Branch protection: Possibility to not use whitelist but allow anyone with write access (#9055)
* Possibility to not use whitelist but allow anyone with write access
* fix existing test
* rename migration function
* Try to give a better name for migration step
* Clear settings if higher level setting is not set
* Move official reviews to db instead of counting approvals each time
* migration
* fix
* fix migration
* fix migration
* Remove NOT NULL from EnableWhitelist as migration isn't possible
* Fix migration, reviews are connected to issues.
* Fix SQL query issues in GetReviewersByPullID.
* Simplify function GetReviewersByIssueID
* Handle reviewers that has been deleted
* Ensure reviews for test is in a well defined order
* Only clear and set official reviews when it is an approve or reject.
Add single sign-on support via SSPI on Windows (#8463)
* Add single sign-on support via SSPI on Windows
* Ensure plugins implement interface
* Ensure plugins implement interface
* Move functions used only by the SSPI auth method to sspi_windows.go
* Field SSPISeparatorReplacement of AuthenticationForm should not be required via binding, as binding will insist the field is non-empty even if another login type is selected
* Fix breaking of oauth authentication on download links. Do not create new session with SSPI authentication on download links.
* Update documentation for the new 'SPNEGO with SSPI' login source
* Mention in documentation that ROOT_URL should contain the FQDN of the server
* Make sure that Contexter is not checking for active login sources when the ORM engine is not initialized (eg. when installing)
* Always initialize and free SSO methods, even if they are not enabled, as a method can be activated while the app is running (from Authentication sources)
* Add option in SSPIConfig for removing of domains from logon names
* Update helper text for StripDomainNames option
* Make sure handleSignIn() is called after a new user object is created by SSPI auth method
* Remove default value from text of form field helper
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Remove default value from text of form field helper
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Remove default value from text of form field helper
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Only make a query to the DB to check if SSPI is enabled on handlers that need that information for templates
* Remove code duplication
* Log errors in ActiveLoginSources
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Revert suffix of randomly generated E-mails for Reverse proxy authentication
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Revert unneeded white-space change in template
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Add copyright comments at the top of new files
* Use loopback name for randomly generated emails
* Add locale tag for the SSPISeparatorReplacement field with proper casing
* Revert casing of SSPISeparatorReplacement field in locale file, moving it up, next to other form fields
* Update docs/content/doc/features/authentication.en-us.md
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
* Remove Priority() method and define the order in which SSO auth methods should be executed in one place
* Log authenticated username only if it's not empty
* Rephrase helper text for automatic creation of users
* Return error if more than one active SSPI auth source is found
* Change newUser() function to return error, letting caller log/handle the error
* Move isPublicResource, isPublicPage and handleSignIn functions outside SSPI auth method to allow other SSO methods to reuse them if needed
* Refactor initialization of the list containing SSO auth methods
* Validate SSPI settings on POST
* Change SSPI to only perform authentication on its own login page, API paths and download links. Leave Toggle middleware to redirect non authenticated users to login page
* Make 'Default language' in SSPI config empty, unless changed by admin
* Show error if admin tries to add a second authentication source of type SSPI
* Simplify declaration of global variable
* Rebuild gitgraph.js on Linux
* Make sure config values containing only whitespace are not accepted
move semantic.dropdown.custom.js to webpack (#9064)
* move semantic.dropdown.custom.js to webpack
Also disabled a annoying linter rule which insisted that imports can not
contain a file extension.
Fixes: https://github.com/go-gitea/gitea/issues/8971
* reorganize web_src files and rebuild
* restart ci
* Add password requirement info on error
* Move BuildComplexityError to the password pkg
* Unexport complexity type
* Fix extra line
* Update modules/password/password.go
Co-Authored-By: Lauris BH <lauris@nix.lv>
- moved gitgraph.js to web_src and made it importable and es6-compatible
- created new webpack chunk for gitgraph
- enabled CSS loader in webpack
- enabled async/await syntax via regenerator-runtime
- added script to ensure webpack chunks are loaded correctly
- disable terser's comment extraction to prevent .LICENCE files
gitgraph.js has many issues:
1. it is incompatible with ES6 because of strict-mode violations
1. it does not export anything
1. it's css has weird styles like for `body`
1. it is not available on npm
I fixed points 1-3 in our version so it's now loadable in webpack. We should eventually consider alternatives.
