mirror/ gitea
1
1
Fork 1
mirror of https://github.com/go-gitea/gitea.git synced 2024-05-28 23:26:13 +02:00
Code Issues
11,163 Commits 17 Branches 211 Tags 578 MiB
Commit Graph

2835 Commits

Author SHA1 Message Date
Lauris BH 044cd4d016
Add reverse proxy configuration support for remote IP address (#14959) 
* Add reverse proxy configuration support for remote IP address validation

* Trust all IP addresses in containerized environments by default

* Use single option to specify networks and proxy IP addresses. By default trust all loopback IPs

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-03-16 00:27:28 +02:00
zeripath 6e423d5573
Ensure validation occurs on clone addresses too (#14994) 
* Ensure validation occurs on clone addresses too

Fix #14984

Signed-off-by: Andrew Thornton <art27@cantab.net>

* fix lint

Signed-off-by: Andrew Thornton <art27@cantab.net>

* fix test

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Fix api tests

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-03-15 17:52:11 -04:00
Norwin 658d1bfac8
API: fix set milestone on PR creation (#14981) 
* API: fix set milestone on PR creation

pr creation via API failed with 404, because we searched
for milestoneID 0, due to uninitialized var usage D:

* add tests

* fix expected status codes

* fix tests

Co-authored-by: 6543 <6543@obermui.de>
 2021-03-13 19:06:52 +01:00
zeripath 91ee3be588
Prevent incorrect HTML escaping in swagger.json (#14957) 
* Prevent incorrect HTML escaping in swagger.json

Fix #14706

Signed-off-by: Andrew Thornton <art27@cantab.net>

* oops add it to the helper

Signed-off-by: Andrew Thornton <art27@cantab.net>

* try again

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-03-11 23:43:04 -05:00
Norwin df76d9f7ad
Show correct issues for team dashboard (#14952) 
* fix no items under /org/$org/{issues,pulls}?type=mentioned

it was filtering by org id, but org-mentions are not persisted like that
to the DB, we need to filter by UID.
This means, selecting different teams will only have an effect on the
selected repos, otherwise results will be the same, which may be
suboptimal.

fixes #14941

* don't spam a warning for a perfectly fine request
 2021-03-12 04:06:33 +01:00
zeripath 5705f72fd6
Prevent panic when editing forked repos by API (#14960) 
When editing forked repos using the API the BaseRepository needs to loaded
in order to check its visibility otherwise there will be NPE panic.

Fix #14956

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-03-11 19:09:52 +01:00
zeripath c8e5c79cfd
Add ui.explore settings to control view of explore pages (2) (#14094) 
This is an alternative PR to #13687.

Add `[ui.explore]` settings to allow restricting the
explore pages to logged in users only and to disable the users explore page.

The two proposed settings are:

- `REQUIRE_SIGNIN_VIEW`: Only allows access to the explore pages if the
user is signed in. Also restricts
  - `/api/v1/user/search`
  - `/api/v1/users/{username}`
  - `/api/v1/users/{username}/repos`
  - but does not restrict `/api/v1/users/{username}/heatmap`
- `DISABLE_USERS_PAGE`: Disables the /explore/users page

Fix #2908

Close #13687 

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
 2021-03-11 13:40:54 +00:00
KN4CK3R 40aca73347
Fix migration context data (#14910) 
* Unified context data.

* Changed method name.
 2021-03-07 20:21:09 +01:00
zeripath 9b261f52f0
Add SameSite setting for cookies (#14900) 
Add SameSite setting for cookies and rationalise the cookie setting code. Switches SameSite to Lax by default. 

There is a possible future extension of differentiating which cookies could be set at Strict by default but that is for a future PR.

Fix #5583

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-03-07 08:12:43 +00:00
Lunny Xiao 9db590f2ee
Fix bug when combine label comments (#14894) 
* Fix bug when combine label comments

* Added some code comments

* More comments
 2021-03-05 16:17:32 +01:00
Norwin 0a8a3ab0f5
Show private heatmap on profile to self & admins (#14881) 
followup to #14080
 2021-03-04 23:59:13 +01:00
a1012112796 a5279b74b6
Make manual merge autodetection optional and add manual merge as merge method (#12543) 
* Make auto check manual merge as a chooseable mod and add manual merge way on ui

as title, Before this pr, we use same way with GH to check manually merge.
It good, but in some special cases, misjudgments can occur. and it's hard
to fix this bug. So I add option to allow repo manager block "auto check manual merge"
function, Then it will have same style like gitlab(allow empty pr). and to compensate for
not being able to detect THE PR merge automatically, I added a manual approach.

