{{if .IsRepo}}{{template "repo/header" .}}{{end}}
404
diff --git a/templates/status/413.tmpl b/templates/status/413.tmpl index 8248f601b2..75cb3d04a6 100644 --- a/templates/status/413.tmpl +++ b/templates/status/413.tmpl @@ -1,5 +1,5 @@ {{template "base/head" .}} -
+
{{if .IsRepo}}{{template "repo/header" .}}{{end}}
-
413
diff --git a/templates/webhook/new/discord.tmpl b/templates/webhook/new/discord.tmpl index 48ac84fc6b..455a96c1f4 100644 --- a/templates/webhook/new/discord.tmpl +++ b/templates/webhook/new/discord.tmpl @@ -5,9 +5,9 @@
+
-
+
diff --git a/tests/e2e/issue-sidebar.test.e2e.js b/tests/e2e/issue-sidebar.test.e2e.js
index 0311910a34..61d3281809 100644
--- a/tests/e2e/issue-sidebar.test.e2e.js
+++ b/tests/e2e/issue-sidebar.test.e2e.js
@@ -96,6 +96,89 @@ test('Issue: Labels', async ({browser}, workerInfo) => {
await expect(labelList.filter({hasText: 'label1'})).toBeVisible();
});
+test('Issue: Assignees', async ({browser}, workerInfo) => {
+ test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
+ const page = await login({browser}, workerInfo);
+ // select label list in sidebar only
+ const assigneesList = page.locator('.issue-content-right .assignees.list .selected .item a');
+
+ const response = await page.goto('/org3/repo3/issues/1');
+ await expect(response?.status()).toBe(200);
+ // preconditions
+ await expect(assigneesList.filter({hasText: 'user2'})).toBeVisible();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeHidden();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeHidden();
+
+ // Clear all assignees
+ await page.locator('.select-assignees-modify.dropdown').click();
+ await page.locator('.select-assignees-modify.dropdown .no-select.item').click();
+ await expect(assigneesList.filter({hasText: 'user2'})).toBeHidden();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeHidden();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeVisible();
+ await expect(page.locator('.select-assign-me')).toBeVisible();
+
+ // Assign other user (with searchbox)
+ await page.locator('.select-assignees-modify.dropdown').click();
+ await page.type('.select-assignees-modify .menu .search input', 'user4');
+ await expect(page.locator('.select-assignees-modify .menu .item').filter({hasText: 'user2'})).toBeHidden();
+ await expect(page.locator('.select-assignees-modify .menu .item').filter({hasText: 'user4'})).toBeVisible();
+ await page.locator('.select-assignees-modify .menu .item').filter({hasText: 'user4'}).click();
+ await page.locator('.select-assignees-modify.dropdown').click();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeVisible();
+
+ // remove user4
+ await page.locator('.select-assignees-modify.dropdown').click();
+ await page.locator('.select-assignees-modify .menu .item').filter({hasText: 'user4'}).click();
+ await page.locator('.select-assignees-modify.dropdown').click();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeVisible();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeHidden();
+
+ // Test assign me
+ await page.locator('.ui.assignees .select-assign-me').click();
+ await expect(assigneesList.filter({hasText: 'user2'})).toBeVisible();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeHidden();
+});
+
+test('New Issue: Assignees', async ({browser}, workerInfo) => {
+ test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
+ const page = await login({browser}, workerInfo);
+ // select label list in sidebar only
+ const assigneesList = page.locator('.issue-content-right .assignees.list .selected .item');
+
+ const response = await page.goto('/org3/repo3/issues/new');
+ await expect(response?.status()).toBe(200);
+ // preconditions
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeVisible();
+ await expect(assigneesList.filter({hasText: 'user2'})).toBeHidden();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeHidden();
+
+ // Assign other user (with searchbox)
+ await page.locator('.select-assignees.dropdown').click();
+ await page.type('.select-assignees .menu .search input', 'user4');
+ await expect(page.locator('.select-assignees .menu .item').filter({hasText: 'user2'})).toBeHidden();
