backport #28213
This PR will fix some missed checks for private repositories' data on
web routes and API routes.
(cherry picked from commit bc3d8bff73)
Backport #28205 by @CodeShakingSheep
In the [docs for email
setup](https://docs.gitea.com/administration/email-setup)
`mailer.IS_TLS_ENABLED` is mentioned which was replaced by
`mailer.PROTOCOL` in release 1.18.0 according to
https://blog.gitea.com/release-of-1.18.0/ . This change wasn't reflected
in the docs for email setup. I just replaced the deprecated mailer
setting.
Co-authored-by: CodeShakingSheep <19874562+CodeShakingSheep@users.noreply.github.com>
(cherry picked from commit 5ed0eefc9a)
Backport #28191 by @yp05327
https://gitea.com/gitea/gitea-docusaurus/actions/runs/661/jobs/0#jobstep-9-39
I noticed that there are many warning logs in building docs.
It is causing 404 in docs.gitea.com now, so we need to fix it.
And there are also some other problems in v1.19 which can not be done in
this PR.
Co-authored-by: yp05327 <576951401@qq.com>
(cherry picked from commit 4b89c0f996)
Backport #28200
gitea doctor failed at checking and fixing 'delete-orphaned-repos',
because table name 'user' needs quoting to be correctly recognized by at
least PostgreSQL.
fixes#28199
(cherry picked from commit 7cae4dfc00)
Backport #28184Fix#25473
Although there was `m.Post("/login/oauth/access_token", CorsHandler()...`,
it never really worked, because it still lacks the "OPTIONS" handler.
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 23838c2c2e)
Backport #28101 by @lng2020
Reverts go-gitea/gitea#27141close#28097
Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
(cherry picked from commit a2314ca9c5)
- "Gitea" is automatically being determined in Swagger and cannot be
overridden, therefor we override it after `swagger generate spec` is run.
- Resolves https://codeberg.org/forgejo/forgejo/issues/226
(cherry picked from commit 0b45380765)
[BRANDING] Change Swagger title to Forgejo API
(cherry picked from commit 79f6a70b53)
(cherry picked from commit 6cd47afe33)
(cherry picked from commit a7ae2e4c09)
(cherry picked from commit 59f837e466)
(cherry picked from commit c1c3d1f0e6)
(cherry picked from commit 4b088713fb)
(cherry picked from commit 3df1d21371)
(cherry picked from commit a4a5fdbde4)
(cherry picked from commit 57aa9ed710)
(cherry picked from commit 948b49bf94)
(cherry picked from commit be4929ab6a)
(cherry picked from commit 9ecb507457)
Conflicts:
templates/swagger/ui.tmpl
(cherry picked from commit 8e57e68863)
(cherry picked from commit f0b3f621e3)
(cherry picked from commit 5b0a6d093e)
(cherry picked from commit 2e0f6b5de8)
(cherry picked from commit bb08076f5c)
(cherry picked from commit 5c9360e38a)
(cherry picked from commit 2f27756148)
(cherry picked from commit 6fce7eeb51)
(cherry picked from commit 8d27e7bebd)
(cherry picked from commit fda2ee2aae)
(cherry picked from commit fe0489a4d8)
(cherry picked from commit fe9479b357)
(cherry picked from commit 1deadb2f35)
(cherry picked from commit d1cb84b2f2)
(cherry picked from commit 9de15d49f8)
(cherry picked from commit 461fbe219c)
(cherry picked from commit f39bf3ba5b)
(cherry picked from commit b3f31c2f7b)
(cherry picked from commit b9f493c139)
(cherry picked from commit 83781b1641)
(cherry picked from commit 4438ee0434)
(cherry picked from commit 56b6b36833)
(cherry picked from commit d42aa19f27)
(cherry picked from commit 4b7eb6a93b)
(cherry picked from commit 9d17e95951)
(cherry picked from commit 31d3f4bb01)
(cherry picked from commit c428c3f14c)
(cherry picked from commit 07fbe2ba69)
Conflicts:
templates/swagger/v1_json.tmpl
remove trailing dot
Backport #28160 by @yp05327
Since #27054, Actions are enabled by default. so we should also edit the
document. 😃
ps: I think this should be backport to 1.21.0.
Co-authored-by: yp05327 <576951401@qq.com>
(cherry picked from commit 447422fe27)
Backport #28143 by @wxiaoguang
Compare by ignoring spaces:
https://github.com/go-gitea/gitea/pull/28143/files?diff=split&w=1
When the form is going to be submitted, add the "is-loading" class to
show an indicator and avoid user UI events.
When the request finishes (success / error), remove the "is-loading"
class to make user can interact the UI.