Signed-off-by: a1012112796 <1012112796@qq.com>

* make swager

* api support

* ping ci

* fix TestPullCreate_EmptyChangesWithCommits

* Apply suggestions from code review

Co-authored-by: zeripath <art27@cantab.net>

* Apply review suggestions and add test

* Apply suggestions from code review

Co-authored-by: zeripath <art27@cantab.net>

* fix build

* test error message

* make fmt

* Fix indentation issues identified by @silverwind

Co-authored-by: silverwind <me@silverwind.io>

* Fix tests and make manually merged disabled error on API the same

Signed-off-by: Andrew Thornton <art27@cantab.net>

* a small nit

* fix wrong commit id error

* fix bug

* simple test

* fix test

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-03-03 22:41:23 -05:00
zeripath 0044e80491
Add CORS config on to /login/oauth/access_token endpoint (#14850) 
Fix #7204

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Lauris BH <lauris@nix.lv>
 2021-03-04 03:25:30 +02:00
Norwin a050de8db3
Handle urls with trailing slash (#14852) 2021-03-02 17:23:36 +01:00
zeripath f0e15250b9
Migrate to use jsoniter instead of encoding/json (#14841) 
* Migrate to use jsoniter

* fix tests

* update gitea.com/go-chi/binding

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
 2021-03-01 22:08:10 +01:00
Paweł Bogusławski 85e6e07346
Organization removal confirmation using name not password (#14738) 
* Organization removal confirmation using name not password

Gitea is asking for user password to confirm organization
removal so this operation cannot be done in systems with
SSO authentication (where no user passwords are used).

This mod changes the way gitea confirms organization
removal - user must enter organization name (not user
password) to confirm operation (similar to repository
removal confirmation).

Author-Change-Id: IB#1107219

* Translation removed

Translation removed from PR - will be restored using Crowdin
after pull got merged.

Fixes: 95ddcdd8bd
Related: https://github.com/go-gitea/gitea/pull/14738
Author-Change-Id: IB#1107219
 2021-03-01 16:33:05 +02:00
6543 a4148c0f12
Repository transfer has to be confirmed, if user can not create repo for new owner (#14792) 
* make repo as "pending transfer" if on transfer start doer has no right to create repo in new destination

* if new pending transfer ocured, create UI & Mail notifications
 2021-03-01 01:47:30 +01:00
zeripath 030646eea4
Set HCaptchaSiteKey on Link Account pages (#14834) 
When using HCaptcha on link account pages the site key needs to be passed
in. This PR ensures that HCaptchaSiteKey is set in the data.

Fix #14766

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-02-28 17:04:15 -05:00
a1012112796 83cf1a894e
Create tag on ui (#13467) 
Support create single tag directly

support create tag with message from create release ui

Signed-off-by: a1012112796 <1012112796@qq.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: zeripath <art27@cantab.net>
 2021-02-28 19:57:45 +00:00
a1012112796 5d2b7ba639
Add EasyMDE support for release content editor (#14744) 
* Add easyMDE(simpleMDE) support for release content editor

Signed-off-by: a1012112796 <1012112796@qq.com>
 2021-02-22 21:17:51 +01:00
Lunny Xiao bd9361384a
Fix go get (#14758) 
* Fix go get

* Fix default branch

Co-authored-by: 6543 <6543@obermui.de>
 2021-02-22 00:51:15 +08:00
gordon-- 343c756357
Heatmap days clickable (#13935) 
* Heatmap days clickable

* Error handling

* Unselect filter

* better dayclick handler

* made linter happy

* clickable heatmap for profiles

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-02-20 17:08:58 -05:00
6543 190bd0accd
Export LFS & TimeTracking function status (#14753) 2021-02-20 11:17:51 +01:00
zeripath aa4f9180e4
Clarify the suffices and prefixes of setting.AppSubURL and setting.AppURL (#12999) 
Also removes some unnecessary uses of fmt.Sprintf and adds documentation
strings

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-02-19 22:36:43 +01:00
Norwin d38ae597e1
Add UI to delete tracked times (#14100) 
Co-authored-by: 6543 <6543@obermui.de>
 2021-02-19 12:52:11 +02:00
zeripath 092299891f
Move the stopwatches to the eventsource stream (#14588) 
Move the stopwatches to the eventsource stream

Use the /user/events eventsource to update the stopwatches
instead of polling /api/v1/user/stopwatches if the eventsource
is enabled.