+ await expect(page.locator('.select-assignees .menu .item').filter({hasText: 'user4'})).toBeVisible();
+ await page.locator('.select-assignees .menu .item').filter({hasText: 'user4'}).click();
+ await page.locator('.select-assignees.dropdown').click();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeVisible();
+
+ // remove user4
+ await page.locator('.select-assignees.dropdown').click();
+ await page.locator('.select-assignees .menu .item').filter({hasText: 'user4'}).click();
+ await page.locator('.select-assignees.dropdown').click();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeVisible();
+ await expect(assigneesList.filter({hasText: 'user4'})).toBeHidden();
+
+ // Test assign me
+ await page.locator('.ui.assignees .select-assign-me').click();
+ await expect(assigneesList.filter({hasText: 'user2'})).toBeVisible();
+ await expect(page.locator('.ui.assignees.list .item.no-select')).toBeHidden();
+
+ await page.locator('.select-assignees.dropdown').click();
+ await page.fill('.select-assignees .menu .search input', '');
+ await page.locator('.select-assignees.dropdown .no-select.item').click();
+ await expect(page.locator('.select-assign-me')).toBeVisible();
+});
+
test('Issue: Milestone', async ({browser}, workerInfo) => {
test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
const page = await login({browser}, workerInfo);
diff --git a/tests/integration/api_actions_artifact_v4_test.go b/tests/integration/api_actions_artifact_v4_test.go
index b2c25a2e70..f55250f6c1 100644
--- a/tests/integration/api_actions_artifact_v4_test.go
+++ b/tests/integration/api_actions_artifact_v4_test.go
@@ -7,12 +7,14 @@ import (
"bytes"
"crypto/sha256"
"encoding/hex"
+ "encoding/xml"
"io"
"net/http"
"strings"
"testing"
"time"
+ "code.gitea.io/gitea/modules/storage"
"code.gitea.io/gitea/routers/api/actions"
actions_service "code.gitea.io/gitea/services/actions"
"code.gitea.io/gitea/tests"
@@ -175,6 +177,134 @@ func TestActionsArtifactV4UploadSingleFileWithRetentionDays(t *testing.T) {
assert.True(t, finalizeResp.Ok)
}
+func TestActionsArtifactV4UploadSingleFileWithPotentialHarmfulBlockID(t *testing.T) {
+ defer tests.PrepareTestEnv(t)()
+
+ token, err := actions_service.CreateAuthorizationToken(48, 792, 193)
+ require.NoError(t, err)
+
+ // acquire artifact upload url
+ req := NewRequestWithBody(t, "POST", "/twirp/github.actions.results.api.v1.ArtifactService/CreateArtifact", toProtoJSON(&actions.CreateArtifactRequest{
+ Version: 4,
+ Name: "artifactWithPotentialHarmfulBlockID",
+ WorkflowRunBackendId: "792",
+ WorkflowJobRunBackendId: "193",
+ })).AddTokenAuth(token)
+ resp := MakeRequest(t, req, http.StatusOK)
+ var uploadResp actions.CreateArtifactResponse
+ protojson.Unmarshal(resp.Body.Bytes(), &uploadResp)
+ assert.True(t, uploadResp.Ok)
+ assert.Contains(t, uploadResp.SignedUploadUrl, "/twirp/github.actions.results.api.v1.ArtifactService/UploadArtifact")
+
+ // get upload urls
+ idx := strings.Index(uploadResp.SignedUploadUrl, "/twirp/")
+ url := uploadResp.SignedUploadUrl[idx:] + "&comp=block&blockid=%2f..%2fmyfile"
+ blockListURL := uploadResp.SignedUploadUrl[idx:] + "&comp=blocklist"
+
+ // upload artifact chunk
+ body := strings.Repeat("A", 1024)
+ req = NewRequestWithBody(t, "PUT", url, strings.NewReader(body))
+ MakeRequest(t, req, http.StatusCreated)
+
+ // verify that the exploit didn't work
+ _, err = storage.Actions.Stat("myfile")
+ require.Error(t, err)
+
+ // upload artifact blockList
+ blockList := &actions.BlockList{
+ Latest: []string{
+ "/../myfile",
+ },
+ }
+ rawBlockList, err := xml.Marshal(blockList)
+ require.NoError(t, err)
+ req = NewRequestWithBody(t, "PUT", blockListURL, bytes.NewReader(rawBlockList))
+ MakeRequest(t, req, http.StatusCreated)
+
+ t.Logf("Create artifact confirm")
+
+ sha := sha256.Sum256([]byte(body))
+
+ // confirm artifact upload
+ req = NewRequestWithBody(t, "POST", "/twirp/github.actions.results.api.v1.ArtifactService/FinalizeArtifact", toProtoJSON(&actions.FinalizeArtifactRequest{
+ Name: "artifactWithPotentialHarmfulBlockID",
+ Size: 1024,
+ Hash: wrapperspb.String("sha256:" + hex.EncodeToString(sha[:])),
+ WorkflowRunBackendId: "792",
+ WorkflowJobRunBackendId: "193",
+ })).
