user, topic, project, label, milestone, repository, pull_request,
release, asset, comment, reaction, review providers
Signed-off-by: Earl Warren <contact@earl-warren.org>
Preserve file size when creating attachments
Introduced in c6f5029708
repoList.LoadAttributes has a ctx argument now
Rename `repo.GetOwner` to `repo.LoadOwner`
bd66fa586a
upgrade to the latest gof3
(cherry picked from commit c77071365629984c1dc39a7a83e7252fd5b298e2)
[F3] ID remapping logic is in place, remove workaround
(cherry picked from commit d0fee301670c37c0e73afb271e0a8dd6b622f6f6)
[F3] it is experimental, do not enable by default
(cherry picked from commit de325b21d0adad199ec05652cb8d9fff19248ddb)
(cherry picked from commit 547e7b3c40f15766deb569cf2acface3290cf092)
(cherry picked from commit 820df3a56bc194645b482ef77a8845255d1185fe)
(cherry picked from commit eaba87689bbea84a215558033fc7d514b1b44f3e)
(cherry picked from commit 1b86896b3b4144254ed27064a167650b4e12c690)
(cherry picked from commit 0046aac1c639e021e719408e374cfc84fcbaa1d8)
(cherry picked from commit f14220df8ff692bdcfdcc94660acf64c77e732f5)
(cherry picked from commit 559b73100149978173b0ca8085280cc7fb79982f)
(cherry picked from commit 801f7d600de923afb9f24b74f2b28cc380f09cd0)
(cherry picked from commit 6aa76e9bcf243500675b5dbd543ee89d301ca44e)
(cherry picked from commit a8757dcb071093faea8a398413ee5681193b0627)
[F3] promote F3 users to matching OAuth2 users on first sign-in
(cherry picked from commit bd7fef7496c6f50e1559eac5922ec3280745864d)
(cherry picked from commit 07412698e8828bff3e1894d57356d92bb0063665)
(cherry picked from commit d143e5b2a3dda118529d29caea5e12423b5f5116)
[F3] upgrade to gof3 50a6e740ac04
Add new methods GetIDString() & SetIDString() & ToFormatInterface()
Change the prototype of the fixture function
(cherry picked from commit d7b263ff8b6fda188fe51b2ce75fa333d4aaa23e)
(cherry picked from commit b3eaf2249d3a8b35a564890674f9f50c4e2fde35)
(cherry picked from commit d492ddd9bba3df102e513e748fcafe7808206cb2)
[F3] add GetLocalMatchingRemote with a default implementation
(cherry picked from commit 0a2201503960a18a4308fcf9c13843c6b48569b0)
(cherry picked from commit f1310c38fbc4b2b941af323be215a6313de08232)
(cherry picked from commit deb68552f24ce22e35b5c7a88ceb45190b9df0a2)
[F3] GetLocalMatchingRemote for user
(cherry picked from commit e73cb837f57be0d6c65d6ecb13da621a362351da)
(cherry picked from commit a24bc0b85e1702917a6b39282a869b26654b1aa0)
(cherry picked from commit 846a522ecc5fcdfff1e875e3d006ea68f26137dd)
[F3] GetAdminUser now has a ctx argument
(cherry picked from commit 37357a92afe74405909721a0e0062c3eebcb3454)
(cherry picked from commit 660bc1673c189a16e88bd492947280a6e25fc7dd)
(cherry picked from commit 72d692a76743279b5dd74ff69ecf85d0994be265)
[F3] introduce UserTypeF3
To avoid conflicts should UserTypeRemoteUser be used differently by Gitea
(cherry picked from commit 6de2701bb34da3ab0e9f9e6038541eecbec1d7e4)
[F3] user.Put: idempotency
(cherry picked from commit 821e38573ceaa62ffa067b4e173fad50f0f20f05)