wiki - add 'write' 'preview' buttons to wiki edit like in issues (#7241)
* Add add 'write' 'preview' buttons to wiki edit like in issues
affects #6975
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* update dark theme
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* fix css lint warnings - missing spaces
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* hide preview button on no fullscreen toolbar
Signed-off-by: Michael Gnehr <michael@gnehr.de>
wiki - editor - enable side-by-side button (#7242)
* wiki - enable side-by-side button in editor
and add some delay so side-by-side live preview is updated
* every 10th keypress
* if keypress < 10 -> apter no input for 1 sec
affects #5436
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* decrease timeinterval user need to stop before rendering is triggered
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* removed not needed code with simpleMDE placeholder
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* run highlight.js on markdown preview
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* fix white border around side-by-side preview
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* modernize js and use babel
- add babel toolchain to transform modern JS to ES5
- extend eslint config for modern rules
- fixes linting issues via `eslint --fix` and manual fixes
* run 'make css' to satisfy CI
* code style tweaks and set js indendation to 2 in .editorconfig
* regenerate js
Allow to add and remove all repositories to/from team. (#8867)
* Allow to add and remove all repositories to team.
* Change style, buttons on same row.
* Apply suggestions from code review
Grammar
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
* Move set num repos to lower function.
* Make general language sentences
a11y: Improve accessibility of dropdown menus (#8638)
* js: Import Semantic-UI's dropdown.js (version 2.3.1)
* js: Set tabindex=-1 on dropdown items
Setting tabindex=-1 on focusable elements within dropdown menus allows
the user to treat dropdown menus as a single focusable item with its own
internal navigation using arrow keys.
* js: Don't use jQuery to click menu items
Menu items are often <a> elements, which jQuery refuses to trigger click
events on. Instead it just bubbles up to the menu.
Using HTMLElement's click method fixes this and makes menu items
clickable from the keyboard using dropdown menus.
* js: Set correct ARIA 1.1 roles on dropdown menus
Setting role= makes assistive technology aware there is a widget here.
In this case, Orca will now exit browse mode and allow us to capture
keydown events when focused on a dropdown menu. It will also inform the
user that there's a menu focused.
Since dropdowns can be used in multiple elements each with different
ARIA roles, a guessRole method is used to find the correct role.
All roles I consider possible are listed, but only menu is implemented.
* js: Set aria-expanded when dropdown menus show and hide
This is deliberately done before the transition finishes so that screen
readers get immediate feedback.
* js: Set aria-label or aria-labelledby on dropdown menus
This makes dropdown menu buttons screen reader accessible.
aria-labelledby refers to an element using an ID, so the chosen labels
are now assigned a unique ID- This ID is not stable, do not refer to it
with user scripts.
* js: Set aria-activedescendant on dropdown menus
As the menus grab focus and navigate by tracking a 'selected' div class,
assistive technology has no idea that what the current selection is.
Assign IDs to each menu item and set aria-activedescendant to the ID of
the currently selected menu item.
When the menu is unfocused, remove aria-activedescendant- This isn't
neccessary but in my experience it triggers Orca to remind the user of
their current selection when re-focusing the menu.
* Makefile: Make eslint ignore semantic.dropdown.js
This file is taken from Semantic UI which isn't linted upstream.
Ignore it as we won't fix these issues.
* js: Add version note to semantic.dropdown.js
* Add Md5 AppVer to templates/base/footer.tmpl
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
* Add Md5 AppVer to templates/pwa/serviceworker_js.tmpl
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
* semantic.dropdown.js -> semantic.dropdown.custom.js
* Use eslintignore
* remove bogus submodule
* Show due date in dashboard issues list
Include due date when vieiwiing all issues on dashboard (matching what
we show for repo issue lists).
Fixes #8859
* Put in same order as repo issue list
* Add suggested changes and also update repo issue list to match
* Theme arc-green: reverse heatmap colors
This uses the same colors as the updated palette in the base theme.
