3513 Commits

Author	SHA1	Message	Date
Jason Song	3dbd2d942b	Remove old HookEventType (#22358) ... Supplement to #22256.	2023-01-06 19:49:14 +08:00
Lunny Xiao	fdbb0b4762	fix gravatar disable bug (#22336)	2023-01-04 16:19:56 +08:00
Lunny Xiao	a1c30740bb	Fix get system setting bug when enabled redis cache (#22295) ... Fix #22281 In #21621 , `Get[V]` and `Set[V]` has been introduced, so that cache value will be `*Setting`. For memory cache it's OK. But for redis cache, it can only store `string` for the current implementation. This PR revert some of changes of that and just store or return a `string` for system setting.	2023-01-02 00:06:52 +08:00
delvh	0f4e1b9ac6	Restructure webhook module (#22256) ... Previously, there was an `import services/webhooks` inside `modules/notification/webhook`. This import was removed (after fighting against many import cycles). Additionally, `modules/notification/webhook` was moved to `modules/webhook`, and a few structs/constants were extracted from `models/webhooks` to `modules/webhook`. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2023-01-01 23:23:15 +08:00
Lunny Xiao	9c8fc7f677	Fix bug of DisableGravatar default value (#22296) ... #18058 made a mistake. The disableGravatar's default value depends on `OfflineMode`. If it's `true`, then `disableGravatar` is true, otherwise it's `false`. But not opposite. Co-authored-by: KN4CK3R <admin@oldschoolhack.me>	2023-01-01 20:19:23 +08:00
KN4CK3R	3fef47b41c	Use ErrInvalidArgument in packages (#22268) ... Related to https://github.com/go-gitea/gitea/pull/22262#discussion_r1059010774 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv>	2022-12-31 12:49:37 +01:00
Jason Song	e5deeda0aa	Support estimated count with multiple schemas (#22276) ... The `EstimateCount` could be incorrect when the table lives in multiple schemas. Related to #19775.	2022-12-30 12:25:58 -06:00
Gusted	b76970f2e4	Fix key signature error page (#22229) ... - When the GPG key contains an error, such as an invalid signature or an email address that does not match the user.A page will be shown that says you must provide a signature for the token. - This page had two errors: one had the wrong translation key and the other tried to use an undefined variable [`.PaddedKeyID`](e81ccc406b/models/asymkey/gpg_key.go (L65-L72)), which is a function implemented on the `GPGKey` struct, given that we don't have that, we use [`KeyID`](e81ccc406b/routers/web/user/setting/keys.go (L102)) which is [the fingerprint of the publickey](https://pkg.go.dev/golang.org/x/crypto/openpgp/packet#PublicKey.KeyIdString) and is a valid way for opengpg to refer to a key. Before:  After:  Co-authored-by: zeripath <art27@cantab.net>	2022-12-30 12:53:05 +08:00
Xinyu Zhou	7cc7db73b9	Add option to prohibit fork if user reached maximum limit of repositories (#21848) ... If user has reached the maximum limit of repositories: - Before - disallow create - allow fork without limit - This patch: - disallow create - disallow fork - Add option `ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT` (Default **true**) : enable this allow user fork repositories without maximum number limit fixed https://github.com/go-gitea/gitea/issues/21847 Signed-off-by: Xinyu Zhou <i@sourcehut.net>	2022-12-27 15:21:14 -06:00
Jason Song	6cf09ccab4	Use complete SHA to create and query commit status (#22244) ... Fix #13485. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-12-27 21:12:49 +08:00
Jason Song	71ca3067bc	Check primary keys for all tables and drop ForeignReference (#21721) ... Some dbs require that all tables have primary keys, see - #16802 - #21086 We can add a test to keep it from being broken again. Edit: ~Added missing primary key for `ForeignReference`~ Dropped the `ForeignReference` table to satisfy the check, so it closes #21086. More context can be found in comments. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: zeripath <art27@cantab.net>	2022-12-23 19:35:43 +08:00
Nick	a2779def36	Test views of LFS files (#22196)	2022-12-23 07:41:56 +08:00
Jason Song	659055138b	Secrets storage with SecretKey encrypted (#22142) ... Fork of #14483, but [gave up MasterKey](https://github.com/go-gitea/gitea/pull/14483#issuecomment-1350728557), and fixed some problems. Close #12065. Needed by #13539. Featrues: - Secrets for repo and org, not user yet. - Use SecretKey to encrypte/encrypt secrets. - Trim spaces of secret value. - Add a new locale ini block, to make it easy to support secrets for user. Snapshots: Repo level secrets:  Rrg level secrets  Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>	2022-12-20 17:07:13 +08:00
