user, topic, project, label, milestone, repository, pull_request,
release, asset, comment, reaction, review providers
Signed-off-by: Earl Warren <contact@earl-warren.org>
Preserve file size when creating attachments
Introduced in c6f5029708
repoList.LoadAttributes has a ctx argument now
Rename `repo.GetOwner` to `repo.LoadOwner`
bd66fa586a
upgrade to the latest gof3
(cherry picked from commit c770713656)
[F3] ID remapping logic is in place, remove workaround
(cherry picked from commit d0fee30167)
[F3] it is experimental, do not enable by default
(cherry picked from commit de325b21d0)
(cherry picked from commit 547e7b3c40)
(cherry picked from commit 820df3a56b)
(cherry picked from commit eaba87689b)
(cherry picked from commit 1b86896b3b)
(cherry picked from commit 0046aac1c6)
(cherry picked from commit f14220df8f)
(cherry picked from commit 559b731001)
(cherry picked from commit 801f7d600d)
(cherry picked from commit 6aa76e9bcf)
(cherry picked from commit a8757dcb07)
[F3] promote F3 users to matching OAuth2 users on first sign-in
(cherry picked from commit bd7fef7496)
(cherry picked from commit 07412698e8)
(cherry picked from commit d143e5b2a3)
[F3] upgrade to gof3 50a6e740ac04
Add new methods GetIDString() & SetIDString() & ToFormatInterface()
Change the prototype of the fixture function
(cherry picked from commit d7b263ff8b)
(cherry picked from commit b3eaf2249d)
(cherry picked from commit d492ddd9bb)
[F3] add GetLocalMatchingRemote with a default implementation
(cherry picked from commit 0a22015039)
(cherry picked from commit f1310c38fb)
(cherry picked from commit deb68552f2)
[F3] GetLocalMatchingRemote for user
(cherry picked from commit e73cb837f5)
(cherry picked from commit a24bc0b85e)
(cherry picked from commit 846a522ecc)
[F3] GetAdminUser now has a ctx argument
(cherry picked from commit 37357a92af)
(cherry picked from commit 660bc1673c)
(cherry picked from commit 72d692a767)
[F3] introduce UserTypeF3
To avoid conflicts should UserTypeRemoteUser be used differently by Gitea
(cherry picked from commit 6de2701bb3)
[F3] user.Put: idempotency
(cherry picked from commit 821e38573c)
(cherry picked from commit f7638f5414)
[F3] upgrade to urfave v2
(cherry picked from commit cc3dbdfd1d)
[F3] update gof3
(cherry picked from commit 2eee960751)
[F3] move f3 under forgejo-cli
* simplify the tests by re-using the forgejo-cli helpers to capture
the output
* unify CmdF3 to be structured in the same way CmdActions is
(cherry picked from commit 4c9fe58b74)
[F3] replace f3 with forgejo-cli f3
(cherry picked from commit 7ba7ceef1b)
[F3] s/ListOptions/Paginator/
[F3] user: add unit tests
[F3] user comparison of F3 managed users is on content
[F3] issue: add unit tests
[F3] gof3 now has one more argument to Put()
[F3] re-use gof3 unit tests for the driver
(cherry picked from commit af7ee6200c)
Conflicts:
tests/integration/integration_test.go
because of some code removed in forgejo-development, trivial
context conflict resolution
[F3] more idempotent tests (#1275)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1275
Co-authored-by: Loïc Dachary <loic@dachary.org>
Co-committed-by: Loïc Dachary <loic@dachary.org>
[F3] tests: do SQL update if nothing changes
[F3] tests comment idempotence
[F3] tests milestone idempotence
[F3] tests pull_request idempotence
[F3] tests release idempotence
[F3] tests asset idempotence
[F3] tests project idempotence
[F3] tests review idempotence
(cherry picked from commit 91038bb4e8)
(cherry picked from commit a7d2a65214)
(cherry picked from commit 59a17e5a34)
[F3] sub command of forgejo-cli
(cherry picked from commit 4d098e9b83)
[F3] implement --quiet, --debug, --verbose
(cherry picked from commit 82e2e17b45)
[F3] fix off by one error when importing repositories
(cherry picked from commit 31689b1397)
[F3] upgrade gof3
(cherry picked from commit 87b8cfe5a1)
[F3] set the logger for all drivers
The logger is set for the local Forgejo driver only. Even when --debug
is specified, the other drivers do not display debug
information. Use the gof3 context to set the logger for all of them at
once.
