- Backport of #2489
- If the user is searching repositories with an specific topic, adding
any other filter option, such as showing unrelevant repositories or
using another sort Forgejo should remember that 'topic only' was set.
- Adds integration test.
- Resolves#2461
(cherry picked from commit b4360d504c)
- It's possible for reviews to not be assiocated with users, when they
were migrated from another forge instance. In the migration code,
there's no sanitization check for author names, so they could contain
HTML tags and thus needs to be properely escaped.
- Pass `$reviewerName` trough `Escape`.
- On the wiki and revisions page, information is shown about the last
commit that modified that wiki page. This includes the time it was last
edited and by whom. That whole string is not being sanitized (passed
trough `Safe` in the templates), because the last edited bit is
formatted as an HTML element and thus shouldn't be sanitized. The
problem with this is that now `.Author.Name` is not being sanitized.
- This can be exploited, the names of authors and commiters on a Git
commit is user controlled, they can be any value and thus also include
HTML. It's not easy to actually exploit this, as you cannot use the
official git binary to do use, as they actually strip `<` and `>` from
user names (trivia: this behaviour was introduced in the initial commit
of Git). In the integration testing, go-git actually has to generate
this commit as they don't have such restrictions.
- Pass `.Author.Name` trough `Escape` in order to be sanitized.
- Backport of #1805
- https://codeberg.org/forgejo/forgejo/pulls/1473 made that dangerous
actions such as deletion also would need to type in the owner's name.
This was apparently not reflected to the deletion modal for migrations
that failed or were cancelled.
- Resolves#2404
(cherry picked from commit c38dbd6f889aeb52745eddb276225acd0153cba6)
Follow-up of #2282 and #2296 (which tried to address #2278)
One of the issue with the previous PR is that when a conversation on the Files tab was marked as "resolved", it would fetch all the comments for that line (even the outdated ones, which should not be shown on this page - except when explicitly activated).
To properly fix this, I have changed `FetchCodeCommentsByLine` to `FetchCodeConversation`. Its role is to fetch all comments related to a given (review, path, line) and reverted my changes in the template (which were based on a misunderstanding).
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2306
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
Backport #28935 by @silverwind
The `ToUTF8*` functions were stripping BOM, while BOM is actually valid
in UTF8, so the stripping must be optional depending on use case. This
does:
- Add a options struct to all `ToUTF8*` functions, that by default will
strip BOM to preserve existing behaviour
- Remove `ToUTF8` function, it was dead code
- Rename `ToUTF8WithErr` to `ToUTF8`
- Preserve BOM in Monaco Editor
- Remove a unnecessary newline in the textarea value. Browsers did
ignore it, it seems but it's better not to rely on this behaviour.
Fixes: https://github.com/go-gitea/gitea/issues/28743
Related: https://github.com/go-gitea/gitea/issues/6716 which seems to
have once introduced a mechanism that strips and re-adds the BOM, but
from what I can tell, this mechanism was removed at some point after
that PR.
Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit b8e6cffd317401d980600e339eb21b15b9bc64c1)
Backport #26745Fixes#26548
This PR refactors the rendering of markup links. The old code uses
`strings.Replace` to change some urls while the new code uses more
context to decide which link should be generated.
The added tests should ensure the same output for the old and new
behaviour (besides the bug).
We may need to refactor the rendering a bit more to make it clear how
the different helper methods render the input string. There are lots of
options (resolve links / images / mentions / git hashes / emojis / ...)
but you don't really know what helper uses which options. For example,
we currently support images in the user description which should not be
allowed I think:
<details>
<summary>Profile</summary>
https://try.gitea.io/KN4CK3R
</details>
(cherry picked from commit 022552d5b6adc792d3cd16df7de6e52cb7b41a72)
Backport #28588 by @yardenshoham
It included the hours, minutes, and seconds. By removing these, the date
renders correctly.
Signed-off-by: Yarden Shoham <git@yardenshoham.com>
Co-authored-by: Yarden Shoham <git@yardenshoham.com>
(cherry picked from commit 564068aa99be42d18e10247deb458d21b13f1a19)
- Backport of #2100
- Make the reference URL in the "Reference in New issue" feature
absolute again as it wouldn't render as a link otherwise.
