aboutsummaryrefslogtreecommitdiffstats
path: root/routers
Commit message (Collapse)AuthorAgeFilesLines
* Refactor markup render system (#32612)wxiaoguang2024-11-2417-224/+151
| | | | | | | | | | This PR removes (almost) all path tricks, and introduces "renderhelper" package. Now we can clearly see the rendering behaviors for comment/file/wiki, more details are in "renderhelper" tests. Fix #31411 , fix #18592, fix #25632 and maybe more problems. (ps: fix #32608 by the way)
* Update the list of watchers and stargazers when clicking watch/unwatch or ↵Yarden Shoham2024-11-222-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | star/unstar (#32570) We make sure the user cards are updated - Fixes https://github.com/go-gitea/gitea/issues/32561 I also removed `ctx.Data["PageIsWatchers"] = true` and `ctx.Data["PageIsStargazers"] = true` as they are not used anywhere. # Before ![before](https://github.com/user-attachments/assets/e3bc3235-35eb-4eda-862d-bdf2510282ea) # After ![after](https://github.com/user-attachments/assets/bc0488a5-8399-4cf6-95c9-17328a9702eb) --------- Signed-off-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
* Fix get reviewers' bug (#32415)Lunny Xiao2024-11-222-5/+13
| | | | | | | | | | This PR rewrites `GetReviewer` function and move it to service layer. Reviewers should not be watchers, so that this PR removed all watchers from reviewers. When the repository is under an organization, the pull request unit read permission will be checked to resolve the bug of #32394 Fix #32394
* Refactor markup render system (#32589)wxiaoguang2024-11-2219-208/+153
| | | | This PR mainly moves some code and introduces `RenderContext.WithXxx` functions
* Enhancing Gitea OAuth2 Provider with Granular Scopes for Resource Access ↵Marcell Mars2024-11-221-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#32573) Resolve #31609 This PR was initiated following my personal research to find the lightest possible Single Sign-On solution for self-hosted setups. The existing solutions often seemed too enterprise-oriented, involving many moving parts and services, demanding significant resources while promising planetary-scale capabilities. Others were adequate in supporting basic OAuth2 flows but lacked proper user management features, such as a change password UI. Gitea hits the sweet spot for me, provided it supports more granular access permissions for resources under users who accept the OAuth2 application. This PR aims to introduce granularity in handling user resources as nonintrusively and simply as possible. It allows third parties to inform users about their intent to not ask for the full access and instead request a specific, reduced scope. If the provided scopes are **only** the typical ones for OIDC/OAuth2—`openid`, `profile`, `email`, and `groups`—everything remains unchanged (currently full access to user's resources). Additionally, this PR supports processing scopes already introduced with [personal tokens](https://docs.gitea.com/development/oauth2-provider#scopes) (e.g. `read:user`, `write:issue`, `read:group`, `write:repository`...) Personal tokens define scopes around specific resources: user info, repositories, issues, packages, organizations, notifications, miscellaneous, admin, and activitypub, with access delineated by read and/or write permissions. The initial case I wanted to address was to have Gitea act as an OAuth2 Identity Provider. To achieve that, with this PR, I would only add `openid public-only` to provide access token to the third party to authenticate the Gitea's user but no further access to the API and users resources. Another example: if a third party wanted to interact solely with Issues, it would need to add `read:user` (for authorization) and `read:issue`/`write:issue` to manage Issues. My approach is based on my understanding of how scopes can be utilized, supported by examples like [Sample Use Cases: Scopes and Claims](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims) on auth0.com. I renamed `CheckOAuthAccessToken` to `GetOAuthAccessTokenScopeAndUserID` so now it returns AccessTokenScope and user's ID. In the case of additional scopes in `userIDFromToken` the default `all` would be reduced to whatever was asked via those scopes. The main difference is the opportunity to reduce the permissions from `all`, as is currently the case, to what is provided by the additional scopes described above. Screenshots: ![Screenshot_20241121_121405](https://github.com/user-attachments/assets/29deaed7-4333-4b02-8898-b822e6f2463e) ![Screenshot_20241121_120211](https://github.com/user-attachments/assets/7a4a4ef7-409c-4116-9d5f-2fe00eb37167) ![Screenshot_20241121_120119](https://github.com/user-attachments/assets/aa52c1a2-212d-4e64-bcdf-7122cee49eb6) ![Screenshot_20241121_120018](https://github.com/user-attachments/assets/9eac318c-e381-4ea9-9e2c-3a3f60319e47) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Add line-through for deleted branch on pull request view page (#32500)Lunny Xiao2024-11-211-0/+1
| | | | | | | | | | | | | Base branch deleted ![图片](https://github.com/user-attachments/assets/bc45aa33-d514-47c8-885a-de9732f2f3d5) branch deleted comment ![图片](https://github.com/user-attachments/assets/83729bbb-2ee8-4bd3-b6f1-780d2daad3d4) Head branch deleted ![图片](https://github.com/user-attachments/assets/90120b22-34a9-4387-aae9-5c882e8d421a)
* Support HTTP POST requests to `/userinfo`, aligning to OpenID Core ↵Marcell Mars2024-11-201-1/+1
| | | | | | | | | specification (#32578) This PR adds support for the HTTP POST requests to `/userinfo` endpoint. While the OpenID Core specification says both are supported and recommends using HTTP GET. ref: https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
* Remove duplicate empty repo check in delete branch API (#32569)Kemal Zebari2024-11-201-5/+0
| | | | | | Found while working on #32433. This branch will never be executed because we have would have already made the same check a couple lines above.