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-02-19 11:05:35 +01:00
Jacob Hrbek 867f4c557d
routers/routes/web: Fix typo in comment (#14729) 2021-02-18 22:47:23 +08:00
6543 8d5c795cc4
[API] Add Restricted Field to User (#14630) 
* Expose Restricted field for User

* Add Option to Change Restricted on User via adminEditUser API

* Add test who change restricted & test if it changed it ...

* make generate-swagger

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
 2021-02-18 16:25:35 +08:00
Jimmy Praet 4c82485424
#14699 Make branch names in PR description clickable (#14716) 2021-02-18 03:45:49 +01:00
zeripath ad43b119a8
Add Password Algorithm option to install page (#14701) 
Add Password Algorithm option to install page

Fix #14674 

Co-authored-by: John Olheiser <john.olheiser@gmail.com>
 2021-02-16 23:37:20 +01:00
zeripath 66a148e398
Restore detection of branches are equal on compare page (#14586) 
Somehow the test for detecting if branches are equal broke
this PR restores this functionality.

Fix #14502

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-02-16 16:39:45 +01:00
Damien Goutte-Gattat fc4a8c2980
Allow blocking some email domains from registering an account (#14667) 
Gitea allows to whitelist email domains so that only email addresses from certain domains are allowed to register an account, but does not currently allows to do the opposite: blacklisting email domains so that addresses from certain domains are *forbidden* to register an account.

The idea has been briefly mentioned in the discussion about issue #6350, but never implemented. This PR does that.

The rationale is that, in my experience of running a Gitea instance, *a single email domain* is responsible for *most* of the spam accounts, and for *all* of the spam accounts that manage to get past the email confirmation step. So on top of the other spam mitigation measures already available (email confirmation, CAPTCHA, etc.), having the option to block a particularly annoying domain would be helpful.

close #13628
 2021-02-15 00:31:29 +01:00
vnkmpf 487f2ee41c
Whitespace in commits (#14650) 
* Add whitespace to commit view

* Add whitespace to /compare/a...b

* Move repeated whitespaceFlags to gitdiff

* Add whitespace for wiki pages
 2021-02-13 05:35:43 +01:00
techknowlogick a3cc842e15
Show Gitea version in swagger (#14654) 
Show Gitea version in swagger

Co-authored-by: 6543 <6543@obermui.de>
 2021-02-12 21:51:56 +01:00
Anton Khimich 5a18712dd7
Fix PATCH /repos/{owner}/{repo} panic (#14637) 
* Fix a runtime error when modifying a repository through API call

Using the `PATCH /repos/{owner}/{repo}` endpoint and attempting to
modify `default_branch` on an empty repository will cause a
panic. This commit adds a check for a nil pointer before attempting
to dereference it.

* Apply suggestions from code review

* Apply suggestions from code review

* Ensure that the git repository is loaded

If you change the default branch for a repository you must change it in
git too. Therefore you must open the repository before changing the
default branch.

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Allow empty repos to have their default branches changed

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Anton Khimich <anton.khimicha@mail.utoronto.ca>
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Andrew Thornton <art27@cantab.net>
 2021-02-11 20:53:41 +01:00
Paweł Bogusławski 7d7007dca7
Added option to disable webhooks (#13176) 
* Added option to disable web hooks

This mod introduces DISABLE_WEB_HOOKS parameter in [security] section
of app.ini (by default set to false). If set to true it disables web
hooks feature. Any existing undelivered web hook tasks will be cancelled.
Any existing web hook definitions will be left untouched in db but
its delivery tasks will be ignored.

Author-Change-Id: IB#1105130

* Webhook spelling fixed

Webhook spelling fixed.

Fixes: 07df6614dc
Related: https://github.com/go-gitea/gitea/pull/13176#pullrequestreview-510868421
Author-Change-Id: IB#1105174

* Parameter description fixed

Parameter description fixed.