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit ffab076b72)
Backport #27610 by @evantobin
Fixes#27598
In #27080, the logic for the tokens endpoints were updated to allow
admins to create and view tokens in other accounts. However, the same
functionality was not added to the DELETE endpoint. This PR makes the
DELETE endpoint function the same as the other token endpoints and adds
unit tests
Co-authored-by: Evan Tobin <me@evantob.in>
(cherry picked from commit 93ede4bc83)
Backport #28072
To avoid unnecessary database access, the `cacheTime` should always be
set if the revision has been checked.
Fix#28057
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 9f63d27ec4)
Backport changelog for v1.21.0 as Giteabot doesn't seem to be in the
mood for it
---------
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit bc6477b36b)
Backport #28019 by @anudeepreddy
Hi,
This PR fixes#27988. The use of `path.join`(which uses `/` as the file
separator) to construct paths and comparing them with paths constructed
using `filepath.join`(which uses platform specific file separator) is
the root cause of this issue.
The desired behavior is to ignore attachments when dumping data
directory. Due to the what's mentioned above, the function
`addRecursiveExclude` is not actually ignoring the attachments directory
and is being written to the archive. The attachment directory is again
added to the archive (with different file separator as mentioned in the
issue) causing a duplicate entry on windows.
The solution is to use `filepath.join` in `addResursiveExclude` to
construct `currentAbsPath`.
Co-authored-by: Anudeep Reddy <anudeepc85@gmail.com>
(cherry picked from commit 00cd5ba6f4)
Backport #28023 by @6543
there was no check in place if a user could see a other user, if you
append e.g. `.rss`
(cherry picked from commit eef4148935)
Backport #27946 by @lng2020
As title. Some attachments and file sizes can easily be larger than
these limits
Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
(cherry picked from commit d4122712f7)
- Backport https://codeberg.org/forgejo/forgejo/pulls/1742
- While looking trough the logs for unrelated things I noticed errors
for directory size calculations in `pushUpdates` that were being caused
by a race condition in which git was making temporary file,
`filepath.WalkDir` noticed that but by the time the second lstat
came(`info.Info()`) it was already gone and it would error.
- Ignore temporary files created by Git.
- There are other cases but much much more rarer and not trivial to detect.
Examples:
...s/repository/push.go:96:pushUpdates() [E] Failed to update size for repository: updateSize: lstat [...]/objects/info/commit-graphs/tmp_graph_Wcy9kR: no such file or directory
...s/repository/push.go:96:pushUpdates() [E] Failed to update size for repository: updateSize: lstat [...]/packed-refs.lock: no such file or directory
(cherry picked from commit 16ce00772d)
(cherry picked from commit 2aebef847f)
- If you attempted to get a branch feed on a empty repository, it would
result in a panic as the code expects that the branch exists.
- `context.RepoRefByType` would normally already 404 if the branch
doesn't exist, however if a repository is empty, it would not do this
check.
- Fix bug where `/atom/branch/*` would return a RSS feed.
(cherry picked from commit d27bcd98a4)
(cherry picked from commit 07916c8723)
(cherry picked from commit 2eedbe0c55)
(cherry picked from commit 3810d905c6)
- The review type '22' is a general comment type that is attached to
single codecomments, reviews with multiple comments or to simple approve
and request changes comment. This comment can be used to create a link
towards this action on an pull request.
- Adds an anchor to the review comment type, so that when its getting
linked to it, it actually jumps towards that event.
- This also now fixes the behavior that after you created a review you
will be redirected to that review and because this is an general comment
type other mails will also be 'fixed' such as the approved or request
changes.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1248
(cherry picked from commit 1741a5f1fe)
---------
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Caesar Schinas <caesar@caesarschinas.com>
(cherry picked from commit 89c9a498fd)
(cherry picked from commit a2e2ce79f4)
(cherry picked from commit 299e437379)
(cherry picked from commit 91a224ce2d)
(cherry picked from commit 3a89b23b3b)
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.
(cherry picked from commit eff097448b)
[GITEA] rework long-term authentication (squash) add migration
Reminder: the migration is run via integration tests as explained
in the commit "[DB] run all Forgejo migrations in integration tests"
(cherry picked from commit 4accf7443c)
(cherry picked from commit 99d06e344ebc3b50bafb2ac4473dd95f057d1ddc)
(cherry picked from commit d8bc98a8f0)
(cherry picked from commit 6404845df9)
(cherry picked from commit 72bdd4f3b9)
(cherry picked from commit 4b01bb0ce8)
(cherry picked from commit c26ac31816)
Loïc Dachary