* Use user.FullName in Oauth2 id_token response (#32542)Baltazár Radics2024-11-182-21/+2
| | | | This makes `/login/oauth/authorize` behave the same way as the `/login/oauth/userinfo` endpoint.
* Refactor push mirror find and add check for updating push mirror (#32539)Lunny Xiao2024-11-181-36/+15
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor markup render system (#32533)wxiaoguang2024-11-181-1/+1
| | | | | Remove unmaintainable sanitizer rules. No need to add special "class" regexp rules anymore, use RenderInternal.SafeAttr instead, more details (and examples) are in the tests
* Refactor find forks and fix possible bugs that weak permissions check (#32528)Lunny Xiao2024-11-182-15/+23
| | | | | | | | | | | - Move models/GetForks to services/FindForks - Add doer as a parameter of FindForks to check permissions - Slight performance optimization for get forks API with batch loading of repository units - Add tests for forking repository to organizations --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use better name for userinfo structure (#32544)Lunny Xiao2024-11-181-11/+11
|
* Fix and refactor markdown rendering (#32522)wxiaoguang2024-11-166-14/+14
|
* Fix oauth2 error handle not return immediately (#32514)Lunny Xiao2024-11-151-0/+2
|
* Refactor render system (#32492)wxiaoguang2024-11-148-69/+50
| | | | | | | | | | | | | | | | | | | There were too many patches to the Render system, it's really difficult to make further improvements. This PR clears the legacy problems and fix TODOs. 1. Rename `RenderContext.Type` to `RenderContext.MarkupType` to clarify its usage. 2. Use `ContentMode` to replace `meta["mode"]` and `IsWiki`, to clarify the rendering behaviors. 3. Use "wiki" mode instead of "mode=gfm + wiki=true" 4. Merge `renderByType` and `renderByFile` 5. Add more comments ---- The problem of "mode=document": in many cases it is not set, so many non-comment places use comment's hard line break incorrectly
* Fix LFS route mock, realm, middleware names (#32488)wxiaoguang2024-11-135-58/+56
| | | | | | | | | | 1. move "internal-lfs" route mock to "common-lfs" 2. fine tune tests 3. fix "realm" strings, according to RFC: https://datatracker.ietf.org/doc/html/rfc2617: * realm = "realm" "=" realm-value * realm-value = quoted-string 4. clarify some names of the middlewares, rename `ignXxx` to `optXxx` to match `reqXxx`, and rename ambiguous `requireSignIn` to `reqGitSignIn`
* Disable Oauth check if oauth disabled (#32368)Lunny Xiao2024-11-121-32/+38
| | | | | | | | Fix #32367 --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor LFS SSH and internal routers (#32473)wxiaoguang2024-11-123-53/+49
| | | | | | | | | | | | | | | | | | Gitea instance keeps reporting a lot of errors like "LFS SSH transfer connection denied, pure SSH protocol is disabled". When starting debugging the problem, there are more problems found. Try to address most of them: * avoid unnecessary server side error logs (change `fail()` to not log them) * figure out the broken tests/user2/lfs.git (added comments) * avoid `migratePushMirrors` failure when a repository doesn't exist (ignore them) * avoid "Authorization" (internal&lfs) header conflicts, remove the tricky "swapAuth" and use "X-Gitea-Internal-Auth" * make internal token comparing constant time (it wasn't a serous problem because in a real world it's nearly impossible to timing-attack the token, but good to fix and backport) * avoid duplicate routers (introduce AddOwnerRepoGitLFSRoutes) * avoid "internal (private)" routes using session/web context (they should use private context) * fix incorrect "path" usages (use "filepath") * fix incorrect mocked route point handling (need to check func nil correctly) * split some tests from "git general tests" to "git misc tests" (to keep "git_general_test.go" simple) Still no correct result for Git LFS SSH tests. So the code is kept there (`tests/integration/git_lfs_ssh_test.go`) and a FIXME explains the details.
