This PR fixes#7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however.
## Features
- [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.)
- [x] Verify commits signed with the default gpg as valid
- [x] Signer, Committer and Author can all be different
- [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon.
- [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available
- Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg
- [x] Try to match the default key with a user on gitea - this is done at verification time
- [x] Make things configurable?
- app.ini configuration done
- [x] when checking commits are signed need to check if they're actually verifiable too
- [x] Add documentation
I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.
* Add Diff Download to Compare List
* Add&Change Text for Diff Options
* move button to seperate template
* add drop down menue with options
* Update: Compare
update Gogs, BitBucket, RhodeCode and remove gitea issue link
Co-Authored-By: Lauris BH <lauris@nix.lv>
* remove last things from TESTing
Add password complexity checks. The default settings require a lowercase, uppercase, number and a special character within passwords.
Co-Authored-By: T-M-A <maxim.tkachenko@gmail.com>
Co-Authored-By: Lanre Adelowo <adelowomailbox@gmail.com>
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
Co-Authored-By: Lauris BH <lauris@nix.lv>
Also reworked the header to remove the filename (which is redundant with
the file path above) and made the header a flexbox with a monospace
font.
Fixes: https://github.com/go-gitea/gitea/issues/8170
* Add teams to repo on collaboration page.
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Add option for repository admins to change teams access to repo.
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Add comment for functions
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Make RepoAdminChangeTeamAccess default false in xorm and make it default checked in template instead.
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Make proper language strings and fix error redirection.
* Add unit tests for adding and deleting team from repository.
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Add database migration
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Fix redirect
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Fix locale string mismatch.
Signed-off-by: David Svantesson <davidsvantesson@gmail.com>
* Move team access mode text logic to template.
* Move collaborator access mode text logic to template.
* Update ref comment
* Generate comment on simple ref
* Make fmt + remove unneeded repo load
* Add TODO comments
* Add ref-check in issue creation; re-arrange template
* Make unit tests pass; rearrange code
* Make fmt
* Filter out xref comment if user can't see the referencing issue
* Add TODOs
* Add cross reference
* Rearrange code; add cross-repository references
* Striketrhough obsolete references
* Remove unnecesary TODO
* Add "not supported" note
* Support for edits and deletes, and issue title
* Revert changes to go.mod
* Fix fmt
* Add support for xref from API
* Add first integration test
* Add integration tests
* Correct formatting
* Fix add comment test
* Add migration
* Remove outdated comments; fix typo
* Some code refactoring and rearranging
* Rename findCrossReferences to createCrossReferences
* Delete xrefs when repository is deleted
* Corrections as suggested by @lafriks
* Prepare for merge
* Fix log for errors
* refuse merge until ci successfully
* deny merge request when required status checkes not succeed on merge Post and API
* add database migration for added columns on protected_branch
* fix migration
* fix protected branch check bug
* fix protected branch settings
* remove duplicated code on check pull request's required commit statuses pass
* remove unused codes
* fix migration
* add newline for template file
* fix go mod
* rename function name and some other fixes
* fix template
* fix bug pull view
* remove go1.12 wrong dependencies
* add administrator bypass when protected branch status check enabled
* fix bug
* improve the codes
* Adds side-by-side diff for images
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Explain blank imports
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Use complete word for width and height labels on image compare
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Update index.css from master
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Moves ImageInfo to git commit file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Assign ImageInfo function for template and sets correct target for BeforeSourcePath
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds missing comment
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Return error if ImageInfo failed
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Avoid template panic when ImageInfo failed for some reason
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Show file size on image diff
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Removes unused helper function
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Reverts copyright year change
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Close file reader
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Update commit.go
Sets correct data key
* Moves reader.Close() up a few lines
* Updates index.css
* Updates CSS file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Transfers adjustments for image compare to compare.go file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adjusts variable name
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Apply lesshint recommendations
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Do not show old image on image compare if it is not in index of base commit
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Change file size text
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Add optional label sets on repo creation
* Fix CRLF
* Instead of hardcoding default, make it the helper
* Move label set init out of repo init
Add a new error for the router
Combine router label init with repo creation label init
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Add issue labels to Swagger for repo creation
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Update models/issue_label.go
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Update models/issue_label.go
Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>
* Add Backend Logic for Toggling Email Notification
This commit adds the backend logic for
allowing users to enable or disable email
notifications. The implementation ensures
that only issue notification emails get disabled
and important emails are still sent regardless
of the setting.
