(cherry picked from commit 2acd211536a7b49dc3198d5cf80dcd3c8ff6a837)
(cherry picked from commit 704317c24e3969e1240eaeac7fd02aac0225d769)
(cherry picked from commit b127296da6742cf1b0380f0779f5dd59d5be34fa)
user, topic, project, label, milestone, repository, pull_request,
release, asset, comment, reaction, review providers
Signed-off-by: Earl Warren <contact@earl-warren.org>
Preserve file size when creating attachments
Introduced in c6f5029708
repoList.LoadAttributes has a ctx argument now
Rename `repo.GetOwner` to `repo.LoadOwner`
bd66fa586a
upgrade to the latest gof3
(cherry picked from commit c77071365629984c1dc39a7a83e7252fd5b298e2)
[F3] ID remapping logic is in place, remove workaround
(cherry picked from commit d0fee301670c37c0e73afb271e0a8dd6b622f6f6)
[F3] it is experimental, do not enable by default
(cherry picked from commit de325b21d0adad199ec05652cb8d9fff19248ddb)
(cherry picked from commit 547e7b3c40f15766deb569cf2acface3290cf092)
(cherry picked from commit 820df3a56bc194645b482ef77a8845255d1185fe)
(cherry picked from commit eaba87689bbea84a215558033fc7d514b1b44f3e)
(cherry picked from commit 1b86896b3b4144254ed27064a167650b4e12c690)
(cherry picked from commit 0046aac1c639e021e719408e374cfc84fcbaa1d8)
(cherry picked from commit f14220df8ff692bdcfdcc94660acf64c77e732f5)
(cherry picked from commit 559b73100149978173b0ca8085280cc7fb79982f)
(cherry picked from commit 801f7d600de923afb9f24b74f2b28cc380f09cd0)
(cherry picked from commit 6aa76e9bcf243500675b5dbd543ee89d301ca44e)
(cherry picked from commit a8757dcb071093faea8a398413ee5681193b0627)
[F3] promote F3 users to matching OAuth2 users on first sign-in
(cherry picked from commit bd7fef7496c6f50e1559eac5922ec3280745864d)
(cherry picked from commit 07412698e8828bff3e1894d57356d92bb0063665)
(cherry picked from commit d143e5b2a3dda118529d29caea5e12423b5f5116)
[F3] upgrade to gof3 50a6e740ac04
Add new methods GetIDString() & SetIDString() & ToFormatInterface()
Change the prototype of the fixture function
(cherry picked from commit d7b263ff8b6fda188fe51b2ce75fa333d4aaa23e)
(cherry picked from commit b3eaf2249d3a8b35a564890674f9f50c4e2fde35)
(cherry picked from commit d492ddd9bba3df102e513e748fcafe7808206cb2)
[F3] add GetLocalMatchingRemote with a default implementation
(cherry picked from commit 0a2201503960a18a4308fcf9c13843c6b48569b0)
(cherry picked from commit f1310c38fbc4b2b941af323be215a6313de08232)
(cherry picked from commit deb68552f24ce22e35b5c7a88ceb45190b9df0a2)
[F3] GetLocalMatchingRemote for user
(cherry picked from commit e73cb837f57be0d6c65d6ecb13da621a362351da)
(cherry picked from commit a24bc0b85e1702917a6b39282a869b26654b1aa0)
(cherry picked from commit 846a522ecc5fcdfff1e875e3d006ea68f26137dd)
[F3] GetAdminUser now has a ctx argument
(cherry picked from commit 37357a92afe74405909721a0e0062c3eebcb3454)
(cherry picked from commit 660bc1673c189a16e88bd492947280a6e25fc7dd)
(cherry picked from commit 72d692a76743279b5dd74ff69ecf85d0994be265)
[F3] introduce UserTypeF3
To avoid conflicts should UserTypeRemoteUser be used differently by Gitea
(cherry picked from commit 6de2701bb34da3ab0e9f9e6038541eecbec1d7e4)
[F3] user.Put: idempotency
(cherry picked from commit 821e38573ceaa62ffa067b4e173fad50f0f20f05)
(cherry picked from commit f7638f5414e8dadbb3d982827d52c9529a4e9298)
[F3] upgrade to urfave v2
(cherry picked from commit cc3dbdfd1d1f6814cf8f047805dccf80efd8554c)
[F3] update gof3
(cherry picked from commit 2eee960751e1481f007c00e50406104a614e1255)
[F3] move f3 under forgejo-cli
* simplify the tests by re-using the forgejo-cli helpers to capture
the output
* unify CmdF3 to be structured in the same way CmdActions is
(cherry picked from commit 4c9fe58b7475529aecae2c85a4a51f7dcee86df8)