zeripath	651fe4bb7d	Add doctor command for full GC of LFS (#21978) ... The recent PR adding orphaned checks to the LFS storage is not sufficient to completely GC LFS, as it is possible for LFSMetaObjects to remain associated with repos but still need to be garbage collected. Imagine a situation where a branch is uploaded containing LFS files but that branch is later completely deleted. The LFSMetaObjects will remain associated with the Repository but the Repository will no longer contain any pointers to the object. This PR adds a second doctor command to perform a full GC. Signed-off-by: Andrew Thornton <art27@cantab.net>	2022-12-15 20:44:16 +00:00
KN4CK3R	07461e18d3	Fix condition for is_internal (#22095) ... depends on #22094 Fixes https://codeberg.org/forgejo/forgejo/issues/77 The old logic did not consider `is_internal`. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>	2022-12-14 17:16:01 +08:00
Lunny Xiao	36a2d2f919	Add a simple test for external renderer (#20033) ... Fix #16402	2022-12-12 20:45:21 +08:00
KN4CK3R	0e2d04601a	Update xorm (#22094)	2022-12-10 18:53:32 -05:00
Lunny Xiao	68704532c2	Rename almost all Ctx functions (#22071)	2022-12-10 10:46:31 +08:00
KN4CK3R	3c59d31bc6	Add API management for issue/pull and comment attachments (#21783) ... Close #14601 Fix #3690 Revive of #14601. Updated to current code, cleanup and added more read/write checks. Signed-off-by: Andrew Thornton <art27@cantab.net> Signed-off-by: Andre Bruch <ab@andrebruch.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Norwin <git@nroo.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-12-09 14:35:56 +08:00
silverwind	0585ac3ac6	Update go dev dependencies (#22064) ... `golangci-lint` [deprecated](https://github.com/golangci/golangci-lint/issues/1841) a bunch of linters, removed them.	2022-12-08 16:21:37 +08:00
hr-98	cf27403e18	Round language stats percentage using largest remainder (#22026) ... Fix #22023 I've changed how the percentages for the language statistics are rounded because they did not always add up to 100% Now it's done with the largest remainder method, which makes sure that total is 100% Co-authored-by: Lauris BH <lauris@nix.lv>	2022-12-08 10:47:47 +08:00
Jason Song	74874d065f	Fix issue/PR numbers (#22037) ... When deleting a closed issue, we should update both `NumIssues`and `NumClosedIssues`, or `NumOpenIssues`(`= NumIssues -NumClosedIssues`) will be wrong. It's the same for pull requests. Releated to #21557. Alse fixed two harmless problems: - The SQL to check issue/PR total numbers is wrong, that means it will update the numbers even if they are correct. - Replace legacy `num_issues = num_issues + 1` operations with `UpdateRepoIssueNumbers`.	2022-12-06 15:53:09 +08:00
zeripath	ea86c2b56a	Use GhostUser if needed for TrackedTimes (#22021) ... When getting tracked times out of the db and loading their attributes handle not exist errors in a nicer way. (Also prevent an NPE.) Fix #22006 Signed-off-by: Andrew Thornton <art27@cantab.net>	2022-12-04 17:48:18 +00:00
Lunny Xiao	0a7d3ff786	refactor some functions to support ctx as first parameter (#21878) ... Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>	2022-12-03 10:48:26 +08:00
Jason Song	f59a74852b	Update gitea-vet to check FSFE REUSE (#22004) ... Related to: - #21840 - https://gitea.com/gitea/gitea-vet/pulls/21 What it looks like when it's working: https://drone.gitea.io/go-gitea/gitea/64040/1/5 All available SPDX license identifiers: [SPDX License List](https://spdx.org/licenses/). Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-12-02 22:14:57 +08:00
Lunny Xiao	f7ade6de7c	Fix generate index failure possibility on postgres (#21998) ... @wxiaoguang Please review Co-authored-by: silverwind <me@silverwind.io>	2022-12-02 11:15:36 +08:00
Lunny Xiao	b2c4870481	Fix parallel creating commit status bug with tests (#21911) ... This PR is a follow up of #21469 Co-authored-by: Lauris BH <lauris@nix.lv>	2022-12-01 00:41:49 +08:00
Jason Song	f047ee0a40	Use random bytes to generate access token (#21959)	2022-11-28 23:37:42 +08:00
