Commit graph

4546 commits

Author SHA1 Message Date
floss4good
3f28306828
Merge branch 'forgejo' of /forgejo/forgejo into report_abuse 2025-04-04 14:29:10 +03:00
floss4good
e39fe465b5
adjust revive comment directives 2025-04-04 11:55:09 +03:00
Gusted
53df0bf9a4 chore(sec): unify usage of crypto/rand.Read (#7453)
- Unify the usage of [`crypto/rand.Read`](https://pkg.go.dev/crypto/rand#Read) to `util.CryptoRandomBytes`.
- Refactor `util.CryptoRandomBytes` to never return an error. It is documented by Go, https://go.dev/issue/66821, to always succeed. So if we still receive a error or if the returned bytes read is not equal to the expected bytes to be read we panic (just to be on the safe side).
- This simplifies a lot of code to no longer care about error handling.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7453
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-04-04 03:31:37 +00:00
Gusted
99fc04b763 fix: make installing Forgejo work again (#7452)
- The default engine is no longer guaranteed to be of the type `*xorm.Engine`, so instead return the interface `db.Engine`.
- Regression of forgejo/forgejo#7212

# Testing

1. Install a Forgejo instance via the setup screen.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7452
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-04-04 03:30:19 +00:00
Gusted
afea42d517 chore: add empty action_variable fixture (#7419)
- Ensures that this table gets emptied between integration tests and does not have any leftovers.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7419
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-04-03 23:42:37 +00:00
floss4good
43d613172f
fix: remove redundant check (this is now done outside this function) 2025-04-04 02:09:11 +03:00
floss4good
41cc860666
fix: when deciding that a shadow copy should be created also check that existing reports have a null shadow_copy_id
- also rename the function to better indicate the purpose

- and handle potential errors returned by Session.Exist()
2025-04-04 02:08:53 +03:00
floss4good
ca0636a6fc
add support for saving shadow copies of repositories 2025-04-04 02:08:35 +03:00
floss4good
78ff27984c
add support for saving shadow copies of issues 2025-04-04 02:08:15 +03:00
floss4good
957cda9f09
include more details in comments' shadow copies
(useful in case the comment was deleted)
2025-04-04 02:07:24 +03:00
floss4good
e483517c7c
Merge branch 'forgejo' of /forgejo/forgejo into report_abuse 2025-04-04 02:04:22 +03:00
famfo
77b0275572 feat(activitiypub): enable HTTP signatures on all ActivityPub endpoints (#7035)
- Set the right keyID and use the right signing keys for outgoing requests.
- Verify the HTTP signature of all incoming requests, except for the server actor.
- Caches keys of incoming requests for users and servers actors.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7035
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: famfo <famfo@famfo.xyz>
Co-committed-by: famfo <famfo@famfo.xyz>
2025-04-03 15:24:15 +00:00
floss4good
9aa5624872
use sync.OnceValue when building the list with UserData column names 2025-04-01 01:41:32 +03:00
floss4good
a5e7a815d8
add INDEX for abuse_report.status 2025-04-01 01:23:57 +03:00
floss4good
d41c045b11
Merge branch 'forgejo' of /forgejo/forgejo into report_abuse 2025-03-31 22:18:51 +03:00
pat-s
63a80bf2b9 feat: use XORM EngineGroup instead of single Engine connection (#7212)
Resolves #7207

Add new configuration to make XORM work with a main and replicas database instances. The follow configuration parameters were added:

- `HOST_PRIMARY`
- `HOST_REPLICAS`
- `LOAD_BALANCE_POLICY`. Options:
    - `"WeightRandom"` -> `xorm.WeightRandomPolicy`
    - `"WeightRoundRobin`  -> `WeightRoundRobinPolicy`
    - `"LeastCon"` -> `LeastConnPolicy`
    - `"RoundRobin"` -> `xorm.RoundRobinPolicy()`
    - default: `xorm.RandomPolicy()`
- `LOAD_BALANCE_WEIGHTS`

