summaryrefslogtreecommitdiffstats
path: root/templates/user/auth
Commit message (Collapse)AuthorAgeFilesLines
* Add new captcha: cloudflare turnstile (#22369)ByLCY2023-02-051-3/+7
| | | | | | | | | Added a new captcha(cloudflare turnstile) and its corresponding document. Cloudflare turnstile official instructions are here: https://developers.cloudflare.com/turnstile Signed-off-by: ByLCY <bylcy@bylcy.dev> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com>
* Add main landmark to templates and adjust titles (#22670)Felipe Leopoldo Sologuren Gutiérrez2023-02-0116-16/+16
| | | | | | | * Add main aria landmark to templates * Adjust some titles to improve understanding of location in navigation Contributed by @Forgejo
* Fix error on account activation with wrong passwd (#22609)Otto Richter (fnetX)2023-01-281-1/+3
| | | | | | | | | | | | | | On activating local accounts, the error message didn't differentiate between using a wrong or expired token, or a wrong password. The result could already be obtained from the behaviour (different screens were presented), but the error message was misleading and lead to confusion for new users on Codeberg with Forgejo. Now, entering a wrong password for a valid token prints a different error message. The problem was introduced in 0f14f69e6070c9aca09f57c419e7d6007d0e520b. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Optimize html templates (#22080)Jason Song2022-12-092-4/+4
| | | Replace `active{{end}} item` with `active{{end}} item`.
* Add option to enable CAPTCHA validation for login (#21638)Xinyu Zhou2022-11-224-52/+30
| | | | | | | | | | | | | | | | | Enable this to require captcha validation for user login. You also must enable `ENABLE_CAPTCHA`. Summary: - Consolidate CAPTCHA template - add CAPTCHA handle and context - add `REQUIRE_CAPTCHA_FOR_LOGIN` config and docs - Consolidate CAPTCHA set-up and verification code Partially resolved #6049 Signed-off-by: Xinyu Zhou <i@sourcehut.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Support instance-wide OAuth2 applications (#21335)qwerty2872022-10-121-1/+1
| | | | | | | Support OAuth2 applications created by admins on the admin panel, they aren't owned by anybody. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Center-aligning content of WebAuthN page (#21127)neon2022-09-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | <!-- Please check the following: 1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for bug fixes. 2. Read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md 3. Describe what your pull request does and which issue you're targeting (if any) --> This attempts to correct #21126 , where the content of the page is not center-aligned. (Note: I think this contains the right commits - but, those other commits seem superfluous. I'm not sure I've made the pull request correctly. I don't often use the pull request pattern when working, opting to use the merge-request pattern instead for my workplace. If there are any issues, please let me know and I will try to correct them.) Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Make sure fmt catches all templates (#20979)silverwind2022-08-316-13/+13
| | | | | | | | * Make sure fmt catches all templates Make's `wildcard` is not recursive so it missed many template files, fix that by using `find`. * Update Makefile
* Fix create repository page's help text (#20810)Gusted2022-08-181-1/+1
|
* Add support mCaptcha as captcha provider (#20458)Gusted2022-08-102-0/+13
| | | | | https://mcaptcha.org/ Co-authored-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@users.noreply.github.com>
* Refactor `i18n` to `locale` (#20153)Gusted2022-06-2720-113/+113
| | | | | | | | | | | * Refactor `i18n` to `locale` - Currently we're using the `i18n` variable naming for the `locale` struct. This contains locale's specific information and cannot be used for general i18n purpose, therefore refactoring it to `locale` makes more sense. - Ref: https://github.com/go-gitea/gitea/pull/20096#discussion_r906699200 * Update routers/install/install.go
* Replace blue button and label classes with primary (#19763)silverwind2022-05-203-3/+3
| | | | | | | | | | | | | | | * make blue really blue * replace blue button and label classes with primary * add --color-blue-dark * add light color variants, tweak a few colors * fix colors * add comment Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Do not send activation email if manual confirm is set (#19119)zeripath2022-03-181-0/+2
| | | | | | | | | | If the mailer is configured then even if Manual confirm is set an activation email is still being sent because `handleUserCreated` is not checking for this case. Fix #17263 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix incorrect OAuth message (#18332)wxiaoguang2022-01-191-2/+2
| | | | | As the title, Fix #18327
* Webauthn nits (#18284)zeripath2022-01-151-1/+1
| | | | | | | This contains some additional fixes and small nits related to #17957 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Support webauthn (#17957)Lunny Xiao2022-01-144-56/+44
| | | | | | | Migrate from U2F to Webauthn Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Multiple Escaping Improvements (#17551)zeripath2021-11-161-2/+2