- Adds integration test.
- Regression by 769be877f2
- Resolves#2012
(cherry picked from commit c74bae28973092eeeaf2fb9a17cbe41d286648db)
- Backport of #2094
- It's possible that `PageIsDiff` is set but not `Commit` resulting in a
NPE in the template. This can happen when the requested commit doesn't exist.
- Regression of c802c46a9b &
5743d7cb5b
- Added 'hacky' integration test.
(cherry picked from commit 8db2d5e4a76f05b34e4f889e7a00ecd6578d3639)
Backport #28576 by wxiaoguang
Regression of #28454 . Now the string is escaped HTML, so it doesn't
need `| Safe`.
Fix#28575
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit acc8100d47bab3b13311bcf4c330b19e2153d4ca)
Backport #28520 by @framitdavid
There is an accessibility issue in the interface when attempting to
delete a repository. When I click on "Delete repository," a dialog box
appears, requiring confirmation to proceed with the repository deletion.
However, when I press the "Repo name" label, the wrong input field gains
focus. The focused field is located behind the dialog and is intended
for renaming the repository.
I am submitting these pull requests to ensure that the correct input
field is focused when the user clicks on the label. This change will
also facilitate the writing of tests using Playwright or Testing Library
to retrieve elements based on roles. This PR will also improve
acessibility of this area.
Co-authored-by: David Øvrelid <46874830+framitdavid@users.noreply.github.com>
(cherry picked from commit 932e282e153ca30f6afaac738469137b761cf904)
Backport #28491 by @appleboy
- Modify the `Password` field in `CreateUserOption` struct to remove the
`Required` tag
- Update the `v1_json.tmpl` template to include the `email` field and
remove the `password` field
Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
(cherry picked from commit 411310d698e86bd639b31f2f5a8b856365b4590f)
Backport #28454 (the only conflict is caused by some comments)
* Close#24483
* Close#28123
* Close#23682
* Close#23149
(cherry picked from commit a3f403f438e7f5b5dca3a5042fae8e68a896b1e7)
Conflicts:
modules/setting/ui.go
trivial context conflict
It shows warnings although the setting is not set, this will surely be
fixed later but there is no sense in spaming the users right now. This
revert can be discarded when another fix lands in v1.21.
su -c "forgejo admin user generate-access-token -u root --raw --scopes 'all,sudo'" git
2023/12/12 15:54:45 .../setting/security.go:166:loadSecurityFrom() [W] Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will default to true in gitea 1.23 and will be removed in gitea 1.24.
This reverts commit 0e3a5abb69.
Conflicts:
routers/api/v1/api.go
Backport #28390 by @jackHay22
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
```
HTTP/1.1 200 OK
...
Warning: token and access_token API authentication is deprecated
...
```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`
## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed
## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)
Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
(cherry picked from commit f144521aea0d7a08b9bd5f17e49bae4021bd7a45)
Backport #28359 by @lunny
The left menu will only display the default branch's workflows but the
right side will display the runs triggered by all branches' workflows.
So we cannot hide right side if default branch has no workflows.
Fix#28332
Replace #28333
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
(cherry picked from commit b7e3adc66c01dc6c81126ca4c031cad48d6eb6c4)
Backport #28351 by @KN4CK3R
Fix#28347
As there is no info how to reproduce it, I can't test it.
Fix may be `section_split.tmpl @ 126/130`.
Other changes are "empty check" refactorings.
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
(cherry picked from commit 08445d5d863e23d2e540d44ace030da0bd474bbf)
Backport #28101 by @lng2020
Reverts go-gitea/gitea#27141close#28097
Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
(cherry picked from commit a2314ca9c5e17db140e66c7031cbfb97e04e41e5)
- "Gitea" is automatically being determined in Swagger and cannot be
overridden, therefor we override it after `swagger generate spec` is run.