[F3] replace f3 with forgejo-cli f3
(cherry picked from commit 7ba7ceef1b22ed43d5e89f7c4a48d883332ac512)
[F3] s/ListOptions/Paginator/
[F3] user: add unit tests
[F3] user comparison of F3 managed users is on content
[F3] issue: add unit tests
[F3] gof3 now has one more argument to Put()
[F3] re-use gof3 unit tests for the driver
(cherry picked from commit af7ee6200cba7fcc2fa8bb7ca1e0aa0a5942a7df)
Conflicts:
tests/integration/integration_test.go
because of some code removed in forgejo-development, trivial
context conflict resolution
[F3] more idempotent tests (#1275)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1275
Co-authored-by: Loïc Dachary <loic@dachary.org>
Co-committed-by: Loïc Dachary <loic@dachary.org>
[F3] tests: do SQL update if nothing changes
[F3] tests comment idempotence
[F3] tests milestone idempotence
[F3] tests pull_request idempotence
[F3] tests release idempotence
[F3] tests asset idempotence
[F3] tests project idempotence
[F3] tests review idempotence
(cherry picked from commit 91038bb4e8d1f45d496ccf05d4fc8be88ded8093)
(cherry picked from commit a7d2a65214d30d2b75961da8eed16378eb445766)
(cherry picked from commit 59a17e5a3404a320b85a2b2ee5838e704f558cea)
[F3] sub command of forgejo-cli
(cherry picked from commit 4d098e9b83a7d43e46086a84606ab627d6ae3138)
[F3] implement --quiet, --debug, --verbose
(cherry picked from commit 82e2e17b4524900ae5afd68ec3ea23d58cabba54)
[F3] fix off by one error when importing repositories
(cherry picked from commit 31689b13979cb54521a09cf95be9c77f4b718fe3)
[F3] upgrade gof3
(cherry picked from commit 87b8cfe5a1e4790848f76ccec1055782cf2e493e)
[F3] set the logger for all drivers
The logger is set for the local Forgejo driver only. Even when --debug
is specified, the other drivers do not display debug
information. Use the gof3 context to set the logger for all of them at
once.
(cherry picked from commit 8aa7de8ba0ddac1c696063aa1c5c9e52ff3e11b4)
[F3] the closed date of an issue may be nil
(cherry picked from commit 93d3eaf0b5026f003fcc071ba9596d9d225e9b17)
[F3] update gof3 to support system users
there now is a workaround to hardcode system users when they are not
supported by the API
(cherry picked from commit 915484daa7365186d77a218af1c11ef9dba53d7c)
(cherry picked from commit b47ac73b8a6452b636bfdb0cca702567c77a581b)
[F3] upgrade gof3 with a version that can deal with system users
When they are missing from what the API returns, it will replace the
missing user with the Ghost user instead of leaving it be a null pointer.
(cherry picked from commit 9eeeab7f8e79bc512a1c2e73945a3b1be418b519)
[F3] tests do not need a running Forgejo server
(cherry picked from commit b2b9749ac9d59d2d460d4b50533dd26a93659b80)
[F3] upgrade gof3 to correctly fetch PRs from forks
(cherry picked from commit d2448de302a4fe3c070f6dd78d350b6e6d2a592d)
[F3] upgrade gof3 to resolve incorrect object ID mappings
(cherry picked from commit af8c9de89ffa3bc6adf659f01850e08959797b15)
[F3] mirroring a repository needs --mirror instead of --bare
(cherry picked from commit 9941131920d0c9122121cd733d11779fa2ec8f00)
[F3] PR create the pull/N/head from the original PR head
It is incorrect to assume they are identical because:
* the IDs of a PR may be remapped and pull/N/head will become
pull/M/head
* the head of a remote fork is a branch named after the fork
(cherry picked from commit 9c220bf23e8a2d1e62862b7f5582b9269ea7e729)
[F3] gof3 upgrade with non overlapping PR references
(cherry picked from commit f1b2f82e7eede4ecb65db6e4ba5f9b59ac3b03fd)
[F3] refactor issue insertion to preserve the creation date
issues_model.NewIssue() is convenient but will override the creation
date. Update the database instead.