+ AddTokenAuth(token)
+ resp = MakeRequest(t, req, http.StatusOK)
+ var finalizeResp actions.FinalizeArtifactResponse
+ protojson.Unmarshal(resp.Body.Bytes(), &finalizeResp)
+ assert.True(t, finalizeResp.Ok)
+}
+
+func TestActionsArtifactV4UploadSingleFileWithChunksOutOfOrder(t *testing.T) {
+ defer tests.PrepareTestEnv(t)()
+
+ token, err := actions_service.CreateAuthorizationToken(48, 792, 193)
+ require.NoError(t, err)
+
+ // acquire artifact upload url
+ req := NewRequestWithBody(t, "POST", "/twirp/github.actions.results.api.v1.ArtifactService/CreateArtifact", toProtoJSON(&actions.CreateArtifactRequest{
+ Version: 4,
+ Name: "artifactWithChunksOutOfOrder",
+ WorkflowRunBackendId: "792",
+ WorkflowJobRunBackendId: "193",
+ })).AddTokenAuth(token)
+ resp := MakeRequest(t, req, http.StatusOK)
+ var uploadResp actions.CreateArtifactResponse
+ protojson.Unmarshal(resp.Body.Bytes(), &uploadResp)
+ assert.True(t, uploadResp.Ok)
+ assert.Contains(t, uploadResp.SignedUploadUrl, "/twirp/github.actions.results.api.v1.ArtifactService/UploadArtifact")
+
+ // get upload urls
+ idx := strings.Index(uploadResp.SignedUploadUrl, "/twirp/")
+ block1URL := uploadResp.SignedUploadUrl[idx:] + "&comp=block&blockid=block1"
+ block2URL := uploadResp.SignedUploadUrl[idx:] + "&comp=block&blockid=block2"
+ blockListURL := uploadResp.SignedUploadUrl[idx:] + "&comp=blocklist"
+
+ // upload artifact chunks
+ bodyb := strings.Repeat("B", 1024)
+ req = NewRequestWithBody(t, "PUT", block2URL, strings.NewReader(bodyb))
+ MakeRequest(t, req, http.StatusCreated)
+
+ bodya := strings.Repeat("A", 1024)
+ req = NewRequestWithBody(t, "PUT", block1URL, strings.NewReader(bodya))
+ MakeRequest(t, req, http.StatusCreated)
+
+ // upload artifact blockList
+ blockList := &actions.BlockList{
+ Latest: []string{
+ "block1",
+ "block2",
+ },
+ }
+ rawBlockList, err := xml.Marshal(blockList)
+ require.NoError(t, err)
+ req = NewRequestWithBody(t, "PUT", blockListURL, bytes.NewReader(rawBlockList))
+ MakeRequest(t, req, http.StatusCreated)
+
+ t.Logf("Create artifact confirm")
+
+ sha := sha256.Sum256([]byte(bodya + bodyb))
+
+ // confirm artifact upload
+ req = NewRequestWithBody(t, "POST", "/twirp/github.actions.results.api.v1.ArtifactService/FinalizeArtifact", toProtoJSON(&actions.FinalizeArtifactRequest{
+ Name: "artifactWithChunksOutOfOrder",
+ Size: 2048,
+ Hash: wrapperspb.String("sha256:" + hex.EncodeToString(sha[:])),
+ WorkflowRunBackendId: "792",
+ WorkflowJobRunBackendId: "193",
+ })).
