Commit graph

14590 commits

Author SHA1 Message Date
zeripath 83640c449e
Remove ReverseProxy authentication from the API (#22219)
Since we changed the /api/v1/ routes to disallow session authentication
we also removed their reliance on CSRF. However, we left the
ReverseProxy authentication here - but this means that POSTs to the API
are no longer protected by CSRF.

Now, ReverseProxy authentication is a kind of session authentication,
and is therefore inconsistent with the removal of session from the API.

This PR proposes that we simply remove the ReverseProxy authentication
from the API and therefore users of the API must explicitly use tokens
or basic authentication.

Replace #22077
Close #22221 
Close #22077 

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-12-27 08:34:05 +08:00
Jason Song 814b44aeaf
Fix typo of Asia/Shanghai (#22242)
As the title.
2022-12-26 16:50:58 +08:00
silverwind f5cd0d9319
Add Mermaid copy button, avoid unnecessary tooltip hide (#22225)
- Add Copy button to mermaid diagrams which copies their source.
- Set tippy to not hide on click and avoid tooltip re-creation for
temporary tooltips. This avoids hide and show when copying repo url.
Popovers still hide the tooltip as usual.


<img width="815" alt="Screenshot 2022-12-23 at 14 02 32"
src="https://user-images.githubusercontent.com/115237/209341696-98e30953-f246-46d9-9157-2ececfd791c9.png">

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
2022-12-25 18:17:48 +01:00
Lunny Xiao 3bd49f7801 [skip ci] Updated licenses and gitignores 2022-12-25 00:19:36 +00:00
Lunny Xiao 2b0b56319e
Improve testing for pgsql empty repository (#22223) 2022-12-23 12:34:51 -06:00
silverwind 2cf0cf0de1
JS refactors (#22227)
- Replace all default exports with named exports, except for Vue SFCs
- Remove names from Vue SFCs, they are automatically inferred from the
filename
- Misc whitespace-related tweaks
2022-12-24 00:03:11 +08:00
Jason Song 71ca3067bc
Check primary keys for all tables and drop ForeignReference (#21721)
Some dbs require that all tables have primary keys, see
- #16802
- #21086

We can add a test to keep it from being broken again.

Edit:

~Added missing primary key for `ForeignReference`~ Dropped the
`ForeignReference` table to satisfy the check, so it closes #21086.

More context can be found in comments.

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: zeripath <art27@cantab.net>
2022-12-23 19:35:43 +08:00
silverwind 41f0668da8
Hide file borders on sticky diff box (#22217)
Before: (1px border left and right when scrolled to a file)
<img width="1143" alt="Screenshot 2022-12-22 at 15 37 54"
src="https://user-images.githubusercontent.com/115237/209158082-c1a413b1-45b7-46b7-a71c-8e5a06324f43.png">

After: (no border)
<img width="1149" alt="Screenshot 2022-12-22 at 15 39 01"
src="https://user-images.githubusercontent.com/115237/209158086-9b00641f-2f41-4de1-9c08-22230c8a966a.png">

Layout in the box does not shift with the changes.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-12-23 11:58:30 +08:00
Nick a2779def36 Test views of LFS files (#22196) 2022-12-23 07:41:56 +08:00
techknowlogick ea5a752ee6
update docs latest to 1.17.4 2022-12-22 10:47:57 -05:00
Lunny Xiao 7bf7c13b64
Frontport 1.17.4 changelog (#22216) 2022-12-22 09:36:01 -06:00
Lunny Xiao 8c1bb77437
Remove test session cache to reduce possible concurrent problem (#22199) 2022-12-22 21:09:35 +08:00
silverwind ac5b44b2f4
Upgrade hugo to 0.82 (#22209)
See
https://github.com/go-gitea/gitea/pull/22206#issuecomment-1362523796.
Apparently hugo 0.81.0 is a broken release in regards to checksums.

https://github.com/gohugoio/hugo/releases/tag/v0.82.0

Co-authored-by: Lauris BH <lauris@nix.lv>
2022-12-22 19:29:33 +08:00
Lauris BH 6037043adf
Fix container layer display overflow (#22208)
Before:

