Backport #28184Fix#25473
Although there was `m.Post("/login/oauth/access_token", CorsHandler()...`,
it never really worked, because it still lacks the "OPTIONS" handler.
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 23838c2c2e)
Backport #28101 by @lng2020
Reverts go-gitea/gitea#27141close#28097
Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
(cherry picked from commit a2314ca9c5)
- "Gitea" is automatically being determined in Swagger and cannot be
overridden, therefor we override it after `swagger generate spec` is run.
- Resolves https://codeberg.org/forgejo/forgejo/issues/226
(cherry picked from commit 0b45380765)
[BRANDING] Change Swagger title to Forgejo API
(cherry picked from commit 79f6a70b53)
(cherry picked from commit 6cd47afe33)
(cherry picked from commit a7ae2e4c09)
(cherry picked from commit 59f837e466)
(cherry picked from commit c1c3d1f0e6)
(cherry picked from commit 4b088713fb)
(cherry picked from commit 3df1d21371)
(cherry picked from commit a4a5fdbde4)
(cherry picked from commit 57aa9ed710)
(cherry picked from commit 948b49bf94)
(cherry picked from commit be4929ab6a)
(cherry picked from commit 9ecb507457)
Conflicts:
templates/swagger/ui.tmpl
(cherry picked from commit 8e57e68863)
(cherry picked from commit f0b3f621e3)
(cherry picked from commit 5b0a6d093e)
(cherry picked from commit 2e0f6b5de8)
(cherry picked from commit bb08076f5c)
(cherry picked from commit 5c9360e38a)
(cherry picked from commit 2f27756148)
(cherry picked from commit 6fce7eeb51)
(cherry picked from commit 8d27e7bebd)
(cherry picked from commit fda2ee2aae)
(cherry picked from commit fe0489a4d8)
(cherry picked from commit fe9479b357)
(cherry picked from commit 1deadb2f35)
(cherry picked from commit d1cb84b2f2)
(cherry picked from commit 9de15d49f8)
(cherry picked from commit 461fbe219c)
(cherry picked from commit f39bf3ba5b)
(cherry picked from commit b3f31c2f7b)
(cherry picked from commit b9f493c139)
(cherry picked from commit 83781b1641)
(cherry picked from commit 4438ee0434)
(cherry picked from commit 56b6b36833)
(cherry picked from commit d42aa19f27)
(cherry picked from commit 4b7eb6a93b)
(cherry picked from commit 9d17e95951)
(cherry picked from commit 31d3f4bb01)
(cherry picked from commit c428c3f14c)
(cherry picked from commit 07fbe2ba69)
Conflicts:
templates/swagger/v1_json.tmpl
remove trailing dot
Backport #28160 by @yp05327
Since #27054, Actions are enabled by default. so we should also edit the
document. 😃
ps: I think this should be backport to 1.21.0.
Co-authored-by: yp05327 <576951401@qq.com>
(cherry picked from commit 447422fe27)
Backport #28143 by @wxiaoguang
Compare by ignoring spaces:
https://github.com/go-gitea/gitea/pull/28143/files?diff=split&w=1
When the form is going to be submitted, add the "is-loading" class to
show an indicator and avoid user UI events.
When the request finishes (success / error), remove the "is-loading"
class to make user can interact the UI.
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit ffab076b72)
Backport #27610 by @evantobin
Fixes#27598
In #27080, the logic for the tokens endpoints were updated to allow
admins to create and view tokens in other accounts. However, the same
functionality was not added to the DELETE endpoint. This PR makes the
DELETE endpoint function the same as the other token endpoints and adds
unit tests
Co-authored-by: Evan Tobin <me@evantob.in>
(cherry picked from commit 93ede4bc83)
Backport #28072
To avoid unnecessary database access, the `cacheTime` should always be
set if the revision has been checked.
Fix#28057
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 9f63d27ec4)
Backport changelog for v1.21.0 as Giteabot doesn't seem to be in the
mood for it
---------
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit bc6477b36b)
Backport #28019 by @anudeepreddy
Hi,
This PR fixes#27988. The use of `path.join`(which uses `/` as the file
separator) to construct paths and comparing them with paths constructed
using `filepath.join`(which uses platform specific file separator) is
the root cause of this issue.