Fixes: 07df6614dc
Related: https://github.com/go-gitea/gitea/pull/13176#pullrequestreview-514086107
Author-Change-Id: IB#1105174
 2021-02-11 12:34:34 -05:00
a1012112796 ac701637b4
Add dismiss review feature (#12674) 
* Add dismiss review feature

refs:
    https://github.blog/2016-10-12-dismissing-reviews-on-pull-requests/
    https://developer.github.com/v3/pulls/reviews/#dismiss-a-review-for-a-pull-request

* change modal ui and error message

* Add unDismissReview api

Signed-off-by: a1012112796 <1012112796@qq.com>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
 2021-02-11 18:32:25 +01:00
Romain c69c01d2b6
Sort / Move project boards (#14634) 
Sort Project board (#14533)
 2021-02-11 17:32:27 +01:00
zeripath 4cffc46f65
Allow org labels to be set with issue templates (#14593) 
Fix #13688

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-02-10 17:18:22 +00:00
zeripath f82b1dd7c3
Prevent adding nil label to .AddedLabels or .RemovedLabels (#14623) 
* Prevent adding nil label to .AddedLabels or .RemovedLabels

There are possibly a few old databases out there with malmigrated data that can
cause panics with empty labels being migrated.

This PR adds a few tests to prevent nil labels being added.

Fix #14466

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Add doctor command to remove the broken label comments

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: 6543 <6543@obermui.de>
 2021-02-10 10:50:44 +08:00
zeripath 30f7ddb833
Ensure memcache TTL cannot be over 30 days (#14592) 
Memcached TTL cannot be > 30 days and if it is attempted the TTL is interpreted as
a unix timestamp.

This PR ensures that the TTL is switched to a unix timestamp in those cases.

Fix #14571

Signed-off-by: Andrew Thornton <art27@cantab.net>
 2021-02-09 22:29:03 +00:00
zeripath b337c606d3
Add support for ref parameter to get raw file API (#14602) 
Fix #14597

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
 2021-02-09 01:15:47 +01:00
6543 5f248d0df2
[API] Add delete release by tag & fix unreleased inconsistency (#14563) 
* DeleteReleaseByTag delete release not git tags

* Add api to delete tag (without release)

* fix & extend tests

* fix swagger doc
 2021-02-07 19:32:18 +01:00
Farid AYOUJIL f72ce26326
Add Content-Length header to HEAD requests (#14542) 
* Add Content-Length header to HEAD requests

This change adds the header Content-Length to HEAD HTTP requests.

The previous behaviour was blocking some Windows executables (i.e
bitsadmin.exe) from downloading files hosted in Gitea.

This along with PR #14541, makes the web server compliant with HTTP RFC 2616 which states
"The methods GET and HEAD MUST be supported by all general-purpose servers"
and
"The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response."

This should also respond to issues #8030 and #14532.

* This change adds the header Content-Length to HEAD HTTP requests

Pass the Size of the content as a parameter to ServeData() instead of
calculating it using ioutil.ReadAll(reader) --> this call is dangerous
and can result in a denial of service.

* Add Content-Length header to HEAD requests

Quick fix for imported dependency not used.

* Check if size is positiv int ...

Co-authored-by: zeripath <art27@cantab.net>
 2021-02-05 21:10:40 +01:00
Michel Ganguin 4457d0e8d9
Honor REGISTER_MANUAL_CONFIRM when doing openid registration (#14548) 
REGISTER_MANUAL_CONFIRM is not honored when doing performing an openid registration. The new account is directly accessible.

With this patch, the manual confirm flag gets honored in the same way as a "normal" registration.
 2021-02-05 04:03:20 +01:00
Lunny Xiao 32c4563d8d
Fix lfs file viewer (#14568) 2021-02-05 02:29:42 +01:00
Lunny Xiao 3537d80088
Fix bug about ListOptions and stars/watchers pagnation (#14556) 
* Fix bug about ListOptions and stars/watchers pagnation

* fix unit test

Co-authored-by: 6543 <6543@obermui.de>
 2021-02-04 11:23:46 -06:00
Cameron Braid 3c965c3e30
[API] GetRelease by tag only return release (#14397) 
get release by tag should filter out tag releases to be consistent with list releases and get by id

Co-authored-by: 6543 <6543@obermui.de>
 2021-02-04 04:12:25 +01:00
6543 0d1444751f
[API] Add pagination to ListBranches (#14524) 
* make PaginateUserSlice generic -> PaginateSlice

* Add pagination to ListBranches

* add skip, limit to Repository.GetBranches()

* Move routers/api/v1/utils/utils PaginateSlice -> modules/util/paginate.go

* repo_module.GetBranches paginate

* fix & rename & more logging

* better description

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: a1012112796 <1012112796@qq.com>
 2021-02-03 20:06:13 +01:00
Farid AYOUJIL 1737a76e1f
Adding Chi's GetHead middleware (#14541) 
Before moving to Chi, HEAD requests were automatically answered by GET
handlers (SetAutoHead(true) from macaron was used).

This Change will restore the previous behaviour.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
 2021-02-02 10:53:42 +02:00