![attels](https://user-images.githubusercontent.com/165205/209109653-6c690569-ddbe-4d8b-ab42-66b9a9c6a556.png)


After:

![attels](https://user-images.githubusercontent.com/165205/209110521-8aa8fc1c-21c8-4280-9b39-ab560b6d95f4.png)
2022-12-22 12:33:17 +02:00
silverwind 3affb02df5
Run hugo via go run and lock its version (#22206)
- Don't rely on obscure docker images like `plugins/hugo`
- Lock down `hugo` to same version the image had used
- Remove unnecessary verbosity in `trans-copy`
- Rename `trans-copy` to `trans-copy.sh`

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: John Olheiser <john+github@jolheiser.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-21 21:09:53 -05:00
zeripath 8e17fb5c06
Update bleve and zapx to fix unaligned atomic (#22031)
There is an unaligned atomic field in zapx 15.3.5 which should have been
fixed in a subsequent patch

This bug causes issues on 32bit builds.

Update bleve and zapx to account for this.

Fix #21957

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-12-21 19:08:26 -06:00
KN4CK3R b76718249a
Allow empty assignees on pull request edit (#22150)
Fixes #22140
2022-12-21 16:45:44 -06:00
Reo 48d71b7d6b
Add Feed for Releases and Tags (#21696)
Fixes #19091

Add Feed for Releases and Tags, can be accessed through
`reponame/releases.rss`, `reponame/releases.atom`, `reponame/tags.rss`,
and `reponame/tags.atom`

Signed-off-by: Reo <reo_999@proton.me>
2022-12-21 15:06:26 -06:00
John Olheiser 9914b21493
fix: update libcurl in docs pipeline (#22203)
updating libcurl fixes the mismatch between curl and libcurl

Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2022-12-21 13:45:32 -06:00
MisterCavespider c403e2f1cf
Fixed colour transparency regex matching in project board sorting (#22091) (#22092)
As described in the linked issue (#22091), semi-transparent UI elements
would result in JS errors due to the fact that the CSS `backgroundColor`
element was being matched by the pattern
`^rgb\((\d+),\s*(\d+),\s*(\d+)\)$`, which does not take the alpha
channel into account.

I changed the pattern to `^rgba?\((\d+),\s*(\d+),\s*(\d+).*\)$`.
This new pattern accepts both `rgb` and `rgba` tuples, and ignores the
alpha channel (that little `.*` at the end) from the sorting criteria.
The reason why I chose to ignore alpha is because when it comes to
kanban colour sorting, only the hue is important; the order of the
panels should stay the same, even if some of them are transparent.

Alternative solutions were discussed in the bug report and are included
here for completeness:
1. Change the regex from ^rgb\((\d+),\s*(\d+),\s*(\d+)\)$ to
^rgba?\((\d+),\s*(\d+),\s*(\d+)(,\s*(\d+(\.\d+)?))?\)$ (alpha channel is
a float or NaN on 5th group) and include the alpha channel in the
sorting criteria.
2. Rethink on why you're reading colours out of the CSS in the first
place, then reformat this sorting procedure.

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-21 20:19:04 +08:00
Nathaniel Sabanski 8e267afd35
Mobile fix for Project view: Add delay to Sortable.js on mobile, to ensure scrolling is possible. (#22152)
Mobile / touch devices currently get "hung up" on the sortable action,
preventing any ability to visually scroll through the Project board to
see issues.

Solution: Sortable.js has a built-in fix using `delayOnTouchOnly`

BEFORE

https://user-images.githubusercontent.com/24665/208266817-6f2968b7-4788-4656-a941-f85b25fc59d5.mp4

AFTER

https://user-images.githubusercontent.com/24665/208266822-3d327002-7a9d-41cf-9890-6d6b8dcb17be.mp4

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-20 23:56:58 -05:00
KN4CK3R 86ace4b5c2
Normalize NuGet package version on upload (#22186)
Fixes #22178

After this change upload versions with different semver metadata are
treated as the same version and trigger a duplicated version error.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-12-20 22:20:23 -05:00
zeripath fe6608f72b
Attempt to fix TestExportUserGPGKeys (#22159)
There are repeated failures with this test which appear related to
failures in getTokenForLoggedInUser. It is difficult to further evaluate
the cause of these failures as we do not get given further information.