(cherry picked from commit 729f4be1e45472d190b6fb842c5ee0e93ddea094)
[F3] gof3 upgrade to get performance improvements
(cherry picked from commit 996ac35d4d859601c203e50ac3b49f8453bd5880)
(cherry picked from commit 906e9eb3f5a6987e7a10b430db807507909d3fbc)
(cherry picked from commit c340e221970f932d3f494918c983fb9b473289c8)
(cherry picked from commit bb0ed72e08396004dd6612d3110418e36ac2602f)
(cherry picked from commit 500e640d6d366437d88f4e3f6a047fdd86f0719e)
[F3] TestForgeMethods needs to populate the database
(cherry picked from commit e6da71229f6f940ec4b14ee5726d940e297e57c8)
(cherry picked from commit e3bd08889584ab9afb9c1fcdfc6d8b5ce34207a5)
(cherry picked from commit 22551361877dbaa3e397e4f75e79f995aae2b665)
(cherry picked from commit 69584b1baf5e5918c644304ba4bc2bf721d5bbfa)
- Currently the confirmation for dangerous actions such as transferring
the repository or deleting it only requires the user to ~~copy paste~~
type the repository name.
- This can be problematic when the user has a fork or another repository
with the same name as an organization's repository, and the confirmation
doesn't make clear that it could be deleting the wrong repository. While
it's mentioned in the dialog, it's better to be on the safe side and
also add the owner's name to be an element that has to be typed for
these dangerous actions.
- Added integration tests.
(cherry picked from commit bf679b24dd23c9ed586b9439e293bbd27cc89232)
(cherry picked from commit 1963085dd9d1521b7a4aa8558d409bd1a9f2e1da)
(cherry picked from commit fb94095d1992c3e47f03e0fccc98a90707a5271b)
(cherry picked from commit e1d1e46afee6891becdb6ccd027fc66843b56db9)
(cherry picked from commit 93993029e4ec8a20a8bc38d80bb4b801e52ee1b7)
(cherry picked from commit df3b058179d8f3e06cc6fb335b287c72c8952821)
(cherry picked from commit 8ccc6b9cba46a736665e4b25523da0baf1679702)
(cherry picked from commit 20b56692693e054bb3c04b4ef12b29b0715b4530)
(cherry picked from commit 1574643a6a9634e5b92c033a4bfb69062a86bd05)
Update semantic version according to specification
(cherry picked from commit 22510f41306f9c133a7e99b61f9c38dabfd4b810)
Mise à jour de 'Makefile'
(cherry picked from commit c3d85d8409f1bb18a45659a167cf1ffee057f3b6)
(cherry picked from commit 5ea23098513c068444226af41faf9be9c4c998e6)
(cherry picked from commit ec5217b9d1b94bb04e34ce8c27eecbdc6f3a247a)
(cherry picked from commit 14f08e364b2ad7e3176b45d3ec8da5f5605b4315)
(cherry picked from commit b4465c67b8737aed9fd79a43046aa3795a298e68)
[API] [SEMVER] replace number with version
(cherry picked from commit fba48e64977a75e77c9c6cf8e3f8a679a5e7b733)
(cherry picked from commit 532ec5d8782703b62d7d02312764e50637cd016e)
[API] [SEMVER] [v1.20] less is replaced by css
(cherry picked from commit 01ca3a4f4291cf4c62df42cbd12a00638f3cdc70)
(cherry picked from commit 1d928c3ab2e1fda6082e1400d89ea96d6605ebaa)
(cherry picked from commit a39dc804cd1da86444ed709455857f069475e7db)
Conflicts:
webpack.config.js
(cherry picked from commit adc68578b3eb41215338125edfca91804706f8a1)
(cherry picked from commit 9b8d98475fd7efcc15bf0d91b0af6ef3aff64508)
(cherry picked from commit 25161039745a63282257eded9616390241af8013)
(cherry picked from commit 18e6287963a0e1863cd08fd514a4e732a1904a68)
(cherry picked from commit e9694e67ab93ad74f7eae3152d88d95e8493e739)
(cherry picked from commit a9763edaf002c8009a2cca4115cb8b926f8cdc85)
(cherry picked from commit e2b550f4fba144f9637a212b56bfe30cac1adb3b)