Co-authored-by: pat-s <patrick.schratz@gmail.com@>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7212
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: pat-s <patrick.schratz@gmail.com>
Co-committed-by: pat-s <patrick.schratz@gmail.com>
2025-03-30 11:34:02 +00:00
Renovate Bot
fed2d81c44 Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367)
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
2025-03-28 22:22:21 +00:00
floss4good
73076f0e11
refactor: change import path from code.gitea.io/gitea to forgejo.org 2025-03-27 23:33:51 +02:00
floss4good
3de09c4192
Merge branch 'forgejo' of https://codeberg.org/forgejo/forgejo into
report_abuse
2025-03-27 23:15:49 +02:00
Gusted
2457f5ff22 chore: branding import path (#7337)
- Massive replacement of changing `code.gitea.io/gitea` to `forgejo.org`.
- Resolves forgejo/discussions#258

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7337
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Panagiotis "Ivory" Vasilopoulos <git@n0toose.net>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-27 19:40:14 +00:00
floss4good
fc0043abae
feat!: make 'report_abuse' a reserved username
BREAKING CHANGE: '/report_abuse' will be the URL path for abusive content reporting page.

It was considered that chances are somewhat low for an account to have the username 'report_abuse'. However, should that be the case, the account should be renamed.
2025-03-27 16:58:38 +02:00
Gusted
f009c6ec4a fix: fix ci dashboard e2e test (#7338)
- Add the necessary branch row for the workflow repository. This is required for the dashboard search to return any commit status for the default branch.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7338
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-26 00:19:31 +00:00
floss4good
36298c7422 Merge branch 'forgejo' into report_abuse 2025-03-23 23:09:37 +00:00
Gusted
72ee7f3b00 fix: consider issues in repository accessible via access table (#7270)
- Consider the following scenario: a private repository in an organization with a team that has no specific access to that repository. Members of that team are still able to visit the repository because of entries in the `access` table.
- Consider this specific scenario for the gathering of issues for project tables.
- Unit test added
- Resolves forgejo/forgejo#7217
- Ref: forgejo/forgejo#6843

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7270
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-19 16:45:42 +00:00
Earl Warren
83e186c00c fix: discard v25 secrets migrations errors instead of failing (#7251)
Failing the migration when a corrupted record is found is problematic because there is no transaction and the database may need to be restored from a backup to attempt the migration again, after deleting the corrupted records.

Each documented case of failed migration was resolved by removing the corrupted records. There is no instance of a failed migration that was caused by non corrupted record.

In the unlikely event of a false negative where a two_factor record is discarded although it is in use, the only consequence is that the user will have to enroll again. Detailed logs are displayed so the Forgejo admin can file a bug report if that happens.

Refs: https://codeberg.org/forgejo/forgejo/issues/6637

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7251): <!--number 7251 --><!--line 0 --><!--description V2hlbiBtaWdyYXRpbmcgdG8gRm9yZ2VqbyB2MTAsIHRoZSBUT1RQIHNlY3JldHMgZm91bmQgdG8gYmUgY29ycnVwdGVkIGFyZSBub3cgdHJhbnNwYXJlbnRseSByZW1vdmVkIGZyb20gdGhlIGRhdGFiYXNlIGluc3RlYWQgb2YgZmFpbGluZyB0aGUgbWlncmF0aW9uLiBUT1RQIGlzIG5vIGxvbmdlciByZXF1aXJlZCB0byBsb2dpbiB3aXRoIHRoZSBhc3NvY2lhdGVkIHVzZXJzLiBUaGV5IHNob3VsZCBiZSBpbmZvcm1lZCBiZWNhdXNlIHRoZXkgd2lsbCBuZWVkIHRvIHZpc2l0IHRoZWlyIHNlY3VyaXR5IHNldHRpbmdzIGFuZCBjb25maWd1cmUgVE9UUCBhZ2Fpbi4gTm8gb3RoZXIgYWN0aW9uIGlzIHJlcXVpcmVkLg==-->When migrating to Forgejo v10, the TOTP secrets found to be corrupted are now transparently removed from the database instead of failing the migration. TOTP is no longer required to login with the associated users. They should be informed because they will need to visit their security settings and configure TOTP again. No other action is required.<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7251
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-03-17 16:25:37 +00:00
Gusted
d5c8091e08 perf: optimize converting releases to feed items (#7221)
- `releasesToFeedItems` is called to convert release structs to feed items, which is then used to render RSS or Atom feeds.
- Optimize the loading of attributes for the releases, introduce `ReleaseList` type which uses caching to load repository and publishers. It also no longer loads release attachments and downloads counts as that is not used in feed items.
- Optimize the composing of meta by introducing caching, this operation is especially slow when the owner is an organization.
- Add unit test (ensures new `LoadAttributes` works correctly).
- Add integration test (ensures that feed output is still as expected).