(cherry picked from commit f7638f5414e8dadbb3d982827d52c9529a4e9298)
[F3] upgrade to urfave v2
(cherry picked from commit cc3dbdfd1d1f6814cf8f047805dccf80efd8554c)
[F3] update gof3
(cherry picked from commit 2eee960751e1481f007c00e50406104a614e1255)
[F3] move f3 under forgejo-cli
* simplify the tests by re-using the forgejo-cli helpers to capture
the output
* unify CmdF3 to be structured in the same way CmdActions is
(cherry picked from commit 4c9fe58b7475529aecae2c85a4a51f7dcee86df8)
[F3] replace f3 with forgejo-cli f3
(cherry picked from commit 7ba7ceef1b22ed43d5e89f7c4a48d883332ac512)
[F3] s/ListOptions/Paginator/
[F3] user: add unit tests
[F3] user comparison of F3 managed users is on content
[F3] issue: add unit tests
[F3] gof3 now has one more argument to Put()
[F3] re-use gof3 unit tests for the driver
(cherry picked from commit af7ee6200cba7fcc2fa8bb7ca1e0aa0a5942a7df)
Conflicts:
tests/integration/integration_test.go
because of some code removed in forgejo-development, trivial
context conflict resolution
[F3] more idempotent tests (#1275)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1275
Co-authored-by: Loïc Dachary <loic@dachary.org>
Co-committed-by: Loïc Dachary <loic@dachary.org>
[F3] tests: do SQL update if nothing changes
[F3] tests comment idempotence
[F3] tests milestone idempotence
[F3] tests pull_request idempotence
[F3] tests release idempotence
[F3] tests asset idempotence
[F3] tests project idempotence
[F3] tests review idempotence
(cherry picked from commit 91038bb4e8d1f45d496ccf05d4fc8be88ded8093)
(cherry picked from commit a7d2a65214d30d2b75961da8eed16378eb445766)
(cherry picked from commit 59a17e5a3404a320b85a2b2ee5838e704f558cea)
[F3] sub command of forgejo-cli
(cherry picked from commit 4d098e9b83a7d43e46086a84606ab627d6ae3138)
[F3] implement --quiet, --debug, --verbose
(cherry picked from commit 82e2e17b4524900ae5afd68ec3ea23d58cabba54)
[F3] fix off by one error when importing repositories
(cherry picked from commit 31689b13979cb54521a09cf95be9c77f4b718fe3)
[F3] upgrade gof3
(cherry picked from commit 87b8cfe5a1e4790848f76ccec1055782cf2e493e)
[F3] set the logger for all drivers
The logger is set for the local Forgejo driver only. Even when --debug
is specified, the other drivers do not display debug
information. Use the gof3 context to set the logger for all of them at
once.
(cherry picked from commit 8aa7de8ba0ddac1c696063aa1c5c9e52ff3e11b4)
[F3] the closed date of an issue may be nil
(cherry picked from commit 93d3eaf0b5026f003fcc071ba9596d9d225e9b17)
[F3] update gof3 to support system users
there now is a workaround to hardcode system users when they are not
supported by the API
(cherry picked from commit 915484daa7365186d77a218af1c11ef9dba53d7c)
(cherry picked from commit b47ac73b8a6452b636bfdb0cca702567c77a581b)
[F3] upgrade gof3 with a version that can deal with system users
When they are missing from what the API returns, it will replace the
missing user with the Ghost user instead of leaving it be a null pointer.
