8ed00f57100adf9ebc5f4a08da9a66e/routers/web/repo/pull.go#L653-L663
* Fix 405 method not allowed CORS / OIDC (#28583)morphelinho2023-12-221-0/+2
| | | | | | Follow #28184 Follow #28515 Fix problem with 405 method not allowed for CORS wrt OIDC
* Use information from previous blame parts (#28572)KN4CK3R2023-12-211-5/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #28545 `git blame` output can contain blocks without commit information if it was outputted before (the `0dafa97ea3f6d9662299579e5be1875cd28baaae 48 26 1` line): ``` fec25436488499df7231f63b857f66457c193d5c 24 25 1 author Bastien Montagne author-mail <bastien@blender.org> author-time 1660731031 author-tz +0200 committer Bastien Montagne committer-mail <bastien@blender.org> committer-time 1660731031 committer-tz +0200 summary LibOverride: Add Make/Reset/Clear entries to IDTemplate contextual menu. previous 839ece6477203382b7a7483062961540180ff1cd source/blender/editors/interface/interface_ops.c filename source/blender/editors/interface/interface_ops.c #include "BLT_translation.h" 0dafa97ea3f6d9662299579e5be1875cd28baaae 48 26 1 3d57bc4397fca53bc9702a27bbf50102827829b0 27 27 1 author Hans Goudey author-mail <hans@blender.org> author-time 1700131315 author-tz +0100 committer Hans Goudey committer-mail <hooglyboogly@noreply.localhost> committer-time 1700131315 committer-tz +0100 summary Cleanup: Move several blenkernel headers to C++ previous 451c054d9b7d3148a646caa5a72fb127a5b5c408 source/blender/editors/interface/interface_ops.cc filename source/blender/editors/interface/interface_ops.cc #include "BKE_context.hh" ``` This PR reuses data from the previous blame part to fill these gaps.
* Fix merging artifact chunks error when minio storage basepath is set (#28555)FuXiaoHei2023-12-211-4/+9
| | | | | | | | | | | | Related to https://github.com/go-gitea/gitea/issues/28279 When merging artifact chunks, it lists chunks from storage. When storage is minio, chunk's path contains `MINIO_BASE_PATH` that makes merging break. <del>So trim the `MINIO_BASE_PATH` when handle chunks.</del> Update the chunk file's basename to retain necessary information. It ensures that the directory in the chunk's path remains unaffected.
* Always enable caches (#28527)Lunny Xiao2023-12-196-39/+25
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Improve ObjectFormat interface (#28496)Lunny Xiao2023-12-193-4/+4
| | | | | | | | | | | | | | | | | | | | | | | The 4 functions are duplicated, especially as interface methods. I think we just need to keep `MustID` the only one and remove other 3. ``` MustID(b []byte) ObjectID MustIDFromString(s string) ObjectID NewID(b []byte) (ObjectID, error) NewIDFromString(s string) (ObjectID, error) ``` Introduced the new interfrace method `ComputeHash` which will replace the interface `HasherInterface`. Now we don't need to keep two interfaces. Reintroduced `git.NewIDFromString` and `git.MustIDFromString`. The new function will detect the hash length to decide which objectformat of it. If it's 40, then it's SHA1. If it's 64, then it's SHA256. This will be right if the commitID is a full one. So the parameter should be always a full commit id. @AdamMajer Please review.
* chore(api): support ignore password if login source type is LDAP for ↵Bo-Yi Wu2023-12-191-11/+21
| | | | | | | | | | | | creating user API (#28491) - Modify the `Password` field in `CreateUserOption` struct to remove the `Required` tag - Update the `v1_json.tmpl` template to include the `email` field and remove the `password` field --------- Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
* Only check online runner when detecting matching runners in workflows (#28286)yp053272023-12-181-1/+3
| | | | | | | | | | | Mentioned: [#28277](https://github.com/go-gitea/gitea/issues/28277#issuecomment-1831325276) We should only check online runner when detecting matching runners in workflows, as if runner is not online, the workflow will not run. ![image](https://github.com/go-gitea/gitea/assets/18380374/11855e9d-7241-4b7a-b8d7-49dbb94ba1c5)
* Add option to disable ambiguous unicode characters detection (#28454)wxiaoguang2023-12-172-14/+13
| | | | | | | | * Close #24483 * Close #28123 * Close #23682 * Close #23149 (maybe more)
* Adjust object format interface (#28469)Lunny Xiao2023-12-1710-35/+35
| | | | | | | - Remove `ObjectFormatID` - Remove function `ObjectFormatFromID`. - Use `Sha1ObjectFormat` directly but not a pointer because it's an empty struct. - Store `ObjectFormatName` in `repository` struct
* Abstract hash function usage (#28138)Adam Majer2023-12-1315-32/+61
| | | | | | Refactor Hash interfaces and centralize hash function. This will allow easier introduction of different hash function later on. This forms the "no-op" part of the SHA256 enablement patch.
* Add endpoint for not implemented Docker auth (#28457)KN4CK3R2023-12-132-1/+15
| | | | | | | | | | Recently Docker started to use the optional `POST /v2/token` endpoint which should respond with a `404 Not Found` status code instead of the current `405 Method Not Allowed`. > Note: Not all token servers implement oauth2. If the request to the endpoint returns 404 using the HTTP POST method, refer to Token Documentation for using the HTTP GET method supported by all token servers.
* Do some missing checks (#28423)Lunny Xiao2023-12-122-3/+39
|
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-121-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-30 22:07:02 +0000