(cherry picked from commit 8aa7de8ba0)
[F3] the closed date of an issue may be nil
(cherry picked from commit 93d3eaf0b5)
[F3] update gof3 to support system users
there now is a workaround to hardcode system users when they are not
supported by the API
(cherry picked from commit 915484daa7)
(cherry picked from commit b47ac73b8a)
[F3] upgrade gof3 with a version that can deal with system users
When they are missing from what the API returns, it will replace the
missing user with the Ghost user instead of leaving it be a null pointer.
(cherry picked from commit 9eeeab7f8e)
[F3] tests do not need a running Forgejo server
(cherry picked from commit b2b9749ac9)
[F3] upgrade gof3 to correctly fetch PRs from forks
(cherry picked from commit d2448de302)
[F3] upgrade gof3 to resolve incorrect object ID mappings
(cherry picked from commit af8c9de89f)
[F3] mirroring a repository needs --mirror instead of --bare
(cherry picked from commit 9941131920)
[F3] PR create the pull/N/head from the original PR head
It is incorrect to assume they are identical because:
* the IDs of a PR may be remapped and pull/N/head will become
pull/M/head
* the head of a remote fork is a branch named after the fork
(cherry picked from commit 9c220bf23e)
[F3] gof3 upgrade with non overlapping PR references
(cherry picked from commit f1b2f82e7e)
[F3] refactor issue insertion to preserve the creation date
issues_model.NewIssue() is convenient but will override the creation
date. Update the database instead.
(cherry picked from commit 729f4be1e4)
[F3] gof3 upgrade to get performance improvements
(cherry picked from commit 996ac35d4d)
(cherry picked from commit 906e9eb3f5)
(cherry picked from commit c340e22197)
(cherry picked from commit bb0ed72e08)
(cherry picked from commit 500e640d6d)
[F3] TestForgeMethods needs to populate the database
(cherry picked from commit e6da71229f)
(cherry picked from commit e3bd088895)
(cherry picked from commit 2255136187)
(cherry picked from commit 69584b1baf)
(cherry picked from commit bc37771dc3)
(cherry picked from commit 90592146c6)
(cherry picked from commit 6160eb38d9)
(cherry picked from commit 4ed79ea8eb)
(cherry picked from commit 8cb9c266ab)
(cherry picked from commit 7b346e7bb2)
(cherry picked from commit 0345dd562d)
(cherry picked from commit 0f8821c1b1)
[F3] resolve
(cherry picked from commit 2acd211536)
(cherry picked from commit 704317c24e)
(cherry picked from commit b127296da6)
(cherry picked from commit 000b6f823e)
(cherry picked from commit 7bd1b35139)
(cherry picked from commit 6ba434bf2f)
(cherry picked from commit 5c0826c529)
(cherry picked from commit 00f7d12512)
(cherry picked from commit 13550cb0b5)
(cherry picked from commit 3b16d9e114)
(cherry picked from commit 1b0db139d6)
[F3] licenses
(cherry picked from commit 2bccd8c1ef)
(cherry picked from commit a92c48c8c2)
(cherry picked from commit 5ca8851224)
(cherry picked from commit 57e597bf7e)
(cherry picked from commit 643a2b0e81)
(cherry picked from commit f10faffb4f)
(cherry picked from commit b440c5767e)
[TESTS] verify facts for the admin storage documentation (squash)
(cherry picked from commit d83d8ce57b)
(cherry picked from commit d8855ef27c)
(cherry picked from commit 11230466ec)
(cherry picked from commit b2cdd9d971)
(cherry picked from commit a0a5e78524)
(cherry picked from commit 846413110f)
(cherry picked from commit 72b92d5a78)
(cherry picked from commit 7e039a9427)
(cherry picked from commit 227d42a1b6)
(cherry picked from commit 6488950a9b)
(cherry picked from commit 0285c99774)
(cherry picked from commit 0527bb20db)
(cherry picked from commit b4d3fd43e3)
(cherry picked from commit b45db64300)
(cherry picked from commit 722ab37611)
(cherry picked from commit ff45632b42)
(cherry picked from commit 5144ae2aa7)
(cherry picked from commit f51438cd68)
(cherry picked from commit 5ec304e5a1)
(cherry picked from commit 440b8c1af1)
Follow-up to d58c542579 for Forgejo.