(cherry picked from commit 2edac36701)
[API] Forgejo API /api/forgejo/v1 (squash)
Update semver as v1.20 is entering release candidate mode
(cherry picked from commit 4995098ec3c6eee19a7ad7bc956b71c6e937c04c)
(cherry picked from commit 578ccfdd27d7a280050bdf61d497d07decf98f2f)
(cherry picked from commit 1bf6ac09520490f0a56b9b55d7836c2d8ea5d22c)
(cherry picked from commit 2fe16b2bfed62c0386d0bfe104f7dcc621d1c3be)
(cherry picked from commit 7cd9d027eec5a2b328d06a47f34545943560fe1b)
(cherry picked from commit eaed4be2ae88055a15dcc96564440c301a13ba8e)
(cherry picked from commit cc94f3115f844a0f16064e49e5eb719d33bc4441)
(cherry picked from commit d7a77e35ccfd2d0fc2ba98932296ab7354edd2db)
(cherry picked from commit cd8eb68ab7b3e2eaacf78d370c762f43cc19fd6a)
(cherry picked from commit 68487ac95f742837e7ff38df902834b6173cd9ab)
(cherry picked from commit 616dceb565456d6fac6f58b1c4de43e9d3254090)
(cherry picked from commit 545fe5975b47d2eab348a57b87c6fd4590f33442)
(cherry picked from commit c042cf8eda2dea805138bd64daa7fbe07865ed5a)
(cherry picked from commit ae5e5a7468aa66312055a26841f658574a9b0dd7)
(cherry picked from commit 8034ef5fa2648a127f8c84c572bec02a1ff6bb9f)
(cherry picked from commit aaf0293034468505449d33ab1483ae65b4175754)
(cherry picked from commit daafa8ce58e5e6077da585b13e5190856228a4a3)
(cherry picked from commit 7ca3681d3e2ed5ec1ae44364cba476d642e2b557)
(cherry picked from commit 39f72cba71ff3f9d2cbb05c88031b34933573a8c)
(cherry picked from commit 60a591713097384935ba0ac51a5cd4793f7544a8)
(cherry picked from commit 4853bd9e16bc8986ba8159349e93bc3093dc8ab9)
[API] Move forgejo api file (squash)
- Move the file to accommodate faa28b5a44
(cherry picked from commit bce89351d251bfa18c677b30bc7da80856d919fb)
(cherry picked from commit 11ae7f6e85395b287c6f4108c531aa1a81fd964c)
(cherry picked from commit 25e96cfcb28859406329090eb0c7990bea4e73eb)
The steps to reproduce it.
First, create a new oauth2 source.
Then, a user login with this oauth2 source.
Disable the oauth2 source.
Visit users -> settings -> security, 500 will be displayed.
This is because this page only load active Oauth2 sources but not all
Oauth2 sources.
Fix nil access for inactive auth sources.
> Render failed, failed to render template:
user/settings/security/security, error: template error:
builtin(static):user/settings/security/accountlinks:32:20 : executing
"user/settings/security/accountlinks" at <$providerData.IconHTML>: nil
pointer evaluating oauth2.Provider.IconHTML
Code tries to access the auth source of an `ExternalLoginUser` but the
list contains only the active auth sources.
Currently this feature is only available to admins, but there is no
clear reason why. If a user can actually merge pull requests, then this
seems fine as well.
This is useful in situations where direct pushes to the repository are
commonly done by developers.
---------
Co-authored-by: delvh <dev.lh@web.de>
Closes#27455
> The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.
>
> To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.
The PR removes the now obsolete setting `COOKIE_USERNAME`.
1. Dropzone attachment removal, pretty simple replacement
2. Image diff: The previous code fetched every image twice, once via
`img[src]` and once via `$.ajax`. Now it's only fetched once and a
second time only when necessary. The image diff code was partially
rewritten.