Jason Song	9607750b5e	Replace fmt.Sprintf with hex.EncodeToString (#21960) ... `hex.EncodeToString` has better performance than `fmt.Sprintf("%x", []byte)`, we should use it as much as possible. I'm not an extreme fan of performance, so I think there are some exceptions: - `fmt.Sprintf("%x", func(...)[N]byte())` - We can't slice the function return value directly, and it's not worth adding lines. ```diff func A()[20]byte { ... } - a := fmt.Sprintf("%x", A()) - a := hex.EncodeToString(A()[:]) // invalid + tmp := A() + a := hex.EncodeToString(tmp[:]) ``` - `fmt.Sprintf("%X", []byte)` - `strings.ToUpper(hex.EncodeToString(bytes))` has even worse performance.	2022-11-28 11:19:18 +00:00
flynnnnnnnnnn	e81ccc406b	Implement FSFE REUSE for golang files (#21840) ... Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>	2022-11-27 18:20:29 +00:00
Jason Song	702f4b521e	Add index for access_token (#21908) ... The `token_last_eight` field has been used in `GetAccessTokenBySHA `:	2022-11-23 20:49:41 -06:00
Xinyu Zhou	e483ec3a00	Fix vertical align of committer avatar rendered by email address (#21884) ... Committer avatar rendered by `func AvatarByEmail` are not vertical align as `func Avatar` does. - Replace literals `ui avatar` and `ui avatar vm` with the constant `DefaultAvatarClass`	2022-11-23 15:57:37 -06:00
zeripath	787f6c3227	Ensure that Webhook tasks are not double delivered (#21558) ... When re-retrieving hook tasks from the DB double check if they have not been delivered in the meantime. Further ensure that tasks are marked as delivered when they are being delivered. In addition: * Improve the error reporting and make sure that the webhook task population script runs in a separate goroutine. * Only get hook task IDs out of the DB instead of the whole task when repopulating the queue * When repopulating the queue make the DB request paged Ref #17940 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-23 22:10:04 +08:00
zeripath	4c00d8f916	Move migration test fixtures to the correct directories (#21901) ... Unfortunately #21549 changed the name of Testcases without changing their associated fixture directories. Fix #21854 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-23 18:24:55 +08:00
KN4CK3R	32db62515f	Add package registry cleanup rules (#21658) ... Fixes #20514 Fixes #20766 Fixes #20631 This PR adds Cleanup Rules for the package registry. This allows to delete unneeded packages automatically. Cleanup rules can be set up from the user or org settings. Please have a look at the documentation because I'm not a native english speaker. Rule Form  Rule List  Rule Preview  Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-20 16:08:38 +02:00
KN4CK3R	044c754ea5	Add context.Context to more methods (#21546) ... This PR adds a context parameter to a bunch of methods. Some helper `xxxCtx()` methods got replaced with the normal name now. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-19 16:12:33 +08:00
Gusted	20385b52a3	Prevent dangling user redirects (#21856) ... - It's possible that the `user_redirect` table contains a user id that no longer exists. - Delete a user redirect upon deleting the user. - Add a check for these dangling user redirects to check-db-consistency.	2022-11-18 22:23:34 +08:00
KN4CK3R	88d5275614	Do not allow Ghost access to limited visible user/org (#21849) ... The Ghost user should not be allowed to have access to a limited visible user/org. Co-authored-by: Lauris BH <lauris@nix.lv>	2022-11-17 14:29:33 -05:00
zeripath	c772934ff6	Adjust gitea doctor --run storages to check all storage types (#21785) ... The doctor check `storages` currently only checks the attachment storage. This PR adds some basic garbage collection functionality for the other types of storage. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-15 16:08:59 +08:00
Lunny Xiao	34283a74e8	Allow detect whether it's in a database transaction for a context.Context (#21756) ... Fix #19513 This PR introduce a new db method `InTransaction(context.Context)`, and also builtin check on `db.TxContext` and `db.WithTx`. There is also a new method `db.AutoTx` has been introduced but could be used by other PRs. `WithTx` will always open a new transaction, if a transaction exist in context, return an error. `AutoTx` will try to open a new transaction if no transaction exist in context. That means it will always enter a transaction if there is no error. Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: 6543 <6543@obermui.de>	2022-11-12 21:18:50 +01:00
