mirrors
/
forgejo
mirror of
1
Fork 0
Code Issues Releases Activity
forgejo/models
History
Gusted e3d6622a63
[SECURITY] Rework long-term authentication 
- This is a 'front-port' of the already existing patch on v1.21 and
v1.20, but applied on top of what Gitea has done to rework the LTA
mechanism. Forgejo will stick with the reworked mechanism by the Forgejo
Security team for the time being. The removal of legacy code (AES-GCM) has been
left out.
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.
 		2023-11-22 20:40:00 +01:00
..
actions [CLI] implement forgejo-cli 2023-11-13 11:51:54 +01:00
activities Refactor Find Sources and fix bug when view a user who belongs to an unactive auth source (#27798) 2023-11-03 01:41:00 +00:00
admin Next round of `db.DefaultContext` refactor (#27089) 2023-09-16 14:39:12 +00:00
asymkey Replace more db.DefaultContext (#27628) 2023-10-15 17:46:06 +02:00
auth [SECURITY] Rework long-term authentication 2023-11-22 20:40:00 +01:00
avatars Final round of `db.DefaultContext` refactor (#27587) 2023-10-14 08:37:24 +00:00
db [SEMVER] store SemVer in ForgejoSemVer after a database upgrade 2023-11-13 12:21:08 +01:00
dbfs make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
fixtures Add unit tests for action runner token (#27670) 2023-10-19 07:24:24 +00:00
forgejo/semver [SEMVER] store SemVer in ForgejoSemVer after a database upgrade 2023-11-13 12:21:09 +01:00
forgejo_migrations [SECURITY] Rework long-term authentication 2023-11-22 20:40:00 +01:00
git Upgrade xorm to 1.3.4 (#27807) 2023-10-27 13:28:53 +02:00
issues [FEAT] allow setting the update date on issues and comments 2023-11-13 12:21:09 +01:00
migrations [UPGRADE] run sanity checks before the database is upgraded 2023-11-13 12:21:09 +01:00
organization Even more `db.DefaultContext` refactor (#27352) 2023-10-03 10:30:41 +00:00
packages List all Debian package versions in `Packages` (#27786) 2023-10-29 14:14:47 +00:00
perm Even more `db.DefaultContext` refactor (#27352) 2023-10-03 10:30:41 +00:00
project More `db.DefaultContext` refactor (#27265) 2023-09-29 12:12:54 +00:00
pull Add Index to pull_auto_merge.doer_id (#27811) 2023-10-30 08:39:29 +00:00
repo [FEAT] allow setting the update date on issues and comments 2023-11-13 12:21:09 +01:00
secret Refactor secrets modification logic (#26873) 2023-09-05 15:21:02 +00:00
shared/types Display owner of a runner as a tooltip instead of static text (#24377) 2023-05-12 08:43:27 +00:00
system Replace more db.DefaultContext (#27628) 2023-10-15 17:46:06 +02:00
unit Make actions default enabled for newly created repository if global configuraion enabled (#27482) 2023-10-10 14:45:31 +00:00
unittest [TESTS] tests.AddFixtures helper loads additional per-test fixtures 2023-11-13 12:21:09 +01:00
user [SECURITY] Rework long-term authentication 2023-11-22 20:40:00 +01:00
webhook Final round of `db.DefaultContext` refactor (#27587) 2023-10-14 08:37:24 +00:00
error.go Sync branches into databases (#22743) 2023-06-29 10:03:20 +00:00
fixture_generation.go Replace more db.DefaultContext (#27628) 2023-10-15 17:46:06 +02:00
fixture_test.go Replace more db.DefaultContext (#27628) 2023-10-15 17:46:06 +02:00
main_test.go make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
org.go Refactor the function RemoveOrgUser (#27582) 2023-11-03 14:01:45 +00:00
org_team.go Refactor the function RemoveOrgUser (#27582) 2023-11-03 14:01:45 +00:00
org_team_test.go Reduce usage of `db.DefaultContext` (#27073) 2023-09-14 17:09:32 +00:00
org_test.go Replace more db.DefaultContext (#27628) 2023-10-15 17:46:06 +02:00
repo.go Penultimate round of `db.DefaultContext` refactor (#27414) 2023-10-11 04:24:07 +00:00
repo_test.go Penultimate round of `db.DefaultContext` refactor (#27414) 2023-10-11 04:24:07 +00:00
repo_transfer.go Next round of `db.DefaultContext` refactor (#27089) 2023-09-16 14:39:12 +00:00
repo_transfer_test.go Next round of `db.DefaultContext` refactor (#27089) 2023-09-16 14:39:12 +00:00