Loading https://codeberg.org/forgejo/forgejo/releases.rss reduced from ~15s to ~1s. (It is currently is deployed on codeberg.org)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7221
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-17 09:00:34 +00:00
Gusted
511148dbc3 perf: avoid sorting team names for ComposeMetas (#7223)
- `ComposeMetas` is called to compose meta information for the markdown processer (which is called a lot), one of those information is the team names that have access to the repository. This is used to decide if a mention is a team mention or not.
- The SQL query sorts the names, this is unnecessary and not required for within the processer; it does a simple `strings.Contains(teams, ","+teamName+",")`, which doesn't rely on sorted values.
- Doing the SQL query with sorting against Codeberg's MariaDB took ~0.180s and without sorting took ~0.03s. Although the returned values are often a few rows (the query I tested returned 8 values) it seems that doing any sorting will create an temporary index and is mainly optimized where it has to sort a huge amount of rows.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7223
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-17 09:00:12 +00:00
floss4good
5e03409316 Merge branch 'forgejo' into report_abuse 2025-03-11 23:45:41 +00:00
floss4good
459fa4668b
Change IDs of abuse category types. 2025-03-11 23:54:19 +02:00
floss4good
f99434fe69
Some cleanup and renames. 2025-03-11 16:25:10 +02:00
floss4good
51580beaee Merge branch 'forgejo' into report_abuse 2025-03-09 21:15:51 +00:00
Lunny Xiao
0a52be2a04
Small refactor to reduce unnecessary database queries and remove duplicated functions (#33779)
(cherry picked from commit 6c8fb8d455cfe25d5aa966674624bce99fba1735)
2025-03-09 15:05:24 +01:00
Dmitrii Sharshakov
30982b9e7b feat(auth): add ability to regenerate access tokens (#6963)
- Add the ability to regenerate existing access tokens in the UI. This preserves the ID of the access token, but generates a new salt and token contents.
- Integration test added.
- Unit test added.
- Resolves #6880

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6963
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Dmitrii Sharshakov <d3dx12.xx@gmail.com>
Co-committed-by: Dmitrii Sharshakov <d3dx12.xx@gmail.com>
2025-03-08 10:42:36 +00:00
Otto Richter
9dea54a9d6 Drop SSPI auth support and more Windows files (#7148)
## Dropping SSPI auth support

SSPI authentication relied on Microsoft Windows support, removal started in https://codeberg.org/forgejo/forgejo/pulls/5353, because it was broken anyway. We have no knowledge of any users using SSPI authentication. However, if you somehow managed to run Forgejo on Windows, or want to upgrade from a Gitea version which does, please ensure that you do not use SSPI as an authentication mechanism for user accounts. Feel free to reach out if you need assistance.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7148
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Otto Richter <otto@codeberg.org>
Co-committed-by: Otto Richter <otto@codeberg.org>
2025-03-08 00:43:41 +00:00
floss4good
4bafc9eb02 Merge branch 'forgejo' into report_abuse 2025-03-07 20:26:43 +00:00
Gusted
a2958f5a26 fix: consider public issues for project boards (#7143)
- The security patch of forgejo/forgejo#6843 fixed the issue where project boards loaded all issues without considering if the doer actually had permission to view that issue. Within that patch the call to `Issues` was modified to include this permission checking.
- The query being generated was not entirely correct. Issues in public repositories weren't considered correctly (partly the fault of not setting `AllPublic` unconditionally) in the cause an authenticated user loaded the project.
- This is now fixed by setting `AllPublic` unconditionally and subsequently fixing the `Issue` function to ensure that the combination of setting `AllPublic` and `User` generates the correct query, by combining the permission check and issues in public repositories as one `AND` query.
- Added unit testing.
- Added integration testing.
- Resolves Codeberg/Community#1809
- Regression of https://codeberg.org/forgejo/forgejo/pulls/6843