The UI to toggle this setting has not yet been
implemented.
* Add UI and complete user email notification enable
This commit completes the functionality to allow
users to disable their own email notifications.
Signed-off-by: Gary Kim <gary@garykim.dev>
* Add Third Option for Only Email on Mention
Signed-off-by: Gary Kim <gary@garykim.dev>
* Readd NOT NULL to new preference string
Signed-off-by: Gary Kim <gary@garykim.dev>
* Add Tests and Rewrite Comment
Signed-off-by: Gary Kim <gary@garykim.dev>
* Allow admin to set default email frequency
Signed-off-by: Gary Kim <gary@garykim.dev>
* Add new config option to docs
Signed-off-by: Gary Kim <gary@garykim.dev>
* Fix a few mistakes
Signed-off-by: Gary Kim <gary@garykim.dev>
* Only update required columns
Signed-off-by: Gary Kim <gary@garykim.dev>
* Simplify an error check
Signed-off-by: Gary Kim <gary@garykim.dev>
* Make email_notification_preference column in DB be VARCHAR(20)
Signed-off-by: Gary Kim <gary@garykim.dev>
* Handle errors
Signed-off-by: Gary Kim <gary@garykim.dev>
* Update models/migrations/v93.go
Co-Authored-By: Lauris BH <lauris@nix.lv>
* add download-button info message
* add overflow-visible css for table colum class
* right colum is always there
* add download button for default branch
* add download button for all other branchs
* resize table colum so two buttons fit in
* code indent avter rebase
* show commit divergence corect
https://github.com/go-gitea/gitea/issues/7625
* changes because of merge master into ...
* optimize if statement for protected branches
* dont downloat a deleted branch - fix error 404
* Fixes#7474 - Handles all redirects for Web UI File CRUD
* Fixes lint errors
* Typo fix
* Adds unit tests for a few helper functions
* Fixes per review
* Fix for new branch creation and to unit test
* Fixes the template used for errors on delete
fix#7
* add wiki page revision list
* mobile improvements
* css improvements for long usernames
* split renderWikiPage into 3 functions
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* Store original author info for migrated issues and comments
Keep original author name for displaying in Gitea interface and also
store original author user ID for potential future use in linking
accounts from old location.
* Add original_url for repo
Store the original URL for a migrated repo
Clean up migrations/tests
* fix migration
* fix golangci-lint
* make 'make revive' happy also
* Modify templates to use OriginalAuthor if set
Use the original author name in templates if it is set rather than the
user who migrated/currently owns the issues
* formatting fixes
* make generate-swagger
* Use default avatar for imported comments
* Remove no longer used IgnoreIssueAuthor option
* Add OriginalAuthorID to swagger also
* archived repo - remove
- open/close button on issue list
- assigne person on issue list
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* archived repo - remove
- comment field on issue view
- lock/unlock issue conversation button from sidebar on issue view
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* archived repo - add 'compare commits' button to pull request
+ remove new pull request button from compare view
as the route is still working, and there is no need to be hidden
Signed-off-by: Michael Gnehr <michael@gnehr.de>
* Only show repository avatar in list when one was selected
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds fallback configuration option for repository avatar
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Implements repository avatar fallback
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds admin task for deleting generated repository avatars
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Solve linting issues
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Save avatar before updating database
* Linting
* Update models/repo.go
Co-Authored-By: zeripath <art27@cantab.net>
* Repository avatars