wxiaoguang	92525ddffd	Init git module before database migration (#21764) ... Close #21761 Some database migrations depend on the git module.	2022-11-10 14:22:39 +00:00
Lunny Xiao	385462d36c	Fix dashboard ignored system setting cache (#21621) ... This is a performance regression from #18058 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>	2022-11-10 14:43:53 +08:00
KN4CK3R	20674dd05d	Add package registry quota limits (#21584) ... Related #20471 This PR adds global quota limits for the package registry. Settings for individual users/orgs can be added in a seperate PR using the settings table. Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-09 14:34:27 +08:00
Lunny Xiao	91c7a3e66f	Fix tests on migrations (#21705)	2022-11-08 12:07:46 +08:00
wxiaoguang	2900dc90a7	Improve valid user name check (#20136) ... Close https://github.com/go-gitea/gitea/issues/21640 Before: Gitea can create users like ".xxx" or "x..y", which is not ideal, it's already a consensus that dot filenames have special meanings, and `a..b` is a confusing name when doing cross repo compare. After: stricter Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>	2022-11-04 17:04:08 +08:00
oliverpool	b6e81357bd	Add Webhook authorization header (#20926) ... _This is a different approach to #20267, I took the liberty of adapting some parts, see below_ ## Context In some cases, a weebhook endpoint requires some kind of authentication. The usual way is by sending a static `Authorization` header, with a given token. For instance: - Matrix expects a `Bearer <token>` (already implemented, by storing the header cleartext in the metadata - which is buggy on retry #19872) - TeamCity #18667 - Gitea instances #20267 - SourceHut https://man.sr.ht/graphql.md#authentication-strategies (this is my actual personal need :) ## Proposed solution Add a dedicated encrypt column to the webhook table (instead of storing it as meta as proposed in #20267), so that it gets available for all present and future hook types (especially the custom ones #19307). This would also solve the buggy matrix retry #19872. As a first step, I would recommend focusing on the backend logic and improve the frontend at a later stage. For now the UI is a simple `Authorization` field (which could be later customized with `Bearer` and `Basic` switches):  The header name is hard-coded, since I couldn't fine any usecase justifying otherwise. ## Questions - What do you think of this approach? @justusbunsi @Gusted @silverwind - ~~How are the migrations generated? Do I have to manually create a new file, or is there a command for that?~~ - ~~I started adding it to the API: should I complete it or should I drop it? (I don't know how much the API is actually used)~~ ## Done as well: - add a migration for the existing matrix webhooks and remove the `Authorization` logic there _Closes #19872_ Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: delvh <dev.lh@web.de>	2022-11-03 20:23:20 +02:00
kolaente	085f717529	feat: notify doers of a merge when automerging (#21553) ... I found myself wondering whether a PR I scheduled for automerge was actually merged. It was, but I didn't receive a mail notification for it - that makes sense considering I am the doer and usually don't want to receive such notifications. But ideally I want to receive a notification when a PR was merged because I scheduled it for automerge. This PR implements exactly that. The implementation works, but I wonder if there's a way to avoid passing the "This PR was automerged" state down so much. I tried solving this via the database (checking if there's an automerge scheduled for this PR when sending the notification) but that did not work reliably, probably because sending the notification happens async and the entry might have already been deleted. My implementation might be the most straightforward but maybe not the most elegant. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2022-11-03 23:49:00 +08:00
KN4CK3R	f8f859b8fa	Alter package_version.metadata_json to LONGTEXT (#21667)	2022-11-03 15:28:46 +08:00
Lunny Xiao	e72acd5e5b	Split migrations folder (#21549) ... There are too many files in `models/migrations` folder so that I split them into sub folders.	2022-11-02 16:54:36 +08:00
Lunny Xiao	9a70a12a34	Merge db.Iterate and IterateObjects (#21641) ... These two functions are similiar, merge them.	2022-10-31 23:51:14 +08:00