The desired behavior is to ignore attachments when dumping data
directory. Due to the what's mentioned above, the function
`addRecursiveExclude` is not actually ignoring the attachments directory
and is being written to the archive. The attachment directory is again
added to the archive (with different file separator as mentioned in the
issue) causing a duplicate entry on windows.
The solution is to use `filepath.join` in `addResursiveExclude` to
construct `currentAbsPath`.
Co-authored-by: Anudeep Reddy <anudeepc85@gmail.com>
(cherry picked from commit 00cd5ba6f4)
Backport #28023 by @6543
there was no check in place if a user could see a other user, if you
append e.g. `.rss`
(cherry picked from commit eef4148935)
Backport #27946 by @lng2020
As title. Some attachments and file sizes can easily be larger than
these limits
Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
(cherry picked from commit d4122712f7)
- Backport https://codeberg.org/forgejo/forgejo/pulls/1742
- While looking trough the logs for unrelated things I noticed errors
for directory size calculations in `pushUpdates` that were being caused
by a race condition in which git was making temporary file,
`filepath.WalkDir` noticed that but by the time the second lstat
came(`info.Info()`) it was already gone and it would error.
- Ignore temporary files created by Git.
- There are other cases but much much more rarer and not trivial to detect.
Examples:
...s/repository/push.go:96:pushUpdates() [E] Failed to update size for repository: updateSize: lstat [...]/objects/info/commit-graphs/tmp_graph_Wcy9kR: no such file or directory
...s/repository/push.go:96:pushUpdates() [E] Failed to update size for repository: updateSize: lstat [...]/packed-refs.lock: no such file or directory
(cherry picked from commit 16ce00772d)
(cherry picked from commit 2aebef847f)
- If you attempted to get a branch feed on a empty repository, it would
result in a panic as the code expects that the branch exists.
- `context.RepoRefByType` would normally already 404 if the branch
doesn't exist, however if a repository is empty, it would not do this
check.
- Fix bug where `/atom/branch/*` would return a RSS feed.
(cherry picked from commit d27bcd98a4)
(cherry picked from commit 07916c8723)
(cherry picked from commit 2eedbe0c55)
(cherry picked from commit 3810d905c6)
- The review type '22' is a general comment type that is attached to
single codecomments, reviews with multiple comments or to simple approve
and request changes comment. This comment can be used to create a link
towards this action on an pull request.
- Adds an anchor to the review comment type, so that when its getting
linked to it, it actually jumps towards that event.
- This also now fixes the behavior that after you created a review you
will be redirected to that review and because this is an general comment
type other mails will also be 'fixed' such as the approved or request
changes.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1248
(cherry picked from commit 1741a5f1fe)
---------
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Caesar Schinas <caesar@caesarschinas.com>
(cherry picked from commit 89c9a498fd)
(cherry picked from commit a2e2ce79f4)
(cherry picked from commit 299e437379)
(cherry picked from commit 91a224ce2d)
(cherry picked from commit 3a89b23b3b)
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.
(cherry picked from commit eff097448b)
[GITEA] rework long-term authentication (squash) add migration
Reminder: the migration is run via integration tests as explained
in the commit "[DB] run all Forgejo migrations in integration tests"
(cherry picked from commit 4accf7443c)
(cherry picked from commit 99d06e344ebc3b50bafb2ac4473dd95f057d1ddc)
(cherry picked from commit d8bc98a8f0)
(cherry picked from commit 6404845df9)
(cherry picked from commit 72bdd4f3b9)
(cherry picked from commit 4b01bb0ce8)
(cherry picked from commit c26ac31816)
The installation instructions of a Maven package places the `url` child
of the `repository` node in an extra indentation level. This indentation
is unnecesary since both the `id` and `url` nodes are direct children of
the `repository` node.
This commit removes the unnecessary indentation.