| | | | | | | | | | | | | | There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this. This is an extensive PR attempting to fix these issues. 1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping. 2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand. 3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.) 5. The title generation in feeds is now properly escaped. 6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>
* Allow U2F 2FA without TOTP (#11573)Kamil Domański2021-11-081-3/+5
| | | | | | | This change enables the usage of U2F without being forced to enroll an TOTP authenticator. The `/user/auth/u2f` has been changed to hide the "use TOTP instead" bar if TOTP is not enrolled. Fixes #5410 Fixes #17495
* Add groups scope/claim to OIDC/OAuth2 Provider (#17367)Nico Schieder2021-10-221-2/+4
| | | | | | | | | | | * Add groups scope/claim to OICD/OAuth2 Add support for groups claim as part of the OIDC/OAuth2 flow. Groups is a list of "org" and "org:team" strings to allow clients to authorize based on the groups a user is part of. Signed-off-by: Nico Schieder <code@nico-schieder.de> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Added introspection endpoint. (#16752)KN4CK3R2021-08-201-0/+1
| | | Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add fluid to ui container class to remove margin (#16396)Stanley Hu2021-07-202-2/+2
|
* Improve 2FA autofill (#16473)Jonathan Herlin2021-07-181-1/+1
| | | This improves the autofill suggestion on mobile devices and some password managers
* Add better errors for disabled account recovery (#15117)John Olheiser2021-06-251-1/+7
| | | | | | Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Add asymmetric JWT signing (#16010)KN4CK3R2021-06-171-0/+7
| | | | | | | | | | | * Added asymmetric token signing. * Load signing key from settings. * Added optional kid parameter. * Updated documentation. * Add "kid" to token header.
* Add OpenID claims "profile" and "email". (#16141)KN4CK3R2021-06-141-0/+29
| | | | | | | | | | | | * Added OpenID claims "profile" and "email". * Splitted error. * Added scopes_supported and claims_supported. * Added more metadata. Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* Remove remaining fontawesome usage in templates (#15952)silverwind2021-05-222-4/+4
| | | Can not remove the dependency yet because easymde depends on it.
* Allow only internal registration (#15795)65432021-05-092-5/+7
| | | | | * Add ALLOW_ONLY_INTERNAL_REGISTRATION into settings * OpenID respect setting too
* Feature/oauth userinfo (#15721)N. L. H2021-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | * Implemented userinfo #8534 * Make lint happy * Add userinfo endpoint to openid-configuration * Give an error when uid equals 0 * Implemented BearerTokenErrorCode handling * instead of ctx.error use ctx.json so that clients parse error and error_description correctly * Removed unneeded if statement * Use switch instead of subsequent if statements Have a default for unknown errorcodes. Co-authored-by: Nils Hillmann <hillmann@nlh-software.de> Co-authored-by: nlhsoftware <nlhsoftware@noreply.localhost>
* Fixed several activation bugs (#15473)KN4CK3R2021-04-301-11/+9
| | | | | | | | | | | * Removed unneeded form tag. * Fixed typo. * Fixed NPE. * Use better error page. * Splitted GET and POST.
* add well-known config for OIDC (#15355)techknowlogick2021-04-151-0/+9
| | | | | | | | | | | | | | * add well-known config for OIDC * spacing per feedback * Update oidc_wellknown.tmpl * add id_token * Update oidc_wellknown.tmpl Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use subdir for URL (#15446)KN4CK3R2021-04-141-1/+1
| | | | Fixes #15444
* Enforce tab indentation in templates (#15289)silverwind2021-04-102-2/+1
| | | | | | | | | | | | | | | | | | * Enforce tab indendation in templates This adds editorconfig-checker [1] to lint the template files so they conform the editorconfig files. I fixed all current identation issues using the fix mode of eclint [2] and some manual corrections. We can extend this linting to other files later, for now I'd like this PR to focus on HTML template files only. [1] https://github.com/editorconfig-checker/editorconfig-checker [2] https://github.com/jedmao/eclint * fix indendation Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Remove usage of JS globals (#15378)silverwind2021-04-091-3/+2
| | | | | | Refactor the exported globals in index.js to JS-initialized event handlers. Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* fix link account ui (#14763)a10121127962021-02-211-12/+11
| | | | | Signed-off-by: a1012112796 <1012112796@qq.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Fix captcha (#14488)Lunny Xiao2021-01-272-2/+2
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
* ensure timeout error is shown on u2f timeout (#14417)zeripath2021-01-221-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* Minimal OpenID Connect implementation (#14139)Johnny Oskarsson2021-01-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | This is "minimal" in the sense that only the Authorization Code Flow from OpenID Connect Core is implemented. No discovery, no configuration endpoint, and no user scope management. OpenID Connect is an extension to the (already implemented) OAuth 2.0 protocol, and essentially an `id_token` JWT is added to the access token endpoint response when using the Authorization Code Flow. I also added support for the "nonce" field since it is required to be used in the id_token if the client decides to include it in its initial request. In order to enable this extension an OAuth 2.0 scope containing "openid" is needed. Other OAuth 2.0 requests should not be impacted by this change. This minimal implementation is enough to enable single sign-on (SSO) for other sites, e.g. by using something like `mod_auth_openidc` to only allow access to a CI server if a user has logged into Gitea. Fixes: #1310 Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Add class to page content to unify top margin (#13766)silverwind2020-11-3018-21/+18
