gitea

文件歷史

Giteabot f144521aea Deprecate query string auth tokens (#28390) (#28430) Backport #28390 by @jackHay22 ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) Co-authored-by: Jack Hay <jack@allspice.io> Co-authored-by: delvh <dev.lh@web.de>		5 月之前
..
actions	Always delete existing scheduled action tasks (#27662) (#27688)	6 月之前
agit	Move notification interface to services layer (#26915)	8 月之前
asymkey	Another round of `db.DefaultContext` refactor (#27103) (#27262)	7 月之前
attachment	move repository deletion to service layer (#26948)	8 月之前
auth	Deprecate query string auth tokens (#28390) (#28430)	5 月之前
automerge	Improve queue and logger context (#24924)	11 月之前
context	Another round of `db.DefaultContext` refactor (#27103) (#27262)	7 月之前
convert	Fix package webhook (#27839) (#27855)	6 月之前
cron	Recover from panic in cron task (#28409) (#28425)	5 月之前
externalaccount	More `db.DefaultContext` refactor (#27265) (#27347)	7 月之前
feed	More `db.DefaultContext` refactor (#27265) (#27347)	7 月之前
forms	Fix required error for token name (#28267) (#28284)	5 月之前
gitdiff	Fix successful return value for `SyncAndGetUserSpecificDiff` (#27152)	7 月之前
indexer	Fix missing issue search index update when changing status (#28325) (#28330)	5 月之前
issue	Avoid run change title process when the title is same (#27467) (#27558)	7 月之前
lfs	Bump github.com/golang-jwt/jwt to v5 (#25975)	9 月之前
mailer	Clean up template locale usage (#27856) (#27857)	6 月之前
markup	Move web/api context related testing function into a separate package (#26859)	8 月之前
migrations	Fix migration panic due to an empty review comment diff (#28334) (#28362)	5 月之前
mirror	More `db.DefaultContext` refactor (#27265) (#27347)	7 月之前
notify	Update status and code index after changing the default branch (#27018)	8 月之前
org	Delete repos of org when purge delete user (#27273) (#27728)	6 月之前
packages	Fix RPM/Debian signature key creation (#28352) (#28353)	5 月之前
pull	Fix poster is not loaded in get default merge message (#27657) (#27666)	6 月之前
release	Fix comment permissions (#28213) (#28216)	5 月之前
repository	Also sync DB branches on push if necessary (#28361) (#28403)	5 月之前
secrets	Refactor secrets modification logic (#26873)	8 月之前
task	Fix incorrect ctx usage in defer function (#27740) (#27741)	6 月之前
uinotification	More `db.DefaultContext` refactor (#27265) (#27347)	7 月之前
user	Remove action runners on user deletion (#27902) (#27908)	6 月之前
webhook	Fix comment permissions (#28213) (#28216)	5 月之前
wiki	Fix incorrect test code for error handling (#27139)	7 月之前