(cherry picked from commit 9eeeab7f8e79bc512a1c2e73945a3b1be418b519)
[F3] tests do not need a running Forgejo server
(cherry picked from commit b2b9749ac9d59d2d460d4b50533dd26a93659b80)
[F3] upgrade gof3 to correctly fetch PRs from forks
(cherry picked from commit d2448de302a4fe3c070f6dd78d350b6e6d2a592d)
[F3] upgrade gof3 to resolve incorrect object ID mappings
(cherry picked from commit af8c9de89ffa3bc6adf659f01850e08959797b15)
[F3] mirroring a repository needs --mirror instead of --bare
(cherry picked from commit 9941131920d0c9122121cd733d11779fa2ec8f00)
[F3] PR create the pull/N/head from the original PR head
It is incorrect to assume they are identical because:
* the IDs of a PR may be remapped and pull/N/head will become
pull/M/head
* the head of a remote fork is a branch named after the fork
(cherry picked from commit 9c220bf23e8a2d1e62862b7f5582b9269ea7e729)
[F3] gof3 upgrade with non overlapping PR references
(cherry picked from commit f1b2f82e7eede4ecb65db6e4ba5f9b59ac3b03fd)
[F3] refactor issue insertion to preserve the creation date
issues_model.NewIssue() is convenient but will override the creation
date. Update the database instead.
(cherry picked from commit 729f4be1e45472d190b6fb842c5ee0e93ddea094)
[F3] gof3 upgrade to get performance improvements
(cherry picked from commit 996ac35d4d859601c203e50ac3b49f8453bd5880)
(cherry picked from commit 906e9eb3f5a6987e7a10b430db807507909d3fbc)
(cherry picked from commit c340e221970f932d3f494918c983fb9b473289c8)
(cherry picked from commit bb0ed72e08396004dd6612d3110418e36ac2602f)
(cherry picked from commit 500e640d6d366437d88f4e3f6a047fdd86f0719e)
[F3] TestForgeMethods needs to populate the database
(cherry picked from commit e6da71229f6f940ec4b14ee5726d940e297e57c8)
(cherry picked from commit e3bd08889584ab9afb9c1fcdfc6d8b5ce34207a5)
(cherry picked from commit 22551361877dbaa3e397e4f75e79f995aae2b665)
(cherry picked from commit 69584b1baf5e5918c644304ba4bc2bf721d5bbfa)
(cherry picked from commit aea4ab25a93642b9032544e82299ef652162a092)
(cherry picked from commit d386b212c48d0b1c8b50f947f11f08a0ad8c6d63)
(cherry picked from commit c4935f08adc2830747905fdd051c551a7e3a0434)
(cherry picked from commit dc6ca7cd25d82039a89c6b0d34cb1cfe80d186e9)
(cherry picked from commit 25296d5a3cc48b8a6b3517a8e085f30208f681c8)
(cherry picked from commit 3d54c64c5f7793e70201ed8b1d636aff2160682e)
(cherry picked from commit 6ece0b9d0144b85ef3e3c5814e56f3d87cacf4cc)
(cherry picked from commit 3b39962033fe87494f2318e4db89dd47182ccaef)
(cherry picked from commit 5e2167cd03efc7af5782abb4fcfa009345a550e3)
(cherry picked from commit e676d7b265d0784241c498645dcd7b6127071024)
(cherry picked from commit 9cd258e8658af36f7149249e81a8923284c4802f)
(cherry picked from commit 0a8d58c1592d0677819977bba4f08cad6a178865)
(cherry picked from commit b66d06823a5634ab355e95c6171749c9bac93878)
(cherry picked from commit 4fbe2a0047c2b78b5a329664f6c9442576d65bbf)
(cherry picked from commit a225e0c9b419ed32f35699630af0d7b97e6a3395)
(cherry picked from commit 21b670b9273353ec233c2840282b168150c0dc99)
(cherry picked from commit d586e335d51dd447cc76b42dac8ddacbf99feb73)
(cherry picked from commit 7ab21549a3014aa7f9ab55d6a9f35a8b1ca551b8)
Fixes#27819
We have support for two factor logins with the normal web login and with
basic auth. For basic auth the two factor check was implemented at three
different places and you need to know that this check is necessary. This
PR moves the check into the basic auth itself.
The steps to reproduce it.
First, create a new oauth2 source.
Then, a user login with this oauth2 source.
Disable the oauth2 source.
Visit users -> settings -> security, 500 will be displayed.
This is because this page only load active Oauth2 sources but not all
Oauth2 sources.
Closes#27455
> The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.
>
> To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.