* Harden runner updateTask and updateLog api (#32462)ChristopherHX2024-11-111-1/+7
| | | Per proposal https://github.com/go-gitea/gitea/issues/32461
* Move some functions from issue.go to standalone files (#32468)Lunny Xiao2024-11-118-3146/+3298
| | | | | | | Just functions move, no code change. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Calculate `PublicOnly` for org membership only once (#32234)65432024-11-113-16/+22
| | | | | | | | | | Refactoring of #32211 this move the PublicOnly() filter calcuation next to the DB querys and let it be decided by the Doer --- *Sponsored by Kithara Software GmbH*
* Refactor sidebar assignee&milestone&project selectors (#32465)wxiaoguang2024-11-113-260/+228
| | | | | | | | | | | | | | | | | | | Follow #32460 Now the code could be much clearer than before and easier to maintain. A lot of legacy code is removed. Manually tested. This PR is large enough, that fine tunes could be deferred to the future if there is no bug found or design problem. Screenshots: <details> ![image](https://github.com/user-attachments/assets/35f4ab7b-1bc0-4bad-a73c-a4569328303c) </details>
* Refactor sidebar label selector (#32460)wxiaoguang2024-11-105-93/+113
| | | Introduce `issueSidebarLabelsData` to handle all sidebar labels related data.
* Add reviewers selection to new pull request (#32403)Calvin K2024-11-095-121/+208
| | | | | | | | | | Users could add reviewers when creating new PRs. --------- Co-authored-by: splitt3r <splitt3r@users.noreply.github.com> Co-authored-by: Sebastian Sauer <sauer.sebastian@gmail.com> Co-authored-by: bb-ben <70356237+bboerben@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor issue page info (#32445)wxiaoguang2024-11-081-3/+3
| | | Fix a longstanding TODO since 2021 (#14826) / 2018 (#2531)
* Support quote selected comments to reply (#32431)wxiaoguang2024-11-071-2/+4
| | | | | | | | | Many existing tests were quite hacky, these could be improved later. <details> ![image](https://github.com/user-attachments/assets/93aebb4f-9de5-4cb8-910b-50c64cbcd25a) </details>
* Move AddCollabrator and CreateRepositoryByExample to service layer (#32419)Lunny Xiao2024-11-073-18/+14
| | | | | | - [x] Move `CreateRepositoryByExample` to service layer - [x] Move `AddCollabrator` to service layer - [x] Add a new parameter for `AddCollabrator` so that changing mode immediately after that will become unnecessary.
* Include file extension checks in attachment API (#32151)Kemal Zebari2024-11-063-9/+30
| | | | | | From testing, I found that issue posters and users with repository write access are able to edit attachment names in a way that circumvents the instance-level file extension restrictions using the edit attachment APIs. This snapshot adds checks for these endpoints.