| | | | | | | | | | | | | | | | | | | * Add class to page content to unify top margin Previously pages would individually set this margin but some didn't so content would stick to the header without any space. Resolve this by adding a new class that is added on all pages. The only place where we remove this margin again is on the pages with menu or wrapper in the header. * fix admin notices * fix team pages * fix loading segment on gitgraph for arc-green * fix last missing case Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Markdown and Repo header tweaks (#13744)silverwind2020-11-291-0/+2
| | | | | | | | | | | | | | | | * Markdown and Repo header tweaks - Use CSS vars for all markdown colors - Tweak repo header, removing double borders and adjust sizes - Use menu instead of buttons for issue open/close switcher - Add emoji inversion for select emoji glyphs in arc-green - Use border over box-shadow for all buttons - Add spacing element to login form without openid * repo settings navbar fix * use shared template in more places and adjust dashboard * fix remaining open/close combos
* Verify password for local-account activation (#13631)65432020-11-281-1/+13
| | | | | | | | | | | | | | | | | | | | | * Verify passwords for activation This is to prevent 3rd party activation * Fix function comment * only veify password on local-account aktivation * fix lint * Update templates/user/auth/activate.tmpl Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Andreas Shimokawa <shimokawa@fsfe.org> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* CSS navbar and color tweaks (#13609)silverwind2020-11-263-41/+47
| | | | | | | | | | | | | | | | | | | * CSS and color tweaks - Unify navbar-style menus - Fix admin bar overlapping menu bar - Fixes file edit comment box - Fix double border on review box - Fix review timeline icons * Many fixes to new-menu and navbar layout enhancements * misc settings fixes * navbar tweak * fix pr tabs * branch tag and arc color tweaks
* unify layout between auth pages (#13547)Norwin2020-11-134-92/+93
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Set appropriate `autocomplete` attributes on password fields (#13078)silverwind2020-10-094-6/+6
| | | | | | | `new-password` prevents annoying autocompletion in some cases, thought it's not semantically correct to use that for example on all three fields on the user account page, so some annoyances remain. Co-authored-by: Lauris BH <lauris@nix.lv>
* hCaptcha Support (#12594)John Olheiser2020-10-022-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Initial work on hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Use module Signed-off-by: jolheiser <john.olheiser@gmail.com> * Format Signed-off-by: jolheiser <john.olheiser@gmail.com> * At least return and debug log a captcha error Signed-off-by: jolheiser <john.olheiser@gmail.com> * Pass context to hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Add context to recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * fix lint Signed-off-by: Andrew Thornton <art27@cantab.net> * Finish hcaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Update example config Signed-off-by: jolheiser <john.olheiser@gmail.com> * Apply error fix for recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Change recaptcha ChallengeTS to string Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Escape more things that are passed through str2html (#12622)zeripath2020-08-281-3/+3
| | | | | | | | | | | | | | * Escape more things that are passed through str2html Signed-off-by: Andrew Thornton <art27@cantab.net> * Bloody editors! Co-authored-by: mrsdizzie <info@mrsdizzie.com> * Update routers/user/oauth.go Co-authored-by: mrsdizzie <info@mrsdizzie.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Escape Email in forgot_password.tmpl (#12610)zeripath2020-08-261-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix: add type=text for user_name (password manager) (#12250)Tchoupinax2020-07-155-5/+5
| | | | | | | | | * fix: add type=text for user_name (password manager) * Update templates/user/auth/reset_passwd.tmpl Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com> Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com>
* Ensure that 2fa is checked on reset-password (#9857)zeripath2020-01-191-1/+22
| | | | | | | | | | | | * Ensure that 2fa is checked on reset-password * Apply suggestions from code review Co-Authored-By: Lauris BH <lauris@nix.lv> * Properly manage scratch_code regeneration Co-authored-by: Lauris BH <lauris@nix.lv>
* update #9066 Always show Password field on link account sign in page (#9147)Benno2019-11-241-1/+1
|
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-19 17:44:47 +0000