- first variant of code from old work for gogs
- add migration 87
- add new option in app.ini
- add en-US locale string
- add new class in repository.less
* Add changed index.css, remove unused template name
* Update en-us doc about configuration options
* Add comments to new functions, add new option to docker app.ini
* Add comment for lint
* Remove variable, not needed
* Fix formatting
* Update swagger api template
* Check if avatar exists
* Fix avatar link/path checks
* Typo
* TEXT column can't have a default value
* Fixes:
- remove old avatar file on upload
- use ID in name of avatar file - users may upload same files
- add simple tests
* Fix fmt check
* Generate PNG instead of "static" GIF
* More informative comment
* Fix error message
* Update avatar upload checks:
- add file size check
- add new option
- update config docs
- add new string to en-us locale
* Fixes:
- use FileHEader field for check file size
- add new test - upload big image
* Fix formatting
* Update comments
* Update log message
* Removed wrong style - not needed
* Use Sync2 to migrate
* Update repos list view
- bigger avatar
- fix html blocks alignment
* A little adjust avatar size
* Use small icons for explore/repo list
* Use new cool avatar preparation func by @lafriks
* Missing changes for new function
* Remove unused import, move imports
* Missed new option definition in app.ini
Add file size check in user/profile avatar upload
* Use smaller field length for Avatar
* Use session to update repo DB data, update DeleteAvatar - use session too
* Fix err variable definition
* As suggested @lafriks - return as soon as possible, code readability
* Show git-notes
* Make git-notes heading text localizable
* Refactor git-notes data fetching to a separate function
* Display the author and time of git notes
* Move note bubble inside the commit bubble
* Revert "Move note bubble inside the commit bubble"
This reverts commit c0951fe0e3.
* Add test for git-notes
* testing ui
* Polish CSS
* Apply suggestions from code review
Co-Authored-By: Lauris BH <lauris@nix.lv>
* Add GET requests to webhook
* make fmt
* Handle invalid http method on webhook
* Uppercase http method in webhook
* Rename v85.go to v86.go
* make fmt
* Show button to delete a pull request branch after a pull request has been closed (#6570)
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Update routers/repo/pull.go
Co-Authored-By: saitho <mario.lubenka@googlemail.com>
* Add oauth2 grants ui
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add delete functionality
Add translations
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Fix unit tests
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Fix unit tests
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Refactor DeleteOAuth2Grant
Use results.Close()
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Refactor DeleteOAuth2Grant (again)
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Check if user ID is zero
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Check if grant ID is zero
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Support searching commits with prefix syntax
For now, support auther: committer:
When more than one prefix is supplied is presented, the result is the union.
When different prefixes are supplied, the result is the intersection.
For example,
"author:alice author:bob"
=> the result is all commits authored by Alice OR Bob
"hello committer:alice"
=> the result is all commits committed by Alice AND has the keyword
'hello' in the message.
Note that there should NOT have any space after the colon(:) of the prefix.
For example,
"author:bill" => correct
"author: bill" => wrong
* Remove unneeded logging
* Add missing files of test repository
* Add missing repo_unit entries to test fixtures
* Update test cases
* Add tooltip for commits search button
* Update tooltip text
I have no idea about how to format it with line breaks.