* Fix milestone deadline and date related problems (#32339)Lunny Xiao2024-11-056-45/+50
| | | | | | | | | Use zero instead of 9999-12-31 for deadline Fix #32291 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Refactor RepoRefByType (#32413)wxiaoguang2024-11-053-11/+11
| | | | | 1. clarify the "filepath" could(should) contain "{ref}" 2. remove unclear RepoRefLegacy and RepoRefAny, use RepoRefUnknown to guess 3. by the way, avoid using AppURL
* Refactor template ctx and render utils (#32422)wxiaoguang2024-11-053-5/+6
| | | Clean up the templates
* Refactor DateUtils and merge TimeSince (#32409)wxiaoguang2024-11-042-5/+3
| | | Follow #32383 and #32402
* Fix git error handling (#32401)wxiaoguang2024-11-023-13/+7
|
* Replace DateTime with DateUtils (#32383)wxiaoguang2024-11-021-2/+2
|
* improve performance of diffs (#32393)Rowan Bohde2024-11-023-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | This has two major changes that significantly reduce the amount of work done for large diffs: * Kill a running git process when reaching the maximum number of files in a diff, preventing it from processing the entire diff. * When loading a diff with the URL param `file-only=true`, skip loading stats. This speeds up loading both hidden files of a diff and sections of a diff when clicking the "Show More" button. A couple of minor things from profiling are also included: * Reuse existing repo in `PrepareViewPullInfo` if head and base are the same. The performance impact is going to depend heavily on the individual diff and the hardware it runs on, but when testing locally on a diff changing 100k+ lines over hundreds of files, I'm seeing a roughly 75% reduction in time to load the result of "Show More" --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix `missing signature key` error when pulling Docker images with ↵Zettat1232024-10-3110-11/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `SERVE_DIRECT` enabled (#32365) Fix #28121 I did some tests and found that the `missing signature key` error is caused by an incorrect `Content-Type` header. Gitea correctly sets the `Content-Type` header when serving files. https://github.com/go-gitea/gitea/blob/348d1d0f322ca57c459acd902f54821d687ca804/routers/api/packages/container/container.go#L712-L717 However, when `SERVE_DIRECT` is enabled, the `Content-Type` header may be set to an incorrect value by the storage service. To fix this issue, we can use query parameters to override response header values. https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html <img width="600px" src="https://github.com/user-attachments/assets/f2ff90f0-f1df-46f9-9680-b8120222c555" /> In this PR, I introduced a new parameter to the `URL` method to support additional parameters. ``` URL(path, name string, reqParams url.Values) (*url.URL, error) ``` --- Most S3-like services support specifying the content type when storing objects. However, Gitea always use `application/octet-stream`. Therefore, I believe we also need to improve the `Save` method to support storing objects with the correct content type. https://github.com/go-gitea/gitea/blob/b7fb20e73e63b8edc9b90c52073e248bef428fcc/modules/storage/minio.go#L214-L221
* Fix suggestions for issues (#32380)wxiaoguang2024-10-301-19/+8
|
* refactor: remove redundant err declarations (#32381)Oleksandr Redko2024-10-305-5/+0
|
* Respect UI.ExploreDefaultSort setting again (#32357)65432024-10-302-2/+4
| | | | | | fix regression of https://github.com/go-gitea/gitea/pull/29430 --- *Sponsored by Kithara Software GmbH*
* Suggestions for issues (#32327)Anbraten2024-10-292-0/+94
| | | closes #16872
* Refactor the DB migration system slightly (#32344)wxiaoguang2024-10-271-1/+1
| | | | Introduce "idNumber" for each migration, and clarify the difference between the migration ID number and database version.
* Fix disable 2fa bug (#32320)Lunny Xiao2024-10-231-3/+6
|
* Make admins adhere to branch protection rules (#32248)Tim2024-10-232-0/+6
| | | | | | | | | | | | This introduces a new flag `BlockAdminMergeOverride` on the branch protection rules that prevents admins/repo owners from bypassing branch protection rules and merging without approvals or failing status checks. Fixes #17131 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Add `DISABLE_ORGANIZATIONS_PAGE` and `DISABLE_CODE_PAGE` settings for ↵Zettat1232024-10-227-30/+36
| | | | | | | | | | | | explore pages and fix an issue related to user search (#32288) These settings can allow users to only display the repositories explore page. Thanks to yp05327 and wxiaoguang ! --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* API: enhance SearchIssues swagger docs (#32208)65432024-10-191-19/+32
| | | | | | | this will result in better api clients generated out of the openapi docs ... for SearchIssues --- *Sponsored by Kithara Software GmbH*
* Make `owner/repo/pulls` handlers use "PR reader" permission (#32254)wxiaoguang2024-10-151-26/+29
| | | Fix #32253 (partially)
* Make git push options accept short name (#32245)wxiaoguang2024-10-121-1/+1
| | | | | Just like what most CLI parsers do: `--opt` means `opt=true` Then users could use `-o force-push` as `-o force-push=true`
* Allow maintainers to view and edit files of private repos when "Allow ↵Zettat1232024-10-111-2/+0
| | | | | maintainers to edit" is enabled (#32215) Fix #31539
* Use per package global lock for container uploads instead of memory lock ↵Lunny Xiao2024-10-111-8/+18
| | | | | | (#31860) This PR uses a per-package lock instead of a global lock for container uploads. So that different packages can be uploaded simultaneously.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-20 17:59:35 +0000