See #8709 and #5864, in particular [my comment showing the problem](https://github.com/go-gitea/gitea/issues/5864#issuecomment-462334171)
* Rebuild CSS
* Use link color as hot, interpolate between hot and cold colors
* Use color from a:hover
Fix commit expand button to not go to commit link (#8745)
* Fix commit expand button to not go to commit link
* Fix message rendering to have correct HTML in result
* Fix check for empty commit message
* Code optimization
Allow cross-repository dependencies on issues (#7901)
* in progress changes for #7405, added ability to add cross-repo dependencies
* removed unused repolink var
* fixed query that was breaking ci tests; fixed check in issue dependency add so that the id of the issue and dependency is checked rather than the indexes
* reverted removal of string in local files becasue these are done via crowdin, not updated manually
* removed 'Select("issue.*")' from getBlockedByDependencies and getBlockingDependencies based on comments in PR review
* changed getBlockedByDependencies and getBlockingDependencies to use a more xorm-like query, also updated the sidebar as a result
* simplified the getBlockingDependencies and getBlockedByDependencies methods; changed the sidebar to show the dependencies in a different format where you can see the name of the repository
* made some changes to the issue view in the dependencies (issue name on top, repo full name on separate line). Change view of issue in the dependency search results (also showing the full repo name on separate line)
* replace call to FindUserAccessibleRepoIDs with SearchRepositoryByName. The former was hardcoded to use isPrivate = false on the repo search, but this code needed it to be true. The SearchRepositoryByName method is used more in the code including on the user's dashboard
* some more tweaks to the layout of the issues when showing dependencies and in the search box when you add new dependencies
* added Name to the RepositoryMeta struct
* updated swagger doc
* fixed total count for link header on SearchIssues
* fixed indentation
* fixed aligment of remove icon on dependencies in issue sidebar
* removed unnecessary nil check (unnecessary because issue.loadRepo is called prior to this block)
* reverting .css change, somehow missed or forgot that less is used
* updated less file and generated css; updated sidebar template with styles to line up delete and issue index
* added ordering to the blocked by/depends on queries
* fixed sorting in issue dependency search and the depends on/blocks views to show issues from the current repo first, then by created date descending; added a "all cross repository dependencies" setting to allow this feature to be turned off, if turned off, the issue dependency search will work the way it did before (restricted to the current repository)
* re-applied my swagger changes after merge
* fixed split string condition in issue search
* changed ALLOW_CROSS_REPOSITORY_DEPENDENCIES description to sound more global than just the issue dependency search; returning 400 in the cross repo issue search api method if not enabled; fixed bug where the issue count did not respect the state parameter
* when adding a dependency to an issue, added a check to make sure the issue and dependency are in the same repo if cross repo dependencies is not enabled
* updated sortIssuesSession call in PullRequests, another commit moved this method from pull.go to pull_list.go so I had to re-apply my change here
* fixed incorrect setting of user id parameter in search repos call
This PR adds basic repository LFS management UI including the ability to find all possible pointers within the repository. Locks are not managed at present but would be addable through some simple additions.
* Add basic repository lfs management
* add auto-associate function
* Add functionality to find commits with this lfs file
* Add link to find commits on the lfs file view
* Adjust commit view to state the likely branch causing the commit
* Only read Oid from database
Enabling and disabling the commit button to prevent empty commits (web editor) (#8590)
* Enabling and disabling the commit button to prevent empty commits
Signed-off-by: LukBukkit <luk.bukkit@gmail.com>
* The button won't get enabled if you change the commit message
Signed-off-by: LukBukkit <luk.bukkit@gmail.com>
* Fixes a spelling mistake for 'silent'
Signed-off-by: LukBukkit <luk.bukkit@gmail.com>
Ensure that diff stats can scroll independently of the diff (#8581)
This PR ensures that once opened the diff stats detail box can be scrolled independently of the diff on the compare page.
Fixes #5532
Details:
* make diff-detail-box the main container
* move file diff at the same level as diff-stats
* make diff-view options sticy again
* make diff-stats scroll if to mouch
* rm useless css info
* less: mv diff-stats to own class
* use new css class
* cleanup less file
* diff-counter: margin-right: 15px;
* make CI work
* make numbers colorful
* add sign (-/+) to numbers
Allow committing / adding empty files using the web ui (#8420) (#8532)
* Allow committing / adding empty files from the web ui (#8420)
Signed-off-by: LukBukkit <luk.bukkit@gmail.com>
* Add a modal to confirm the commit of an empty file
Signed-off-by: LukBukkit <luk.bukkit@gmail.com>
Sign merges, CRUD, Wiki and Repository initialisation with gpg key (#7631)
This PR fixes #7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however.
## Features
- [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.)
- [x] Verify commits signed with the default gpg as valid
- [x] Signer, Committer and Author can all be different
- [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon.
- [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available
- Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg
- [x] Try to match the default key with a user on gitea - this is done at verification time
- [x] Make things configurable?
- app.ini configuration done
- [x] when checking commits are signed need to check if they're actually verifiable too
- [x] Add documentation
I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.
techknowlogick
Lunny Xiao
silverwind
Alexey 〒erentyev
jaqra
David Svantesson
John Olheiser
Benno
QuaSoft
guillep2k
Vedran
Cherrg
mrsdizzie
6543
Jookia
Damien Pollet
Lauris BH
Brad Albright
May
zeripath
Lukas
yan
Nicholas Smith