aboutsummaryrefslogtreecommitdiffstats
path: root/templates/user/auth
Commit message (Collapse)AuthorAgeFilesLines
...
* ensure timeout error is shown on u2f timeout (#14417)zeripath2021-01-221-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* Minimal OpenID Connect implementation (#14139)Johnny Oskarsson2021-01-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | This is "minimal" in the sense that only the Authorization Code Flow from OpenID Connect Core is implemented. No discovery, no configuration endpoint, and no user scope management. OpenID Connect is an extension to the (already implemented) OAuth 2.0 protocol, and essentially an `id_token` JWT is added to the access token endpoint response when using the Authorization Code Flow. I also added support for the "nonce" field since it is required to be used in the id_token if the client decides to include it in its initial request. In order to enable this extension an OAuth 2.0 scope containing "openid" is needed. Other OAuth 2.0 requests should not be impacted by this change. This minimal implementation is enough to enable single sign-on (SSO) for other sites, e.g. by using something like `mod_auth_openidc` to only allow access to a CI server if a user has logged into Gitea. Fixes: #1310 Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Add class to page content to unify top margin (#13766)silverwind2020-11-3018-21/+18
| | | | | | | | | | | | | | | | | | | * Add class to page content to unify top margin Previously pages would individually set this margin but some didn't so content would stick to the header without any space. Resolve this by adding a new class that is added on all pages. The only place where we remove this margin again is on the pages with menu or wrapper in the header. * fix admin notices * fix team pages * fix loading segment on gitgraph for arc-green * fix last missing case Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Markdown and Repo header tweaks (#13744)silverwind2020-11-291-0/+2
| | | | | | | | | | | | | | | | * Markdown and Repo header tweaks - Use CSS vars for all markdown colors - Tweak repo header, removing double borders and adjust sizes - Use menu instead of buttons for issue open/close switcher - Add emoji inversion for select emoji glyphs in arc-green - Use border over box-shadow for all buttons - Add spacing element to login form without openid * repo settings navbar fix * use shared template in more places and adjust dashboard * fix remaining open/close combos
* Verify password for local-account activation (#13631)65432020-11-281-1/+13
| | | | | | | | | | | | | | | | | | | | | * Verify passwords for activation This is to prevent 3rd party activation * Fix function comment * only veify password on local-account aktivation * fix lint * Update templates/user/auth/activate.tmpl Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Andreas Shimokawa <shimokawa@fsfe.org> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* CSS navbar and color tweaks (#13609)silverwind2020-11-263-41/+47
| | | | | | | | | | | | | | | | | | | * CSS and color tweaks - Unify navbar-style menus - Fix admin bar overlapping menu bar - Fixes file edit comment box - Fix double border on review box - Fix review timeline icons * Many fixes to new-menu and navbar layout enhancements * misc settings fixes * navbar tweak * fix pr tabs * branch tag and arc color tweaks
* unify layout between auth pages (#13547)Norwin2020-11-134-92/+93
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Set appropriate `autocomplete` attributes on password fields (#13078)silverwind2020-10-094-6/+6
| | | | | | | `new-password` prevents annoying autocompletion in some cases, thought it's not semantically correct to use that for example on all three fields on the user account page, so some annoyances remain. Co-authored-by: Lauris BH <lauris@nix.lv>