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7143
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-03-06 23:26:08 +00:00
Gusted
b10454a00c [gitea] week 2025-10 cherry pick (gitea/main -> forgejo) (#7111)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7111
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
2025-03-06 20:39:18 +00:00
floss4good
9b5084ec74 Merge branch 'forgejo' into report_abuse 2025-03-05 23:34:19 +00:00
Litchi Pi
dc7f5d6b84 feat(ui): create a comment aggregator to reduce noise in issues (#6523)
Closes: https://codeberg.org/forgejo/forgejo/issues/6042
Continuation of: https://codeberg.org/forgejo/forgejo/pulls/6284
Replaces: https://codeberg.org/forgejo/forgejo/pulls/6285
Context: https://codeberg.org/forgejo/forgejo/pulls/6284#issuecomment-2518599

Create a new type of comment: `CommentTypeAggregator`

Replaces the grouping of labels and review request in a single place: the comment aggregator

The whole list of comments is "scanned", if they can get aggregated (diff of time < 60secs, same poster, open / close issue, add / del labels, add /del review req), they are added to the aggregator.
Once needed, the list of all the aggregated comments are replaced with a single aggregated comment containing all the data required.

In templates, have a specific HTML rendering part for the comment aggregator, reuse the same rendering as with the other types of comments.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6523
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Litchi Pi <litchi.pi@proton.me>
Co-committed-by: Litchi Pi <litchi.pi@proton.me>
2025-03-05 17:24:51 +00:00
floss4good
799885246a
Change ShadowCopyID type from *int64 to sql.NullInt64. 2025-03-05 11:51:54 +02:00
floss4good
7046bd5e39
Some fixes and improvements based on recent review. 2025-03-05 11:42:19 +02:00
floss4good
75578c64ea Merge branch 'forgejo' into report_abuse 2025-03-05 09:32:00 +00:00
Renovate Bot
6b436955fc Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v1.64.6 (forgejo) (#7118)
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
2025-03-04 21:38:35 +00:00
Michael Jerger
ee324c68cb fix: Use correct table in migration v18 (#7114)
Fix for https://codeberg.org/forgejo/forgejo/issues/6971

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7114
Reviewed-by: floss4good <floss4good@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
Co-committed-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
2025-03-04 16:44:37 +00:00
Lunny Xiao
9a5ef22f3a
Add composor source field (#33502)
Fix #33066

(cherry picked from commit aca21549f285255f0d78f90f1f15f0c6f9396761)
2025-03-04 00:00:09 +01:00
floss4good
44e3a7815f Merge branch 'forgejo' into report_abuse 2025-03-03 11:53:33 +00:00
floss4good
729ac5b9f2
Improve validation and error handling. 2025-03-03 11:52:31 +02:00
floss4good
af2c8f763b
some cleanups 2025-03-03 09:03:01 +02:00
Litchi Pi
9dd47d932f fix(web): forbid blocked users from reopening issues (#7010)
Closes https://codeberg.org/forgejo/forgejo/issues/6841.

Signed-off-by: Litchi Pi <litchi.pi@proton.me>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7010
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Litchi Pi <litchi.pi@proton.me>
Co-committed-by: Litchi Pi <litchi.pi@proton.me>
2025-03-01 12:39:52 +00:00
floss4good
248e2d3861
Add new 'Report abuse' form and links for user profile, repository page, issues, pulls and comments. 2025-02-28 12:41:00 +02:00