+ AddTokenAuth(token)
+ resp = MakeRequest(t, req, http.StatusOK)
+ var finalizeResp actions.FinalizeArtifactResponse
+ protojson.Unmarshal(resp.Body.Bytes(), &finalizeResp)
+ assert.True(t, finalizeResp.Ok)
+}
+
func TestActionsArtifactV4DownloadSingle(t *testing.T) {
defer tests.PrepareTestEnv(t)()
diff --git a/tests/integration/api_issue_test.go b/tests/integration/api_issue_test.go
index 6e60fe72bc..4051f95ed9 100644
--- a/tests/integration/api_issue_test.go
+++ b/tests/integration/api_issue_test.go
@@ -76,6 +76,34 @@ func TestAPIListIssues(t *testing.T) {
}
}
+func TestAPIListIssuesPublicOnly(t *testing.T) {
+ defer tests.PrepareTestEnv(t)()
+
+ repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+ owner1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo1.OwnerID})
+
+ session := loginUser(t, owner1.Name)
+ token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue)
+ link, _ := url.Parse(fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner1.Name, repo1.Name))
+ link.RawQuery = url.Values{"state": {"all"}}.Encode()
+ req := NewRequest(t, "GET", link.String()).AddTokenAuth(token)
+ MakeRequest(t, req, http.StatusOK)
+
+ repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+ owner2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo2.OwnerID})
+
+ session = loginUser(t, owner2.Name)
+ token = getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue)
+ link, _ = url.Parse(fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner2.Name, repo2.Name))
+ link.RawQuery = url.Values{"state": {"all"}}.Encode()
+ req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
+ MakeRequest(t, req, http.StatusOK)
+
+ publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
+ req = NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken)
+ MakeRequest(t, req, http.StatusForbidden)
+}
+
func TestAPICreateIssue(t *testing.T) {
defer tests.PrepareTestEnv(t)()
const body, title = "apiTestBody", "apiTestTitle"
@@ -404,6 +432,12 @@ func TestAPISearchIssues(t *testing.T) {
DecodeJSON(t, resp, &apiIssues)
assert.Len(t, apiIssues, expectedIssueCount)
+ publicOnlyToken := getUserToken(t, "user1", auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
+ req = NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken)
+ resp = MakeRequest(t, req, http.StatusOK)
+ DecodeJSON(t, resp, &apiIssues)
+ assert.Len(t, apiIssues, 15) // 15 public issues
+
since := "2000-01-01T00:50:01+00:00" // 946687801
before := time.Unix(999307200, 0).Format(time.RFC3339)
query.Add("since", since)
diff --git a/tests/integration/api_packages_arch_test.go b/tests/integration/api_packages_arch_test.go
index af275de442..2cf0186416 100644
--- a/tests/integration/api_packages_arch_test.go
+++ b/tests/integration/api_packages_arch_test.go
@@ -14,6 +14,7 @@ import (
"io"
"net/http"
"strings"
+ "sync"
"testing"
"testing/fstest"
@@ -258,11 +259,15 @@ HMhNSS1IzUsBcpJAPFAwwUXSM0u4BjoaR8EoGAWjgGQAAILFeyQADAAA
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusCreated)
- req = NewRequestWithBody(t, "DELETE", rootURL+"/base/notfound/1.0.0-1", nil).
+ req = NewRequestWithBody(t, "DELETE", rootURL+"/base/notfound/1.0.0-1/any", nil).
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNotFound)
- req = NewRequestWithBody(t, "DELETE", groupURL+"/test/1.0.0-1", nil).
+ req = NewRequestWithBody(t, "DELETE", groupURL+"/test/1.0.0-1/x86_64", nil).
+ AddBasicAuth(user.Name)
+ MakeRequest(t, req, http.StatusNoContent)
+
+ req = NewRequestWithBody(t, "DELETE", groupURL+"/test/1.0.0-1/any", nil).
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNoContent)
@@ -270,12 +275,22 @@ HMhNSS1IzUsBcpJAPFAwwUXSM0u4BjoaR8EoGAWjgGQAAILFeyQADAAA
respPkg := MakeRequest(t, req, http.StatusOK)
files, err := listTarGzFiles(respPkg.Body.Bytes())
require.NoError(t, err)
- require.Len(t, files, 1) // other pkg in L225
+ require.Len(t, files, 1)
- req = NewRequestWithBody(t, "DELETE", groupURL+"/test2/1.0.0-1", nil).
+ req = NewRequestWithBody(t, "DELETE", groupURL+"/test2/1.0.0-1/any", nil).
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNoContent)
- req = NewRequest(t, "GET", groupURL+"/x86_64/base.db")
+
+ req = NewRequest(t, "GET", groupURL+"/x86_64/base.db").
+ AddBasicAuth(user.Name)
+ MakeRequest(t, req, http.StatusNotFound)
+
+ req = NewRequestWithBody(t, "DELETE", groupURL+"/test/1.0.0-1/aarch64", nil).