This PR will attempt to fix this.

First it adds some extra logging and it uses the csrf cookie primarily
for the csrf value.

If the problem does not occur again with those changes we could merge,
assume that it is fixed and hope that if it occurs in future the
additional logging will be helpful.

If not I will add more changes in attempt to fix.

Fix #22105

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
Co-authored-by: techknowlogick <matti@mdranta.net>
Co-authored-by: delvh <dev.lh@web.de>
2022-12-21 09:46:16 +08:00
Gusted 90572c5a22
Specify ID in TestAPITeam (#22192)
- There have been [CI
failures](https://codeberg.org/forgejo/forgejo/issues/111) in this
specific test function. The code on itself looks good, the CI failures
are likely caused by not specifying any field in `TeamUser`, which might
have caused to unittest to return another `TeamUser` than the code
expects.

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
2022-12-21 09:22:23 +08:00
Nick c4df10d219
Repair LFS web rendering. (#22195)
There was just a missing check.

Fixes #22193.

Signed-off-by: Nick Guenther <nick.guenther@polymtl.ca>
2022-12-21 09:21:26 +08:00
Dan Church 70d15e7785
Fix misc whitespace issues in install docs (#22189)
I ran into issues when copy-pasting the docker-compose.yml contents from
https://docs.gitea.io/en-us/install-with-docker/ - specifically the part
about adding PostgreSQL to the YAML file; I tried manually adding the
diffs by removing the `+` at the beginning of lines, and the resulting
YAML was unparsable.

This forces the indentation to be consistent across all places where
YAML is used.

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-20 17:26:03 -05:00
silverwind e767b3372a
Update JS dependencies and eslint (#22190)
- Update all JS dependencies to latest version
- Enable unicorn/prefer-node-protocol and autofix issues
- Regenerate SVGs
- Add some comments to eslint rules
- Tested build, Mermaid and Katex rendering
2022-12-20 17:15:47 -05:00
Lunny Xiao 495b8b3635
Fix delete secret modal (#22187)
Fix #22181
2022-12-20 12:18:15 -06:00
Jason Song 659055138b
Secrets storage with SecretKey encrypted (#22142)
Fork of #14483, but [gave up
MasterKey](https://github.com/go-gitea/gitea/pull/14483#issuecomment-1350728557),
and fixed some problems.

Close #12065.
Needed by #13539.

Featrues:
- Secrets for repo and org, not user yet.
- Use SecretKey to encrypte/encrypt secrets.
- Trim spaces of secret value.
- Add a new locale ini block, to make it easy to support secrets for
user.

Snapshots:

Repo level secrets:

![image](https://user-images.githubusercontent.com/9418365/207823319-b8a4903f-38ca-4af7-9d05-336a5af906f3.png)

Rrg level secrets

![image](https://user-images.githubusercontent.com/9418365/207823371-8bd02e93-1928-40d1-8c76-f48b255ace36.png)

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
2022-12-20 17:07:13 +08:00
Gusted 40ba750c4b
Check for zero time instant in TimeStamp.IsZero() (#22171)
- Currently, the 'IsZero' function for 'TimeStamp' just checks if the
unix time is zero, which is not the behavior of 'Time.IsZero()', but
Gitea is using this method in accordance with the behavior of
'Time.IsZero()'.
- Adds a new condition to check for the zero time instant.
- Fixes a bug where non-expiring GPG keys where shown as they expired on
Jan 01, 0001.
- Related https://codeberg.org/Codeberg/Community/issues/791

Before:

![image](https://user-images.githubusercontent.com/25481501/208509035-ecc5fa4a-3bd1-4fa3-beba-90875719163c.png)

After:

![image](https://user-images.githubusercontent.com/25481501/208508950-3e7f6eeb-be83-432a-89a6-d738553dafe4.png)
2022-12-20 10:04:55 +08:00
silverwind 2774671584
Fix heatmap first color being unused (#22157)
vue3-calendar-heatmap has the behaviour that the first and second colors
are mapped to values null and 0, meaning the second color was not used
as intended for values > 0. I think this is a behaviour change from
previous vue2 version that was missed during the upgrade.