Refs: https://codeberg.org/forgejo/forgejo/pulls/1534
(cherry picked from commit 82f0ddad7b)
(cherry picked from commit 905e546549)
(cherry picked from commit 4e58ab82b7)
(cherry picked from commit 2f207e7deb)
(cherry picked from commit c3552fb2be)
(cherry picked from commit 6c8e4d4fc9)
(cherry picked from commit a9f7fa924c)
(cherry picked from commit 4592a73f57)
- Add a indication to the file history if the file has been renamed,
this indication contains a link to browse the history of the file
further.
- Added unit testing.
- Added integration testing.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1279
(cherry picked from commit 72c297521b)
(cherry picked from commit 283f964894)
Conflicts:
options/locale/locale_en-US.ini
https://codeberg.org/forgejo/forgejo/pulls/1550
(cherry picked from commit 7c30af7fde)
(cherry picked from commit f3be6eb269)
(cherry picked from commit 78e1755b94)
(cherry picked from commit 9f30b92009)
(cherry picked from commit bb694684a4)
(cherry picked from commit 721f0ccf3e)
(cherry picked from commit 6a6ec50130)
[GITEA] Detect file rename and show in history (squash) ctx.Locale
(cherry picked from commit 08698d747f)
- If there's a code comment that's received during the migration that
contains no diffhunk, skip it. This either means it was commenting on
old diffhunk or it's just a general codecomment. Forgejo supports
neither of such type of code comment.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1407
(cherry picked from commit ae463c7c55)
(cherry picked from commit bf48f02a86)
(cherry picked from commit 10c3f102fa)
(cherry picked from commit 828b4cc10c)
(cherry picked from commit 6427fa65b6)
(cherry picked from commit 5b7a43c43f)
(cherry picked from commit 49eb256648)
(cherry picked from commit 0be26ca144)
(cherry picked from commit c083236a58)
(cherry picked from commit 85738bc0a1)
- Currently the repository description uses the same sanitizer as a
normal markdown document. This means that element such as heading and
images are allowed and can be abused.
- Create a minimal restricted sanitizer for the repository description,
which only allows what the postprocessor currently allows, which are
links and emojis.
- Added unit testing.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1202
- Resolves https://codeberg.org/Codeberg/Community/issues/1122
(cherry picked from commit a8afa4cd18)
(cherry picked from commit 0238587c51)
(cherry picked from commit a8c7bbf728)
(cherry picked from commit 80e05a8245)
(cherry picked from commit f5af5050b3)
(cherry picked from commit 608f981e55)
(cherry picked from commit 6591867502)
(cherry picked from commit b7e6dedafd)
(cherry picked from commit 1cd196da49)
(cherry picked from commit 4c74fd4a04)
- Make it consistent with the other modals of the dangerous actions.
(cherry picked from commit 576d7ec759)
(cherry picked from commit 8b1225f974)
(cherry picked from commit c2c47972ee)
(cherry picked from commit eec301806b)
(cherry picked from commit 6b5e728f0a)
(cherry picked from commit 3681691e65)
(cherry picked from commit 0d6f131e21)
(cherry picked from commit 7ac510074b)
(cherry picked from commit 2d561205d2)
(cherry picked from commit dbb4737afe)
[GITEA] Tidy up archive modal (squash) ctx.Locale
(cherry picked from commit aa682a5f04)
System users (Ghost, ActionsUser, etc) have a negative id and may be
the author of a comment, either because it was created by a now
deleted user or via an action using a transient token.
The GetPossibleUserByID function has special cases related to system
users and will not fail if given a negative id.
Refs: https://codeberg.org/forgejo/forgejo/issues/1425
(cherry picked from commit 97667e06b3)
(cherry picked from commit 8ef73a09c9)
(cherry picked from commit fa8a00d264)
(cherry picked from commit 2ada2074b5)
(cherry picked from commit f9a59b940a)
(cherry picked from commit cd82834043)
(cherry picked from commit 7fb032c240)
(cherry picked from commit 64438ff837)
(cherry picked from commit 8174592b29)
(cherry picked from commit 46d36555f9)