* hCaptcha Support (#12594)John Olheiser2020-10-022-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Initial work on hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Use module Signed-off-by: jolheiser <john.olheiser@gmail.com> * Format Signed-off-by: jolheiser <john.olheiser@gmail.com> * At least return and debug log a captcha error Signed-off-by: jolheiser <john.olheiser@gmail.com> * Pass context to hCaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Add context to recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * fix lint Signed-off-by: Andrew Thornton <art27@cantab.net> * Finish hcaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Update example config Signed-off-by: jolheiser <john.olheiser@gmail.com> * Apply error fix for recaptcha Signed-off-by: jolheiser <john.olheiser@gmail.com> * Change recaptcha ChallengeTS to string Signed-off-by: jolheiser <john.olheiser@gmail.com> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Escape more things that are passed through str2html (#12622)zeripath2020-08-281-3/+3
| | | | | | | | | | | | | | * Escape more things that are passed through str2html Signed-off-by: Andrew Thornton <art27@cantab.net> * Bloody editors! Co-authored-by: mrsdizzie <info@mrsdizzie.com> * Update routers/user/oauth.go Co-authored-by: mrsdizzie <info@mrsdizzie.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Escape Email in forgot_password.tmpl (#12610)zeripath2020-08-261-1/+1
| | | Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix: add type=text for user_name (password manager) (#12250)Tchoupinax2020-07-155-5/+5
| | | | | | | | | * fix: add type=text for user_name (password manager) * Update templates/user/auth/reset_passwd.tmpl Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com> Co-authored-by: jaqra <48099350+jaqra@users.noreply.github.com>
* Ensure that 2fa is checked on reset-password (#9857)zeripath2020-01-191-1/+22
| | | | | | | | | | | | * Ensure that 2fa is checked on reset-password * Apply suggestions from code review Co-Authored-By: Lauris BH <lauris@nix.lv> * Properly manage scratch_code regeneration Co-authored-by: Lauris BH <lauris@nix.lv>
* update #9066 Always show Password field on link account sign in page (#9147)Benno2019-11-241-1/+1
|
* Add single sign-on support via SSPI on Windows (#8463)QuaSoft2019-11-231-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add single sign-on support via SSPI on Windows * Ensure plugins implement interface * Ensure plugins implement interface * Move functions used only by the SSPI auth method to sspi_windows.go * Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected * Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links. * Update documentation for the new 'SPNEGO with SSPI' login source * Mention in documentation that ROOT_URL should contain the FQDN of the server * Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing) * Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources) * Add option in SSPIConfig for removing of domains from logon names * Update helper text for StripDomainNames option * Make sure handleSignIn() is called after a new user object is created by SSPI auth method * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Remove default value from text of form field helper Co-Authored-By: Lauris BH <lauris@nix.lv> * Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates * Remove code duplication * Log errors in ActiveLoginSources Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert suffix of randomly generated E-mails for Reverse proxy authentication Co-Authored-By: Lauris BH <lauris@nix.lv> * Revert unneeded white-space change in template Co-Authored-By: Lauris BH <lauris@nix.lv> * Add copyright comments at the top of new files * Use loopback name for randomly generated emails * Add locale tag for the SSPISeparatorReplacement field with proper casing * Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields * Update docs/content/doc/features/authentication.en-us.md Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * Remove Priority() method and define the order in which SSO auth methods should be executed in one place * Log authenticated username only if it's not empty * Rephrase helper text for automatic creation of users * Return error if more than one active SSPI auth source is found * Change newUser() function to return error, letting caller log/handle the error * Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed * Refactor initialization of the list containing SSO auth methods * Validate SSPI settings on POST * Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page * Make 'Default language' in SSPI config empty, unless changed by admin * Show error if admin tries to add a second authentication source of type SSPI * Simplify declaration of global variable * Rebuild gitgraph.js on Linux * Make sure config values containing only whitespace are not accepted