This change makes first and second values the same, so the heatmap can
now use one additional color for meaningful values.

Before:
<img width="710" alt="Screenshot 2022-12-18 at 09 17 58"
src="https://user-images.githubusercontent.com/115237/208288347-df4973af-8ebd-4582-b828-bec948ffdf60.png">

After:
<img width="709" alt="Screenshot 2022-12-18 at 09 18 15"
src="https://user-images.githubusercontent.com/115237/208288350-e0b85aa2-6925-4a37-83d2-89e2518c91ce.png">

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-12-19 16:14:49 -05:00
zeripath d6b96627c1
Add setting to disable the git apply step in test patch (#22130)
For a long time Gitea has tested PR patches using a git apply --check
method, and in fact prior to the introduction of a read-tree assisted
three-way merge in #18004, this was the only way of checking patches.

Since #18004, the git apply --check method has been a fallback method,
only used when the read-tree three-way merge method has detected a
conflict. The read-tree assisted three-way merge method is much faster
and less resource intensive method of detecting conflicts. #18004 kept
the git apply method around because it was thought possible that this
fallback might be able to rectify conflicts that the read-tree three-way
merge detected. I am not certain if this could ever be the case.

Given the uncertainty here and the now relative stability of the
read-tree method - this PR makes using this fallback optional and
disables it by default. The hope is that users will not notice any
significant difference in conflict detection and we will be able to
remove the git apply fallback in future, and/or improve the read-tree
three-way merge method to catch any conflicts that git apply method
might have been able to fix.

An additional benefit is that patch checking should be significantly
less resource intensive and much quicker.

(See
https://github.com/go-gitea/gitea/issues/22083\#issuecomment-1347961737)

Ref #22083

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
2022-12-19 19:37:15 +08:00
zeripath a89b399faa
Local storage should not store files as executable (#22162)
The PR #21198 introduced a probable security vulnerability which
resulted in making all storage files be marked as executable.

This PR ensures that these are forcibly marked as non-executable.

Fix #22161

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-12-19 08:50:36 +08:00
zeripath 998fe26051 [skip ci] Updated licenses and gitignores 2022-12-18 00:19:33 +00:00
zeripath 6e22605793
Ensure that plain files are rendered correctly even when containing ambiguous characters (#22017)
As recognised in #21841 the rendering of plain text files is somewhat
incorrect when there are ambiguous characters as the html code is double
escaped. In fact there are several more problems here.

We have a residual isRenderedHTML which is actually simply escaping the
file - not rendering it. This is badly named and gives the wrong
impression.

There is also unusual behaviour whether the file is called a Readme or
not and there is no way to get to the source code if the file is called
README.

In reality what should happen is different depending on whether the file
is being rendered a README at the bottom of the directory view or not.

1. If it is rendered as a README on a directory - it should simply be
escaped and rendered as `<pre>` text.
2. If it is rendered as a file then it should be rendered as source
code.

This PR therefore does:
1. Rename IsRenderedHTML to IsPlainText
2. Readme files rendered at the bottom of the directory are rendered
without line numbers
3. Otherwise plain text files are rendered as source code.

Replace #21841

Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-12-17 22:22:25 +02:00
Meisam f3370eeaee
verify nodeinfo response by schema (#22137)
... using
[github.com/xeipuuv/gojsonschema](https://github.com/xeipuuv/gojsonschema)

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-17 01:22:34 -05:00
silverwind c4c4151f7d
Fix margin and alignment in dashboard repolist (#22120)
Seems this has recently regressed, previously, there was a significant
whitespace between icon and text, but it seems to be gone, so I added
the margin and also vertically aligned the icon because it was slightly
misaligned.