---------
Co-authored-by: Giteabot <teabot@gitea.io>
storageHandler() is written as a middleware but is used as an endpoint
handler, and thus `next` is actually `nil`, which causes a null pointer
dereference when a request URL does not match the pattern (where it
calls `next.ServerHTTP()`).
Example CURL command to trigger the panic:
```
curl -I "http://yourhost/gitea//avatars/a"
```
Fixes#27409
---
Note: the diff looks big but it's actually a small change - all I did
was to remove the outer closure (and one level of indentation) ~and
removed the HTTP method and pattern checks as they seem redundant
because go-chi already does those checks~. You might want to check "Hide
whitespace" when reviewing it.
Alternative solution (a bit simpler): append `, misc.DummyOK` to the
route declarations that utilize `storageHandler()` - this makes it
return an empty response when the URL is invalid. I've tested this one
and it works too. Or maybe it would be better to return a 400 error in
that case (?)
This pull request is a minor code cleanup.
From the Go specification (https://go.dev/ref/spec#For_range):
> "1. For a nil slice, the number of iterations is 0."
> "3. If the map is nil, the number of iterations is 0."
`len` returns 0 if the slice or map is nil
(https://pkg.go.dev/builtin#len). Therefore, checking `len(v) > 0`
before a loop is unnecessary.
---
At the time of writing this pull request, there wasn't a lint rule that
catches these issues. The closest I could find is
https://staticcheck.dev/docs/checks/#S103
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
This PR reduces the complexity of the system setting system.
It only needs one line to introduce a new option, and the option can be
used anywhere out-of-box.
It is still high-performant (and more performant) because the config
values are cached in the config system.
Part of #27065
This PR touches functions used in templates. As templates are not static
typed, errors are harder to find, but I hope I catch it all. I think
some tests from other persons do not hurt.
Follow #23465 and #25624
This PR introduces the following improvements:
- We do not need to call `GetTags` to get tags because tags have been
loaded by `RepoAssignment`
ef90fdbd1d/modules/context/repo.go (L663-L668)
- Similarly, the number of tags and releases also have been loaded by
`RepoAssignment`, so the related code has been removed from the
handlers. The query condition of `GetReleaseCountByRepoID` in
`RepoAssignment` has been changed to include draft releases.
ef90fdbd1d/modules/context/repo.go (L538-L551)
- `releasesOrTags` function has been removed. The code for rendering
releases list and tags list moved to `Releases` and `TagList`
respectively.
This PR removed `unittest.MainTest` the second parameter
`TestOptions.GiteaRoot`. Now it detects the root directory by current
working directory.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Partially Fix#25041
This PR redefined the meaning of column `is_active` in table
`action_runner_token`.
Before this PR, `is_active` means whether it has been used by any
runner. If it's true, other runner cannot use it to register again.
In this PR, `is_active` means whether it's validated to be used to
register runner. And if it's true, then it can be used to register
runners until it become false. When creating a new `is_active` register
token, any previous tokens will be set `is_active` to false.
Fixes https://github.com/go-gitea/gitea/issues/27136.
This does the following for Monaco's EOL setting:
1. Use editorconfig setting if present
2. Use the file's dominant line ending as detected by monaco, which uses
LF for empty file
Beginning since 2af30f715e, Gitea has a
500 error when visiting a user profile with `?tab=overview` in the URL
when the user doesn't have a `.profile/README.md`, because the backend
code assumes that if the tab is overview a profile repository must
exist, and checks that the repository is nil aren't done.
In this PR I treat `?tab=overview` the same as if no tab is set in the
URL, which corrects this behaviour- Now, when visiting `?tab=overview`,
if `.profile/README.md` exists on that user's profile it'll show that as
it should, otherwise it'll show the repositories tab.
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
- Use the correct total amount for pagination. Thereby correctly show
the pagination bare when there's more than one page of
followers/followings.
Refs: https://codeberg.org/forgejo/forgejo/pulls/1477
(cherry picked from commit c1a136318be3bf72511bed108f2d67f2cf34e1b8)
Co-authored-by: Gusted <postmaster@gusted.xyz>