summaryrefslogtreecommitdiffstats
path: root/templates/user/auth
Commit message (Collapse)AuthorAgeFilesLines
* Replace blue button and label classes with primary (#19763)silverwind2022-05-203-3/+3
| | | | | | | | | | | | | | | * make blue really blue * replace blue button and label classes with primary * add --color-blue-dark * add light color variants, tweak a few colors * fix colors * add comment Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Do not send activation email if manual confirm is set (#19119)zeripath2022-03-181-0/+2
| | | | | | | | | | If the mailer is configured then even if Manual confirm is set an activation email is still being sent because `handleUserCreated` is not checking for this case. Fix #17263 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix incorrect OAuth message (#18332)wxiaoguang2022-01-191-2/+2
| | | | | As the title, Fix #18327
* Webauthn nits (#18284)zeripath2022-01-151-1/+1
| | | | | | | This contains some additional fixes and small nits related to #17957 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Support webauthn (#17957)Lunny Xiao2022-01-144-56/+44
| | | | | | | Migrate from U2F to Webauthn Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Multiple Escaping Improvements (#17551)zeripath2021-11-161-2/+2
| | | | | | | | | | | | | | There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow U2F 2FA without TOTP (#11573)Kamil Domański2021-11-081-3/+5
| | | | | | | This change enables the usage of U2F without being forced to enroll an TOTP authenticator. The `/user/auth/u2f` has been changed to hide the "use TOTP instead" bar if TOTP is not enrolled. Fixes #5410 Fixes #17495
* Add groups scope/claim to OIDC/OAuth2 Provider (#17367)Nico Schieder2021-10-221-2/+4
| | | | | | | | | | | * Add groups scope/claim to OICD/OAuth2 Add support for groups claim as part of the OIDC/OAuth2 flow. Groups is a list of "org" and "org:team" strings to allow clients to authorize based on the groups a user is part of. Signed-off-by: Nico Schieder <code@nico-schieder.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Added introspection endpoint. (#16752)KN4CK3R2021-08-201-0/+1
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add fluid to ui container class to remove margin (#16396)Stanley Hu2021-07-202-2/+2
|
* Improve 2FA autofill (#16473)Jonathan Herlin2021-07-181-1/+1
| | | This improves the autofill suggestion on mobile devices and some password managers
* Add better errors for disabled account recovery (#15117)John Olheiser2021-06-251-1/+7
| | | | | | Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Add asymmetric JWT signing (#16010)KN4CK3R2021-06-171-0/+7
| | | | | | | | | | | * Added asymmetric token signing. * Load signing key from settings. * Added optional kid parameter. * Updated documentation. * Add "kid" to token header.
* Add OpenID claims "profile" and "email". (#16141)KN4CK3R2021-06-141-0/+29
| | | | | | | | | | | | * Added OpenID claims "profile" and "email". * Splitted error. * Added scopes_supported and claims_supported. * Added more metadata. Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* Remove remaining fontawesome usage in templates (#15952)silverwind2021-05-222-4/+4
| | | Can not remove the dependency yet because easymde depends on it.
* Allow only internal registration (#15795)65432021-05-092-5/+7
| | | | | * Add ALLOW_ONLY_INTERNAL_REGISTRATION into settings * OpenID respect setting too
* Feature/oauth userinfo (#15721)N. L. H2021-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | * Implemented userinfo #8534 * Make lint happy * Add userinfo endpoint to openid-configuration * Give an error when uid equals 0 * Implemented BearerTokenErrorCode handling * instead of ctx.error use ctx.json so that clients parse error and error_description correctly * Removed unneeded if statement * Use switch instead of subsequent if statements Have a default for unknown errorcodes. Co-authored-by: Nils Hillmann <hillmann@nlh-software.de> Co-authored-by: nlhsoftware <nlhsoftware@noreply.localhost>
* Fixed several activation bugs (#15473)KN4CK3R2021-04-301-11/+9
| | | | | | | | | | | * Removed unneeded form tag. * Fixed typo. * Fixed NPE. * Use better error page. * Splitted GET and POST.