Before:
<img width="419" alt="Screenshot 2022-12-13 at 20 03 51"
src="https://user-images.githubusercontent.com/115237/207422938-7c45110c-f73e-4344-afc8-c072266d1f95.png">

After:
<img width="419" alt="image"
src="https://user-images.githubusercontent.com/115237/207447579-95525405-574d-4ca8-84ba-d8a9af50015a.png">

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
2022-12-17 09:58:57 +08:00
Xinyu Zhou 84001467bd
Update username (#22147)
update my email & username
2022-12-16 15:11:03 +02:00
Christian Ullrich 84285a1169
Do not list active repositories as unadopted (#22034)
This fixes a bug where, when searching unadopted repositories, active
repositories will be listed as well. This is because the size of the
array of repository names to check is larger by one than the
`IterateBufferSize`.

For an `IterateBufferSize` of 50, the original code will pass 51
repository names but set the query to `LIMIT 50`. If all repositories in
the query are active (i.e. not unadopted) one of them will be omitted
from the result. Due to the `ORDER BY` clause it will be the oldest (or
least recently modified) one.

Bug found in 1.17.3.

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-12-16 16:58:56 +08:00
zeripath 651fe4bb7d
Add doctor command for full GC of LFS (#21978)
The recent PR adding orphaned checks to the LFS storage is not
sufficient to completely GC LFS, as it is possible for LFSMetaObjects to
remain associated with repos but still need to be garbage collected.

Imagine a situation where a branch is uploaded containing LFS files but
that branch is later completely deleted. The LFSMetaObjects will remain
associated with the Repository but the Repository will no longer contain
any pointers to the object.

This PR adds a second doctor command to perform a full GC.

Signed-off-by: Andrew Thornton <art27@cantab.net>
2022-12-15 20:44:16 +00:00
silentcodeg 3243dbe1a9
remove silentcode from MAINTAINERS (#22143)
Signed-off-by: silentcode <silentcode@senga.org>
2022-12-15 09:41:38 -06:00
Nathaniel Sabanski ae97197404
Fixed Project view .board-column height for tall screens. (#22108)
This bug occurs because we are calculating `.board-column` height
strictly off of `vh`, when the layout header is of static height.

BEFORE


https://user-images.githubusercontent.com/24665/206991060-372c24e3-986e-4fc6-9fc8-aab8b4ef09bb.mp4


AFTER


https://user-images.githubusercontent.com/24665/206991070-91b7cbab-d807-4016-8696-e43bdaf8a7ff.mp4
2022-12-14 21:14:50 +00:00
zeripath cdc43454a4
Correctly handle moved files in apply patch (#22118)
Moved files in a patch will result in git apply returning:

```
error: {filename}: No such file or directory
```

This wasn't handled by the git apply patch code. This PR adds handling
for this.

Fix #22083

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-14 21:45:33 +08:00
Lunny Xiao 1b32ed014a
remove duplicated read file code (#22042)
Merge the duplicated read file code as one function in reading text file
and readme file.
2022-12-14 18:11:11 +08:00
KN4CK3R 07461e18d3
Fix condition for is_internal (#22095)
depends on #22094

Fixes https://codeberg.org/forgejo/forgejo/issues/77

The old logic did not consider `is_internal`.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-14 17:16:01 +08:00
zeripath 4fb2006ca1
Make gitea work using cmd.exe again (#22073)
Gitea will attempt to lookup its location using LookPath however, this
fails on cmd.exe if gitea is in the current working directory.

exec.LookPath will return an exec.ErrDot error which we can test for and
then simply using filepath.Abs(os.Args[0]) to absolute gitea against the
current working directory.

Fix #22063

Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2022-12-14 01:15:11 -05:00
Yakov5776 5aa854693f
Fix markdown typo of an extra backtick in docs (#22123)
Fixes a visual bug in docs which is caused by a typo of an extra backtick.
2022-12-13 18:20:36 -06:00
Chongyi Zheng a95247b7df
Fix autofilled text visibility in dark mode (#22088)
Fixes #22087
2022-12-13 19:06:23 +08:00
Lunny Xiao 87c64f655a
Fix permission check on issue/pull lock (#22110)
Fix #21826
2022-12-12 23:02:51 +08:00
Lunny Xiao 36a2d2f919
Add a simple test for external renderer (#20033)
Fix #16402
2022-12-12 20:45:21 +08:00