* Make the usage example more real
* Add a test case
* Add new options struct for SearchCommits
* Prefer len(s) > 0 over s != ""
* Add NewSearchCommitsOptions
* Panic don't fatal on create new logger
Fixes#5854
Signed-off-by: Andrew Thornton <art27@cantab.net>
* partial broken
* Update the logging infrastrcture
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Reset the skip levels for Fatal and Error
Signed-off-by: Andrew Thornton <art27@cantab.net>
* broken ncsa
* More log.Error fixes
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Remove nal
* set log-levels to lowercase
* Make console_test test all levels
* switch to lowercased levels
* OK now working
* Fix vetting issues
* Fix lint
* Fix tests
* change default logging to match current gitea
* Improve log testing
Signed-off-by: Andrew Thornton <art27@cantab.net>
* reset error skip levels to 0
* Update documentation and access logger configuration
* Redirect the router log back to gitea if redirect macaron log but also allow setting the log level - i.e. TRACE
* Fix broken level caching
* Refactor the router log
* Add Router logger
* Add colorizing options
* Adjust router colors
* Only create logger if they will be used
* update app.ini.sample
* rename Attribute ColorAttribute
* Change from white to green for function
* Set fatal/error levels
* Restore initial trace logger
* Fix Trace arguments in modules/auth/auth.go
* Properly handle XORMLogger
* Improve admin/config page
* fix fmt
* Add auto-compression of old logs
* Update error log levels
* Remove the unnecessary skip argument from Error, Fatal and Critical
* Add stacktrace support
* Fix tests
* Remove x/sync from vendors?
* Add stderr option to console logger
* Use filepath.ToSlash to protect against Windows in tests
* Remove prefixed underscores from names in colors.go
* Remove not implemented database logger
This was removed from Gogs on 4 Mar 2016 but left in the configuration
since then.
* Ensure that log paths are relative to ROOT_PATH
* use path.Join
* rename jsonConfig to logConfig
* Rename "config" to "jsonConfig" to make it clearer
* Requested changes
* Requested changes: XormLogger
* Try to color the windows terminal
If successful default to colorizing the console logs
* fixup
* Colorize initially too
* update vendor
* Colorize logs on default and remove if this is not a colorizing logger
* Fix documentation
* fix test
* Use go-isatty to detect if on windows we are on msys or cygwin
* Fix spelling mistake
* Add missing vendors
* More changes
* Rationalise the ANSI writer protection
* Adjust colors on advice from @0x5c
* Make Flags a comma separated list
* Move to use the windows constant for ENABLE_VIRTUAL_TERMINAL_PROCESSING
* Ensure matching is done on the non-colored message - to simpify EXPRESSION
* Make Ghost not link to 404 page
* Make correct localization label show
* Create and use GetLastEventLabelFake for when a Ghost user has made the action, thus not linking to a user profile
* Add corresponding _fake entries to locale_en-US
* Make Ghost avatar not link to 404 page
* Make Ghost on milestone_issues not link to 404 page
Include the current CustomPath location in the admin section and also
display GITEA_WORK_DIR and/or GITEA_CUSTOM env var if they are set.
Right now there is no easy way to see this information, and if you try
and help most users they won't be able to tell you anything about these
values -- just that their custom template isn't working, files aren't in
the right place, etc... Now you can see all paths and if they were set
by ENV or not.
Partially implement #770.
Add "Default Webhooks" page in site admin UI.
Persist to the existing webhooks table, but store with RepoID=0 and OrgID=0.
Upon repo creation, copy the set of default webhooks into the new repo.
* Add emoji to labels
Minor cleanup of tribute code in footer.tmpl
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Quick find/replace in other i18n files containing label translations
Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Revert "Quick find/replace in other i18n files containing label translations"
This reverts commit ec3e1a3a17.
* Add style to overwrite emoji height in labels
* Revert Makefile change that makes Windows work
This PR makes it possible for the markdown renderer to render images and media straight from the LFS.
Fix#5746
Signed-off-by: Andrew Thornton [art27@cantab.net](mailto:art27@cantab.net)
* fixes#5957
* add tests to make sure config option is respected
* use already defined struct
* - use migration to make the flag repo wide not for the entire gitea instance
Also note that the config value can still be set so as to be able to control the value for new repositories that are to be created
- fix copy/paste error in copyright header year and rearrange import
- use repo config instead of server config value to determine if a commit should close an issue
- update testsuite
* use global config only when creating a new repository
* allow repo admin toggle feature via UI
* fix typo and improve testcase
* fix fixtures
* add DEFAULT prefix to config value
* fix test
* Don't display buttons if there are no notices
* clear stopwatch on merging a PR
* remove redundant gt check
* use ctx.Flash as per @bkcsoft comment
* stop timer on closing issues/PRs too
* updated translation as per review
* redirect to login page after successfully activating account
* remove unrelated changes
* stop timer for issues that are closed via commits too..Not just the 'close' UI button
1. A key can either be an ssh user key or a deploy key. It cannot be both.
2. If a key is a user key - it can only be associated with one user.
3. If a key is a deploy key - it can be used in multiple repositories and the permissions it has on those repositories can be different.