By default, Gitea does not select any map service that can be used
to introduce a 'Show this place on a map' button in the location
field of a user profile. Before I tried upstreaming this change to
Gitea, this was the case in Forgejo. This patch essentially recovers
this functionality, which is nice for public-facing instances and
communities.
Links to original PRs:
- https://codeberg.org/forgejo/forgejo/pulls/1076
- https://github.com/go-gitea/gitea/pull/26214
(cherry picked from commit bb187d5f61)
(cherry picked from commit ce02ef9078)
(cherry picked from commit 6b75c40e25)
(cherry picked from commit 6bc8e9f573)
(cherry picked from commit 063f8afdf7)
(cherry picked from commit c5cc736b72)
(cherry picked from commit 7b1bb4bedc)
(cherry picked from commit 2a022dceb4)
(cherry picked from commit a946c142d2)
(cherry picked from commit 8a4ea0c7ab)
(cherry picked from commit 37bfb05b34)
(cherry picked from commit 12fbbb1754)
(cherry picked from commit abe9de2cd9)
(cherry picked from commit 84db578717)
(cherry picked from commit 1beab7af46)
(cherry picked from commit 8779d505f2)
(cherry picked from commit 21a788f2eb)
(cherry picked from commit a7cc6d1687)
(cherry picked from commit 25f840379f)
(cherry picked from commit 0db65f1122)
(cherry picked from commit 0e08cbc854)
(cherry picked from commit 57de51db8d)
(cherry picked from commit 5ab3dcabb1)
(cherry picked from commit 7b5ad0c13b)
Sometimes you need to work on a feature which depends on another (unmerged) feature.
In this case, you may create a PR based on that feature instead of the main branch.
Currently, such PRs will be closed without the possibility to reopen in case the parent feature is merged and its branch is deleted.
Automatic target branch change make life a lot easier in such cases.
Github and Bitbucket behave in such way.
Example:
$PR_1$: main <- feature1
$PR_2$: feature1 <- feature2
Currently, merging $PR_1$ and deleting its branch leads to $PR_2$ being closed without the possibility to reopen.
This is both annoying and loses the review history when you open a new PR.
With this change, $PR_2$ will change its target branch to main ($PR_2$: main <- feature2) after $PR_1$ has been merged and its branch has been deleted.
This behavior is enabled by default but can be disabled.
For security reasons, this target branch change will not be executed when merging PRs targeting another repo.
Fixes#27062Fixes#18408
---------
Co-authored-by: Denys Konovalov <kontakt@denyskon.de>
Co-authored-by: delvh <dev.lh@web.de>
Mainly for MySQL/MSSQL.
It is important for Gitea to use case-sensitive database charset
collation. If the database is using a case-insensitive collation, Gitea
will show startup error/warning messages, and show the errors/warnings
on the admin panel's Self-Check page.
Make `gitea doctor convert` work for MySQL to convert the collations of
database & tables & columns.
* Fix#28131
## ⚠️ BREAKING ⚠️
It is not quite breaking, but it's highly recommended to convert the
database&table&column to a consistent and case-sensitive collation.
The CORS code has been unmaintained for long time, and the behavior is
not correct.
This PR tries to improve it. The key point is written as comment in
code. And add more tests.
Fix#28515Fix#27642Fix#17098
Nowadays, cache will be used on almost everywhere of Gitea and it cannot
be disabled, otherwise some features will become unaviable.
Then I think we can just remove the option for cache enable. That means
cache cannot be disabled.
But of course, we can still use cache configuration to set how should
Gitea use the cache.
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
```
HTTP/1.1 200 OK
...
Warning: token and access_token API authentication is deprecated
...
```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`
## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed
## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)
---------
Co-authored-by: delvh <dev.lh@web.de>
This patchset changes the connection string builder to use net.URL and
the host/port parser to use the stdlib function for splitting host from
port. It also adds a footnote about a potentially required portnumber
for postgres UNIX sockets.
Fixes: #24552
This PR adds a prefix path for all minio storage and override base path
will override the path.
The previous behavior is undefined officially, so it will be marked as
breaking.
Closes#27455
> The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.
>
> To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.
The PR removes the now obsolete setting `COOKIE_USERNAME`.
Fix #27541
The INI package has a quirk: by default, the keys are inherited.
When maintaining the keys, the newly added sub key should not be
affected by the parent key.