- Resolves https://codeberg.org/forgejo/forgejo/issues/226
(cherry picked from commit 0b453807656b6fbe54284d865e59880460f3d253)
[BRANDING] Change Swagger title to Forgejo API
(cherry picked from commit 79f6a70b53421be9984a9ad96ebd0d06ab5af02e)
(cherry picked from commit 6cd47afe3366a615d40655a435275d5543910065)
(cherry picked from commit a7ae2e4c09431cd7a1f18c5b87b9dd87981b538d)
(cherry picked from commit 59f837e4661233dafc202ded9ad907dbdf7e3e69)
(cherry picked from commit c1c3d1f0e63b880baa32d285d3eba6034137b45a)
(cherry picked from commit 4b088713fb0a55c2c37f734ce82f13190ca412dd)
(cherry picked from commit 3df1d2137112a95279a8c84a8601e4c137d75d4f)
(cherry picked from commit a4a5fdbde4f9ebbf5ba6ba66c8f20a89e54860de)
(cherry picked from commit 57aa9ed710a95aa51ae3824873c3766b38da7850)
(cherry picked from commit 948b49bf9449af744a1f2e1324187897ed1c0809)
(cherry picked from commit be4929ab6a802d7d748f537ab8b798e30588c1d4)
(cherry picked from commit 9ecb507457d8a6aa60713762a1a5d2995ed986e5)
Conflicts:
templates/swagger/ui.tmpl
(cherry picked from commit 8e57e688637b9fbd3c33d3e38aed8768a2c07208)
(cherry picked from commit f0b3f621e34130c75b35c113ad509ab73118e123)
(cherry picked from commit 5b0a6d093ea5210a5ba27705b1d1636e23da8738)
(cherry picked from commit 2e0f6b5de8837a439ecadaf3434d006d7014016c)
(cherry picked from commit bb08076f5c26481d78855823c2daa1a76d3865fb)
(cherry picked from commit 5c9360e38a41a4494b1b1b247f9d57b1a0d91ef0)
(cherry picked from commit 2f277561489e1228af163fa4e5d153ceb7eec864)
(cherry picked from commit 6fce7eeb511d949249e045a995cc637d3788a1f0)
(cherry picked from commit 8d27e7bebd961468bd492c4d64e132a46d97f62b)
(cherry picked from commit fda2ee2aaedac8f394d9fc38085f768c775d2c38)
(cherry picked from commit fe0489a4d856655fdcf93c16a41995709c47f78f)
(cherry picked from commit fe9479b357d2ef0f5fd8247e8356ce7c75135b88)
(cherry picked from commit 1deadb2f35c8c0c87cd93b6f04675312b1e667bb)
(cherry picked from commit d1cb84b2f225c484755172735841e3b75abce409)
(cherry picked from commit 9de15d49f8ff0ef0803e8b3a7437a45358e924b9)
(cherry picked from commit 461fbe219c30de7e756ce2cb6dbc354417655a6f)
(cherry picked from commit f39bf3ba5b6325898968533e79fdfc5fe74c3810)
(cherry picked from commit b3f31c2f7bc5b4f5ed3f7fb6e6a6649331eb179a)
(cherry picked from commit b9f493c139bc40bb5aaf361b813019968be75968)
(cherry picked from commit 83781b16411d49f2f27b622ac3e806234b477984)
(cherry picked from commit 4438ee0434f88fc0dcb917304a5baf5b8c2d11a8)
(cherry picked from commit 56b6b368334fe3d11fb55b8e35bbfc314f45405a)
(cherry picked from commit d42aa19f27cb984693d3be7084059f5bd946ae3e)
(cherry picked from commit 4b7eb6a93bf9700e491e8bf99cf76b19f481cac4)
(cherry picked from commit 9d17e95951e17528cd912028544421264f531eca)
(cherry picked from commit 31d3f4bb01d0260da4b6e71b055b28f11dc6cce3)
(cherry picked from commit c428c3f14c770dd2f4a2f1320f7bf047933d1057)
(cherry picked from commit 07fbe2ba69)
Conflicts:
templates/swagger/v1_json.tmpl
remove trailing dot