The PR removes the now obsolete setting `COOKIE_USERNAME`.
When the user does not set a username lookup condition, LDAP will get an
empty string `""` for the user, hence the following code
```
if isExist, err := user_model.IsUserExist(db.DefaultContext, 0, sr.Username)
```
The user presence determination will always be nonexistent, so updates
to user information will never be performed.
Fix#27049
Part of #27065
This reduces the usage of `db.DefaultContext`. I think I've got enough
files for the first PR. When this is merged, I will continue working on
this.
Considering how many files this PR affect, I hope it won't take to long
to merge, so I don't end up in the merge conflict hell.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Bumping `github.com/golang-jwt/jwt` from v4 to v5.
`github.com/golang-jwt/jwt` v5 is bringing some breaking changes:
- standard `Valid()` method on claims is removed. It's replaced by
`ClaimsValidator` interface implementing `Validator()` method instead,
which is called after standard validation. Gitea doesn't seem to be
using this logic.
- `jwt.Token` has a field `Valid`, so it's checked in `ParseToken`
function in `services/auth/source/oauth2/token.go`
---------
Co-authored-by: Giteabot <teabot@gitea.io>
we refactored `userIDFromToken` for the token parsing part into a new
function `parseToken`. `parseToken` returns the string `token` from
request, and a boolean `ok` representing whether the token exists or
not. So we can distinguish between token non-existence and token
inconsistency in the `verfity` function, thus solving the problem of no
proper error message when the token is inconsistent.
close#24439
related #22119
---------
Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: Giteabot <teabot@gitea.io>
Fix#21072
![image](https://github.com/go-gitea/gitea/assets/15528715/96b30beb-7f88-4a60-baae-2e5ad8049555)
Username Attribute is not a required item when creating an
authentication source. If Username Attribute is empty, the username
value of LDAP user cannot be read, so all users from LDAP will be marked
as inactive by mistake when synchronizing external users.
This PR improves the sync logic, if username is empty, the email address
will be used to find user.
1. The "web" package shouldn't depends on "modules/context" package,
instead, let each "web context" register themselves to the "web"
package.
2. The old Init/Free doesn't make sense, so simplify it
* The ctx in "Init(ctx)" is never used, and shouldn't be used that way
* The "Free" is never called and shouldn't be called because the SSPI
instance is shared
---------
Co-authored-by: Giteabot <teabot@gitea.io>
The plan is that all built-in auth providers use inline SVG for more
flexibility in styling and to get the GitHub icon to follow
`currentcolor`. This only removes the `public/img/auth` directory and
adds the missing svgs to our svg build.
It should map the built-in providers to these SVGs and render them. If
the user has set a Icon URL, it should render that as an `img` tag
instead.
```
gitea-azure-ad
gitea-bitbucket
gitea-discord
gitea-dropbox
gitea-facebook
gitea-gitea
gitea-gitlab
gitea-google
gitea-mastodon
gitea-microsoftonline
gitea-nextcloud
gitea-twitter
gitea-yandex
octicon-mark-github
```
GitHub logo is now white again on dark theme:
<img width="431" alt="Screenshot 2023-06-12 at 21 45 34"
src="https://github.com/go-gitea/gitea/assets/115237/27a43504-d60a-4132-a502-336b25883e4d">
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Fix#24856
Rename "context.contextKey" to "context.WebContextKey", this context is
for web context only. But the Context itself is not renamed, otherwise
it would cause a lot of changes (if we really want to rename it, there
could be a separate PR).
The old test code doesn't really test, the "install page" gets broken
not only one time, so use new test code to make sure the "install page"
could work.
Replace #16455Close#21803
Mixing different Gitea contexts together causes some problems:
1. Unable to respond proper content when error occurs, eg: Web should
respond HTML while API should respond JSON
2. Unclear dependency, eg: it's unclear when Context is used in
APIContext, which fields should be initialized, which methods are
necessary.
To make things clear, this PR introduces a Base context, it only
provides basic Req/Resp/Data features.
