Gusted b0c5165145 [SECURITY] Rework long-term authentication ... - This is a 'front-port' of the already existing patch on v1.21 and v1.20, but applied on top of what Gitea has done to rework the LTA mechanism. Forgejo will stick with the reworked mechanism by the Forgejo Security team for the time being. The removal of legacy code (AES-GCM) has been left out. - The current architecture is inherently insecure, because you can construct the 'secret' cookie value with values that are available in the database. Thus provides zero protection when a database is dumped/leaked. - This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies). - Integration testing is added to ensure the new mechanism works. - Removes a setting, because it's not used anymore. (cherry picked from commit e3d6622a63) (cherry picked from commit fef1a6dac5)		2023-12-04 12:47:02 +01:00
..
actions	[CI] Search .forgejo/workflows first	2023-12-04 12:21:19 +01:00
activitypub	Upgrade to golangci-lint@v1.55.0 (#27756)	2023-10-24 02:54:59 +00:00
analyze	Rename code_langauge.go to code_language.go (#26377)	2023-08-07 15:00:53 -04:00
assetfs	Use Set[Type] instead of map[Type]bool/struct{}. (#26804)	2023-08-30 06:55:25 +00:00
auth	[SECURITY] default to pbkdf2 with 320,000 iterations	2023-12-04 12:47:01 +01:00
avatar	Remove nfnt/resize and oliamb/cutter (#25999)	2023-07-20 19:52:42 +08:00
base
cache	improve unit test for caching (#26185)	2023-07-27 22:24:40 +02:00
charset
container
context	[SECURITY] Rework long-term authentication	2023-12-04 12:47:02 +01:00
contexttest	Replace assert.Fail with assert.FailNow (#27578)	2023-10-11 11:02:24 +00:00
csv
doctor	Fix delete-orphaned-repos (#28200)	2023-11-24 14:46:19 +00:00
emoji
eventsource	Final round of db.DefaultContext refactor (#27587)	2023-10-14 08:37:24 +00:00
generate	Handle base64 decoding correctly to avoid panic (#26483)	2023-08-14 10:30:16 +00:00
git	Read previous info from git blame (#28306)	2023-12-01 01:26:52 +00:00
gitgraph	More db.DefaultContext refactor (#27265)	2023-09-29 12:12:54 +00:00
graceful	Refactor graceful manager to use shared code (#28073)	2023-11-24 14:21:46 +00:00
hcaptcha
highlight	Upgrade go dependencies (#25819)	2023-07-14 11:00:31 +08:00
hostmatcher	Support allowed hosts for webhook to work with proxy (#27655)	2023-10-18 09:44:36 +00:00
html	Refactor backend SVG package and add tests (#26335)	2023-08-05 04:34:59 +00:00
httpcache
httplib
indexer	[CI] disable meilisearch/elasticsearch test, no server yet in CI	2023-12-04 12:21:19 +01:00
issue/template
json
label
lfs	Upgrade to golangci-lint@v1.55.0 (#27756)	2023-10-24 02:54:59 +00:00
log	Reduce some allocations in type conversion (#26772)	2023-08-29 00:43:16 +08:00
markup	Use restricted sanitizer for repository description (#28141)	2023-11-23 16:34:25 +00:00
mcaptcha
metrics	Reduce usage of db.DefaultContext (#27073)	2023-09-14 17:09:32 +00:00
migration
nosql	Update tool dependencies, lock govulncheck and actionlint (#25655)	2023-07-09 11:58:06 +00:00
options
packages	Close all hashed buffers (#27787)	2023-10-25 21:24:24 +02:00
paginator
pprof
private	[CLI] implement forgejo-cli	2023-12-04 12:21:19 +01:00
process	Replace assert.Fail with assert.FailNow (#27578)	2023-10-11 11:02:24 +00:00
proxy
proxyprotocol
public	Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974)	2023-07-21 12:14:20 +00:00
queue	[CI] disable redis test, no redis server yet in CI	2023-12-04 12:21:19 +01:00
recaptcha
references	Replace 'userxx' with 'orgxx' in all test files when the user type is org (#27052)	2023-09-14 02:59:53 +00:00
regexplru	Upgrade go dependencies (#25819)	2023-07-14 11:00:31 +08:00
repository	Ignore "non-existing" errors when getDirectorySize calculates the size (#28276)	2023-11-29 13:08:58 +08:00
secret
session	Next round of db.DefaultContext refactor (#27089)	2023-09-16 14:39:12 +00:00
setting	[GITEA] add GetFile to config provider	2023-12-04 12:47:01 +01:00
sitemap
ssh	Remove SSH workaround (#27893)	2023-11-03 15:21:05 +00:00
storage	[CI] Forgejo Actions based CI for PR & branches	2023-12-04 12:21:19 +01:00
structs	[FEAT] allow setting the update date on issues and comments	2023-12-04 12:47:02 +01:00
svg	Refactor backend SVG package and add tests (#26335)	2023-08-05 04:34:59 +00:00
sync
system	Replace more db.DefaultContext (#27628)	2023-10-15 17:46:06 +02:00
templates	Upgrade to golangci-lint@v1.55.0 (#27756)	2023-10-24 02:54:59 +00:00
test	Move web/api context related testing function into a separate package (#26859)	2023-09-01 11:26:07 +00:00
testlogger
timeutil
translation
turnstile
typesniffer	Detect ogg mime-type as audio or video (#26494)	2023-08-15 10:31:25 +08:00
updatechecker	Replace more db.DefaultContext (#27628)	2023-10-15 17:46:06 +02:00
upload
uri
user
util	[LINT] Add deadcode linter	2023-12-04 12:47:02 +01:00
validation	Check blocklist for emails when adding them to account (#26812)	2023-08-30 10:46:49 -05:00
web	Make CORS work for oauth2 handlers (#28184)	2023-11-23 21:19:26 +08:00
webhook