4. If a repository is deleted, its deploy keys must be deleted too.
We currently don't enforce any of this and multiple repositories access with different permissions doesn't work at all. This PR enforces the following constraints:
- [x] You should not be able to add the same user key as another user
- [x] You should not be able to add a ssh user key which is being used as a deploy key
- [x] You should not be able to add a ssh deploy key which is being used as a user key
- [x] If you add an ssh deploy key to another repository you should be able to use it in different modes without losing the ability to use it in the other mode.
- [x] If you delete a repository you must delete all its deploy keys.
Fix#1357
* add util method and tests
* make sure the title of an issue cannot be empty
* wiki title cannot be empty
* pull request title cannot be empty
* update to make use of the new util methof
* add migration and basic UI for changing a user's theme
* update user themem
* use right text on button
* load theme based on users' selection
* load theme based on users' selection in pwa too
* update sample config
* delete older theme loading
* implement AfterLoad to set users' theme properly
* set up default theme when creating a user. This uses the installation wide theme
* use flash messages for error
* set default theme when creating a user from the cli
* fix @lunny review
* Add branch protection for approvals
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add required approvals
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add missing comments and fmt
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* Add type = approval and group by reviewer_id to review
* Prevent users from adding negative review limits
* Add migration for approval whitelists
Signed-off-by: Jonas Franz <info@jonasfranz.software>
* improve team members and repositories settings UI
* use tab on team pages
* add default description on team members and repos
* add blank on numbers and texts
* improve translation
* add milestone issues and pulls page instead of redirecting issues page
* add milestone when creating issue from milestone page
* refactor to merge similiar codes as a new function issues
* remove milestone info on milestone issues list
* fix missing params
* Show either sign up OR sign in
* disambiguate fresh start from adding recovery options
* use tabs to switch between account link flows
* add active to tab body as well
* changes as per discussion
* handle specific error; fix missing err typo
* Added basic heatmap data
* Added extra case for sqlite
* Built basic heatmap into user profile
* Get contribution data from api & styling
* Fixed lint & added extra group by statements for all database types
* generated swagger spec
* generated swagger spec
* generated swagger spec
* fixed swagger spec
* fmt
* Added tests
* Added setting to enable/disable user heatmap
* Added locale for loading text
* Removed UseTiDB
* Updated librejs & moment.js
* Fixed import order
* Fixed heatmap in postgresql
* Update docs/content/doc/advanced/config-cheat-sheet.en-us.md
Co-Authored-By: kolaente <konrad@kola-entertainments.de>
* Added copyright header
* Fixed a bug to show the heatmap for the actual user instead of the currently logged in
* Added integration test for heatmaps
* Added a heatmap on the dashboard
* Fixed timestamp parsing
* Hide heatmap on mobile
* optimized postgresql group by query
* Improved sqlite group by statement
* redirect to login page after successfully activating account
* force users to change password if account was created by an admin
* force users to change password if account was created by an admin
* fixed build
* fixed build
* fix pending issues with translation and wrong routes
* make sure path check is safe
* remove unneccessary newline
* make sure users that don't have to view the form get redirected
* move route to use /settings prefix so as to make sure unauthenticated users can't view the page
* update as per @lafriks review
* add necessary comment
* remove unrelated changes
* support redirecting to location the user actually want to go to before being forced to change his/her password
* run make fmt
* added tests
* improve assertions
* add assertion
* fix copyright year
Signed-off-by: Lanre Adelowo <yo@lanre.wtf>
zeripath