This PR mainly moves code. There are still many legacy problems and
TODOs in code, leave unrelated changes to future PRs.
Co-author: @pboguslawski
"registration success email" is only used for notifying a user that "you
have a new account now" when the account is created by admin manually.
When a user uses external auth source, they already knows that they has
the account, so do not send such email.
Co-authored-by: Giteabot <teabot@gitea.io>
Since the login form label for user_name unconditionally displays
`Username or Email Address` for the `user_name` field, bring matching
LDAP filters to more prominence in the documentation/placeholders.
Signed-off-by: Gary Moon <gary@garymoon.net>
Partially for #24457
Major changes:
1. The old `signedUserNameStringPointerKey` is quite hacky, use
`ctx.Data[SignedUser]` instead
2. Move duplicate code from `Contexter` to `CommonTemplateContextData`
3. Remove incorrect copying&pasting code `ctx.Data["Err_Password"] =
true` in API handlers
4. Use one unique `RenderPanicErrorPage` for panic error page rendering
5. Move `stripSlashesMiddleware` to be the first middleware
6. Install global panic recovery handler, it works for both `install`
and `web`
7. Make `500.tmpl` only depend minimal template functions/variables,
avoid triggering new panics
Screenshot:
<details>
![image](https://user-images.githubusercontent.com/2114189/235444895-cecbabb8-e7dc-4360-a31c-b982d11946a7.png)
</details>
> The scoped token PR just checked all API routes but in fact, some web
routes like `LFS`, git `HTTP`, container, and attachments supports basic
auth. This PR added scoped token check for them.
---------
Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This allows for usernames, and emails connected to them to be reserved
and not reused.
Use case, I manage an instance with open registration, and sometimes
when users are deleted for spam (or other purposes), their usernames are
freed up and they sign up again with the same information.
This could also be used to reserve usernames, and block them from being
registered (in case an instance would like to block certain things
without hardcoding the list in code and compiling from scratch).
This is an MVP, that will allow for future work where you can set
something as reserved via the interface.
---------
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
Close#24062
At the beginning, I just wanted to fix the warning mentioned by #24062
But, the cookie code really doesn't look good to me, so clean up them.
Complete the TODO on `SetCookie`:
> TODO: Copied from gitea.com/macaron/macaron and should be improved
after macaron removed.
In the `for` loop, the value of `membershipsToAdd[org]` and
`membershipsToRemove[org]` is a slice that should be appended instead of
overwritten.
Due to the current overwrite, the LDAP group sync only matches the last
group at the moment.
## Example reproduction
- an LDAP user is both a member of
`cn=admin_staff,ou=people,dc=planetexpress,dc=com` and
`cn=ship_crew,ou=people,dc=planetexpress,dc=com`.
- configuration of `Map LDAP groups to Organization teams ` in
`Authentication Sources`:
```json
{
"cn=admin_staff,ou=people,dc=planetexpress,dc=com":{
"test_organization":[
"admin_staff",
"test_add"
]
},
"cn=ship_crew,ou=people,dc=planetexpress,dc=com":{
"test_organization":[
"ship_crew"
]
}
```
- start `Synchronize external user data` task in the `Dashboard`.
- the user was only added for the team `test_organization.ship_crew`
None of the features of `unrolled/render` package is used.
The Golang builtin "html/template" just works well. Then we can improve
our HTML render to resolve the "$.root.locale.Tr" problem as much as
possible.
Next step: we can have a template render pool (by Clone), then we can
inject global functions with dynamic context to every `Execute` calls.
Then we can use `{{Locale.Tr ....}}` directly in all templates , no need
to pass the `$.root.locale` again and again.
When running listLdapGroupMemberships check if the groupFilter is empty
before using it to list memberships.
Fix#23615
Signed-off-by: Andrew Thornton <art27@cantab.net>
When there is an error creating a new openIDConnect authentication
source try to handle the error a little better.
Close#23283
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>