* add well-known config for OIDC (#15355)techknowlogick2021-04-151-0/+9
| | | | | | | | | | | | | | * add well-known config for OIDC * spacing per feedback * Update oidc_wellknown.tmpl * add id_token * Update oidc_wellknown.tmpl Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use subdir for URL (#15446)KN4CK3R2021-04-141-1/+1
| | | | Fixes #15444
* Enforce tab indentation in templates (#15289)silverwind2021-04-102-2/+1
| | | | | | | | | | | | | | | | | | * Enforce tab indendation in templates This adds editorconfig-checker [1] to lint the template files so they conform the editorconfig files. I fixed all current identation issues using the fix mode of eclint [2] and some manual corrections. We can extend this linting to other files later, for now I'd like this PR to focus on HTML template files only. [1] https://github.com/editorconfig-checker/editorconfig-checker [2] https://github.com/jedmao/eclint * fix indendation Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Remove usage of JS globals (#15378)silverwind2021-04-091-3/+2
| | | | | | Refactor the exported globals in index.js to JS-initialized event handlers. Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* fix link account ui (#14763)a10121127962021-02-211-12/+11
| | | | | Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix captcha (#14488)Lunny Xiao2021-01-272-2/+2
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
* ensure timeout error is shown on u2f timeout (#14417)zeripath2021-01-221-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* Minimal OpenID Connect implementation (#14139)Johnny Oskarsson2021-01-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | This is "minimal" in the sense that only the Authorization Code Flow from OpenID Connect Core is implemented. No discovery, no configuration endpoint, and no user scope management. OpenID Connect is an extension to the (already implemented) OAuth 2.0 protocol, and essentially an `id_token` JWT is added to the access token endpoint response when using the Authorization Code Flow. I also added support for the "nonce" field since it is required to be used in the id_token if the client decides to include it in its initial request. In order to enable this extension an OAuth 2.0 scope containing "openid" is needed. Other OAuth 2.0 requests should not be impacted by this change. This minimal implementation is enough to enable single sign-on (SSO) for other sites, e.g. by using something like `mod_auth_openidc` to only allow access to a CI server if a user has logged into Gitea. Fixes: #1310 Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Add class to page content to unify top margin (#13766)silverwind2020-11-3018-21/+18
| | | | | | | | | | | | | | | | | | | * Add class to page content to unify top margin Previously pages would individually set this margin but some didn't so content would stick to the header without any space. Resolve this by adding a new class that is added on all pages. The only place where we remove this margin again is on the pages with menu or wrapper in the header. * fix admin notices * fix team pages * fix loading segment on gitgraph for arc-green * fix last missing case Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Markdown and Repo header tweaks (#13744)silverwind2020-11-291-0/+2
| | | | | | | | | | | | | | | | * Markdown and Repo header tweaks - Use CSS vars for all markdown colors - Tweak repo header, removing double borders and adjust sizes - Use menu instead of buttons for issue open/close switcher - Add emoji inversion for select emoji glyphs in arc-green - Use border over box-shadow for all buttons - Add spacing element to login form without openid * repo settings navbar fix * use shared template in more places and adjust dashboard * fix remaining open/close combos
* Verify password for local-account activation (#13631)65432020-11-281-1/+13
| | | | | | | | | | | | | | | | | | | | | * Verify passwords for activation This is to prevent 3rd party activation * Fix function comment * only veify password on local-account aktivation * fix lint * Update templates/user/auth/activate.tmpl Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Andreas Shimokawa <shimokawa@fsfe.org> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* CSS navbar and color tweaks (#13609)silverwind2020-11-263-41/+47
| | | | | | | | | | | | | | | | | | | * CSS and color tweaks - Unify navbar-style menus - Fix admin bar overlapping menu bar - Fixes file edit comment box - Fix double border on review box - Fix review timeline icons * Many fixes to new-menu and navbar layout enhancements * misc settings fixes * navbar tweak * fix pr tabs * branch tag and arc color tweaks
* unify layout between auth pages (#13547)Norwin2020-11-134-92/+93
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Set appropriate `autocomplete` attributes on password fields (#13078)silverwind2020-10-094-6/+6