* Move index.js to web_src and use webpack to pack them (#8598)Lunny Xiao2019-11-131-1/+1
| | | | | | | | | | | | * Move index.js to web_src and use webpack * Fix initHeatMap * update eslint and move webpack to devDependencies * update index.js * add eslint env node
* Use AppSubUrl for more redirections (#8647)zeripath2019-10-231-2/+2
| | | | Fix #8461 - fix misspelling of {{AppSubUrl}} and other misspelling in template Fixes /explore and organisation redirection
* Add nofollow to sign in links (#8509)guillep2k2019-10-141-2/+2
|
* Make captcha and password optional for external accounts (#6606)AJ ONeal2019-07-062-8/+13
|
* UX + Security current user password reset (#5042)AJ ONeal2019-04-181-0/+15
| | | | | | | | | | | | | | * allow current user to reset their own password * handle reset password edge cases properly and consistently * remove dangling assignment * properly label account recovery instead of reset password * remove 'Click here' from button * update English-only account-recovery templates
* fix: avoid multi-clicks when perform oauth2 login (#6467)BetaCat2019-03-311-4/+15
|
* Integrate OAuth2 Provider (#5378)Jonas Franz2019-03-082-0/+47
|
* UX of link account (Step 1) (#5006)AJ ONeal2018-10-283-11/+49
| | | | | | | | | | | | | | * Show either sign up OR sign in * disambiguate fresh start from adding recovery options * use tabs to switch between account link flows * add active to tab body as well * changes as per discussion * handle specific error; fix missing err typo
* Fix missing AppSubUrl in few more templates (#5021)SagePtr2018-10-051-1/+1
|
* Force user to change password (#4489)Lanre Adelowo2018-09-132-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * redirect to login page after successfully activating account * force users to change password if account was created by an admin * force users to change password if account was created by an admin * fixed build * fixed build * fix pending issues with translation and wrong routes * make sure path check is safe * remove unneccessary newline * make sure users that don't have to view the form get redirected * move route to use /settings prefix so as to make sure unauthenticated users can't view the page * update as per @lafriks review * add necessary comment * remove unrelated changes * support redirecting to location the user actually want to go to before being forced to change his/her password * run make fmt * added tests * improve assertions * add assertion * fix copyright year Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
* Add Recaptcha functionality to Gitea (#4044)Fluf2018-07-052-2/+12
|
* Add support for FIDO U2F (#3971)Jonas Franz2018-05-192-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add support for U2F Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add vendor library Add missing translations Signed-off-by: Jonas Franz <info@jonasfranz.software> * Minor improvements Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F support for Firefox, Chrome (Android) by introducing a custom JS library Add U2F error handling Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F login page to OAuth Signed-off-by: Jonas Franz <info@jonasfranz.software> * Move U2F user settings to a separate file Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add unit tests for u2f model Renamed u2f table name Signed-off-by: Jonas Franz <info@jonasfranz.software> * Fix problems caused by refactoring Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add U2F documentation Signed-off-by: Jonas Franz <info@jonasfranz.software> * Remove not needed console.log-s Signed-off-by: Jonas Franz <info@jonasfranz.software> * Add default values to app.ini.sample Add FIDO U2F to comparison Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Some small template fixes (#3820)Rodrigo Villablanca Vásquez2018-04-201-1/+2
|
* Don't warn users about *every* dirty form (#3707)Gerben2018-03-233-3/+3
| | | | | | | | | | | The choice regarding which forms should or should not trigger a warning is subjective. I tried to be consistent and not warn about forms that: - run an action, rather than edit data: search, send an email. - delete data: a warning about losing data would be confusing Note that forms on sign-in pages were already ignored (using a selector, rather than an explicit class on the form element). Fixes #3698.