Part of https://github.com/go-gitea/gitea/issues/27097:
- `gitea` theme is renamed to `gitea-light`
- `arc-green` theme is renamed to `gitea-dark`
- `auto` theme is renamed to `gitea-auto`
I put both themes in separate CSS files, removing all colors from the
base CSS. Existing users will be migrated to the new theme names. The
dark theme recolor will follow in a separate PR.
## ⚠️ BREAKING ⚠️
1. If there are existing custom themes with the names `gitea-light` or
`gitea-dark`, rename them before this upgrade and update the `theme`
column in the `user` table for each affected user.
2. The theme in `<html>` has moved from `class="theme-name"` to
`data-theme="name"`, existing customizations that depend on should be
updated.
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
This pull request is a minor code cleanup.
From the Go specification (https://go.dev/ref/spec#For_range):
> "1. For a nil slice, the number of iterations is 0."
> "3. If the map is nil, the number of iterations is 0."
`len` returns 0 if the slice or map is nil
(https://pkg.go.dev/builtin#len). Therefore, checking `len(v) > 0`
before a loop is unnecessary.
---
At the time of writing this pull request, there wasn't a lint rule that
catches these issues. The closest I could find is
https://staticcheck.dev/docs/checks/#S103
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
This PR reduces the complexity of the system setting system.
It only needs one line to introduce a new option, and the option can be
used anywhere out-of-box.
It is still high-performant (and more performant) because the config
values are cached in the config system.
With this PR we added the possibility to configure the Actions timeouts
values for killing tasks/jobs.
Particularly this enhancement is closely related to the `act_runner`
configuration reported below:
```
# The timeout for a job to be finished.
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
timeout: 3h
```
---
Setting the corresponding key in the INI configuration file, it is
possible to let jobs run for more than 3 hours.
Signed-off-by: Francesco Antognazza <francesco.antognazza@gmail.com>
If the AppURL(ROOT_URL) is an HTTPS URL, then the COOKIE_SECURE's
default value should be true.
And, if a user visits an "http" site with "https" AppURL, they won't be
able to login, and they should have been warned. The only problem is
that the "language" can't be set either in such case, while I think it
is not a serious problem, and it could be fixed easily if needed.
This feature was removed by #22219 to avoid possible CSRF attack.
This PR takes reverseproxy auth for API back but with default disabled.
To prevent possbile CSRF attack, the responsibility will be the
reverseproxy but not Gitea itself.
For those want to enable this `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`,
they should know what they are doing.
---------
Co-authored-by: Giteabot <teabot@gitea.io>
Currently, Artifact does not have an expiration and automatic cleanup
mechanism, and this feature needs to be added. It contains the following
key points:
- [x] add global artifact retention days option in config file. Default
value is 90 days.
- [x] add cron task to clean up expired artifacts. It should run once a
day.
- [x] support custom retention period from `retention-days: 5` in
`upload-artifact@v3`.
- [x] artifacts link in actions view should be non-clickable text when
expired.
This PR rewrites the function `getStorage` and make it more clear.
Include tests from #26435, thanks @earl-warren
---------
Co-authored-by: Earl Warren <contact@earl-warren.org>
When users put the secrets into a file (GITEA__sec__KEY__FILE), the
newline sometimes is different to avoid (eg: echo/vim/...)
So the last newline could be removed when reading, it makes the users
easier to maintain the secret files.
Co-authored-by: Giteabot <teabot@gitea.io>
This PR is an extended implementation of #25189 and builds upon the
proposal by @hickford in #25653, utilizing some ideas proposed
internally by @wxiaoguang.
Mainly, this PR consists of a mechanism to pre-register OAuth2
applications on startup, which can be enabled or disabled by modifying
the `[oauth2].DEFAULT_APPLICATIONS` parameter in app.ini. The OAuth2
applications registered this way are being marked as "locked" and
neither be deleted nor edited over UI to prevent confusing/unexpected
behavior. Instead, they're being removed if no longer enabled in config.
The implemented mechanism can also be used to pre-register other OAuth2
applications in the future, if wanted.
Co-authored-by: hickford <mirth.hickford@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
---------
Co-authored-by: M Hickford <mirth.hickford@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This PR will fix#26264, caused by #23911.
The package configuration derive is totally wrong when storage type is
local in that PR.
This PR fixed the inherit logic when storage type is local with some
unit tests.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
1. Fix the wrong document (add the missing `MODE=`)
2. Add a more friendly log message to tell users to add `MODE=` in their
config
Co-authored-by: Giteabot <teabot@gitea.io>