| | | | | | | `new-password` prevents annoying autocompletion in some cases, thought it's not semantically correct to use that for example on all three fields on the user account page, so some annoyances remain. Co-authored-by: Lauris BH <lauris@nix.lv>
* hCaptcha Support (#12594)John Olheiser2020-10-022-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Initial work on hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Use module Signed-off-by: jolheiser <john.olheiser@gmail.com> * Format Signed-off-by: jolheiser <john.olheiser@gmail.com> * At least return and debug log a captcha error Signed-off-by: jolheiser <john.olheiser@gmail.com> * Pass context to hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Add context to recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * fix lint Signed-off-by: Andrew Thornton <art27@cantab.net> * Finish hcaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Update example config Signed-off-by: jolheiser <john.olheiser@gmail.com> * Apply error fix for recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Change recaptcha ChallengeTS to string Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Escape more things that are passed through str2html (#12622)zeripath2020-08-281-3/+3
| | | | | | | | | | | | | | * Escape more things that are passed through str2html Signed-off-by: Andrew Thornton <art27@cantab.net> * Bloody editors! Co-authored-by: mrsdizzie <info@mrsdizzie.com> * Update routers/user/oauth.go Co-authored-by: mrsdizzie <info@mrsdizzie.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Escape Email in forgot_password.tmpl (#12610)zeripath2020-08-261-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix: add type=text for user_name (password manager) (#12250)Tchoupinax2020-07-155-5/+5
| | | | | | | | | * fix: add type=text for user_name (password manager) * Update templates/user/auth/reset_passwd.tmpl Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com> Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com>
* Ensure that 2fa is checked on reset-password (#9857)zeripath2020-01-191-1/+22
| | | | | | | | | | | | * Ensure that 2fa is checked on reset-password * Apply suggestions from code review Co-Authored-By: Lauris BH <lauris@nix.lv> * Properly manage scratch_code regeneration Co-authored-by: Lauris BH <lauris@nix.lv>
* update #9066 Always show Password field on link account sign in page (#9147)Benno2019-11-241-1/+1
|
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
* Move index.js to web_src and use webpack to pack them (#8598)Lunny Xiao2019-11-131-1/+1
| | | | | | | | | | | | * Move index.js to web_src and use webpack * Fix initHeatMap * update eslint and move webpack to devDependencies * update index.js * add eslint env node
* Use AppSubUrl for more redirections (#8647)zeripath2019-10-231-2/+2
| | | | Fix #8461 - fix misspelling of {{AppSubUrl}} and other misspelling in template Fixes /explore and organisation redirection
* Add nofollow to sign in links (#8509)guillep2k2019-10-141-2/+2
|
* Make captcha and password optional for external accounts (#6606)AJ ONeal2019-07-062-8/+13
|
* UX + Security current user password reset (#5042)AJ ONeal2019-04-181-0/+15
| | | | | | | | | | | | | | * allow current user to reset their own password * handle reset password edge cases properly and consistently * remove dangling assignment * properly label account recovery instead of reset password * remove 'Click here' from button * update English-only account-recovery templates
* fix: avoid multi-clicks when perform oauth2 login (#6467)BetaCat2019-03-311-4/+15
|
* Integrate OAuth2 Provider (#5378)Jonas Franz2019-03-082-0/+47
|
* UX of link account (Step 1) (#5006)AJ ONeal2018-10-283-11/+49
| | | | | | | | | | | | | | * Show either sign up OR sign in * disambiguate fresh start from adding recovery options * use tabs to switch between account link flows * add active to tab body as well * changes as per discussion * handle specific error; fix missing err typo
* Fix missing AppSubUrl in few more templates (#5021)SagePtr2018-10-051-1/+1
|
* Force user to change password (#4489)Lanre Adelowo2018-09-132-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * redirect to login page after successfully activating account * force users to change password if account was created by an admin * force users to change password if account was created by an admin * fixed build * fixed build * fix pending issues with translation and wrong routes * make sure path check is safe * remove unneccessary newline * make sure users that don't have to view the form get redirected * move route to use /settings prefix so as to make sure unauthenticated users can't view the page * update as per @lafriks review * add necessary comment * remove unrelated changes * support redirecting to location the user actually want to go to before being forced to change his/her password * run make fmt * added tests * improve assertions * add assertion * fix copyright year Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
* Add Recaptcha functionality to Gitea (#4044)Fluf2018-07-052-2/+12
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-24 22:02:27 +0000