* Responsive view (#2750)Morgan Bazalgette2017-12-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Viewport meta tag * responsive: dashboard * responsive: issues page * responsive: Explore page * responsive: navbar, and some navbar css refactoring * responsive: button for collapsing navbar in mobile view * Mark the hamburger button as active when pressed * better homepage for responsive views * Bring back jump class in navbar The class was necessary, because this way the dropdown doesn't assume the contents of the selected item. * make repository homes responsive * Make file view page responsive * Make forms look good on responsive views * make commits and commit diff view responsive * issues and PRs * responsive wiki * Don't place auto-init far off the page * Minor changes to amend broken stuff minor improvements - make login/sign up in navbar stackable - make navbar in explore and sign in not stackable Change selected class in TestPullCompare Fix typo that happened when rebasing fix dashboard on org view improve profile UI Use clearing on file diff to fix broken UI caused by floating elements remove unresolved merge conflict, and | Sanitize Fix repo home not loading
* hide navbar when only 1 sign-in method is available (#2648)Kazuki Sawada2017-10-041-6/+6
|
* Center-aligned login topbar (#1880)Ethan Koenig2017-06-062-2/+2
| | | | | | * Center-aligned login topbar * Center-align OpenID login
* xxx_active_code_live setting in printed in hours and minutes instead … (#1814)Jonas Östanbäck2017-05-292-3/+3
| | | | | | * xxx_active_code_live setting in printed in hours and minutes instead of just hours * Update app.ini description of xxx_code_lives settings
* Change two factor code entry box from text to number (#1733)Patrick G2017-05-161-1/+1
|
* Add new text for reset password flash (#1718)Jonas Östanbäck2017-05-141-1/+1
| | | | | * Forgot password should use ResetPwdCodeLives, not ActiveCodeLives * Improve documentation for different send mail functions related to password reset * Improve documentation in conf/app.ini regarding xxx_CODE_LIVE_MINUTES settings
* Additional OAuth2 providers (#1010)Willem van Dreumel2017-05-012-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add google+ * sort signin oauth2 providers based on the name so order is always the same * update auth tip for google+ * add gitlab provider * add bitbucket provider (and some go fmt) * add twitter provider * add facebook provider * add dropbox provider * add openid connect provider incl. new format of tips section in "Add New Source" * lower the amount of disk storage for each session to prevent issues while building cross platform (and disk overflow) * imports according to goimport and code style * make it possible to set custom urls to gitlab and github provider (only these could have a different host) * split up oauth2 into multiple files * small typo in comment * fix indention * fix indentation * fix new line before external import * fix layout of signin part * update "broken" dependency
* Autofocus on 2fa passcode fields (#1460)Jonas2017-04-072-2/+2
| | | | | | * Autofocus on 2fa passcode field * Autofocus on 2fa scratch code field
* Changed text when password reset disabled. (#1364)Jonas2017-03-221-1/+1
| | | Fixes #1340
* Reduce conditionals in signin/signup inner formsSandro Santilli2017-03-202-3/+3
| | | | by always using SignInLink and SignUpLink in the form action
* Add captcha support to OpenID based signupSandro Santilli2017-03-201-0/+10
|
* Use readonly input form to show the validated OpenID URI (#1308)Sandro Santilli2017-03-202-12/+4
|
* Use font-awesome OpenID icon more (#1320)Sandro Santilli2017-03-192-3/+4
|
* Login via OpenID-2.0 (#618)Sandro Santilli2017-03-178-50/+233
|
* Rename /forget_password url to /forgot_passwordSandro Santilli2017-03-142-3/+3
| | | | | | | | | Also renames `forgot_password` translation key to `forgot_password_title` and `forget_password` to `forgot_password` Includes entry in CHANGELOG about the breaking change (and some markdown fixes in there)
* Oauth2 consumer (#679)Willem van Dreumel2017-02-225-96/+131
| | | | | | | | | | | | | | | | | | | | | | | | | * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
* social_register_hepler_msg -> social_register_helper_msg (#855)Sandro Santilli2017-02-071-1/+1
| | | | | | * social_register_hepler_msg -> social_register_helper_msg * register_hepler_msg -> register_helper_msg
* Two factor authentication support (#630)Andrew2017-01-162-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | * Initial commit for 2FA support Signed-off-by: Andrew <write@imaginarycode.com> * Add vendored files * Add missing depends * A few clean ups * Added improvements, proper encryption * Better encryption key * Simplify "key" generation * Make 2FA enrollment page more robust * Fix typo * Rename twofa/2FA to TwoFactor * UNIQUE INDEX -> UNIQUE
* Fixes xss, clickjacking & password autocompletionBwko2016-11-293-4/+4
|
* #2937 able to prohibit user loginUnknwon2016-07-161-0/+16
|
* Indent all templates with tabsAdam Strzelecki2015-12-085-182/+182
| | | | | | | | | | | | This commit improves templates readability, since all of them use consistent indent with all template command blocks indented too. 1. Indents both HTML containers such as <div>, <p> and Go HTML template blocks such as {{if}} {{with}} 2. Cleans all trailing white-space 3. Adds trailing last line-break to each file
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-01 08:04:01 +0000