+ AddBasicAuth(user.Name)
+ MakeRequest(t, req, http.StatusNoContent)
+
+ req = NewRequest(t, "GET", groupURL+"/aarch64/base.db").
+ AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNotFound)
})
@@ -294,12 +309,33 @@ HMhNSS1IzUsBcpJAPFAwwUXSM0u4BjoaR8EoGAWjgGQAAILFeyQADAAA
resp := MakeRequest(t, req, http.StatusOK)
require.Equal(t, pkgs[key], resp.Body.Bytes())
- req = NewRequestWithBody(t, "DELETE", groupURL+"/test2/1.0.0-1", nil).
+ req = NewRequestWithBody(t, "DELETE", groupURL+"/test2/1.0.0-1/any", nil).
AddBasicAuth(user.Name)
MakeRequest(t, req, http.StatusNoContent)
})
}
}
+ t.Run("Concurrent Upload", func(t *testing.T) {
+ defer tests.PrintCurrentTest(t)()
+ var wg sync.WaitGroup
+
+ targets := []string{"any", "aarch64", "x86_64"}
+ for _, tag := range targets {
+ wg.Add(1)
+ go func(i string) {
+ defer wg.Done()
+ req := NewRequestWithBody(t, "PUT", rootURL, bytes.NewReader(pkgs[i])).
+ AddBasicAuth(user.Name)
+ MakeRequest(t, req, http.StatusCreated)
+ }(tag)
+ }
+ wg.Wait()
+ for _, target := range targets {
+ req := NewRequestWithBody(t, "DELETE", rootURL+"/test/1.0.0-1/"+target, nil).
+ AddBasicAuth(user.Name)
+ MakeRequest(t, req, http.StatusNoContent)
+ }
+ })
}
func getProperty(data, key string) string {
@@ -318,10 +354,10 @@ func getProperty(data, key string) string {
func listTarGzFiles(data []byte) (fstest.MapFS, error) {
reader, err := gzip.NewReader(bytes.NewBuffer(data))
- defer reader.Close()
if err != nil {
return nil, err
}
+ defer reader.Close()
tarRead := tar.NewReader(reader)
files := make(fstest.MapFS)
for {
diff --git a/tests/integration/api_packages_composer_test.go b/tests/integration/api_packages_composer_test.go
index 9cdcd07e37..9d25cc4d64 100644
--- a/tests/integration/api_packages_composer_test.go
+++ b/tests/integration/api_packages_composer_test.go
@@ -37,6 +37,7 @@ func TestPackageComposer(t *testing.T) {
packageType := "composer-plugin"
packageAuthor := "Gitea Authors"
packageLicense := "MIT"
+ packageBin := "./bin/script"
var buf bytes.Buffer
archive := zip.NewWriter(&buf)
@@ -50,6 +51,9 @@ func TestPackageComposer(t *testing.T) {
{
"name": "` + packageAuthor + `"
}
+ ],
+ "bin": [
+ "` + packageBin + `"
]
}`))
archive.Close()
@@ -211,6 +215,8 @@ func TestPackageComposer(t *testing.T) {
assert.Len(t, pkgs[0].Authors, 1)
assert.Equal(t, packageAuthor, pkgs[0].Authors[0].Name)
assert.Equal(t, "zip", pkgs[0].Dist.Type)
- assert.Equal(t, "7b40bfd6da811b2b78deec1e944f156dbb2c747b", pkgs[0].Dist.Checksum)
+ assert.Equal(t, "4f5fa464c3cb808a1df191dbf6cb75363f8b7072", pkgs[0].Dist.Checksum)
+ assert.Len(t, pkgs[0].Bin, 1)
+ assert.Equal(t, packageBin, pkgs[0].Bin[0])
})
}
diff --git a/tests/integration/api_pull_review_test.go b/tests/integration/api_pull_review_test.go
index b7e5130cb8..b66e65ee41 100644
--- a/tests/integration/api_pull_review_test.go
+++ b/tests/integration/api_pull_review_test.go
@@ -60,6 +60,9 @@ func TestAPIPullReviewCreateDeleteComment(t *testing.T) {
var reviews []*api.PullReview
DecodeJSON(t, resp, &reviews)
for _, review := range reviews {
+ if review.State == api.ReviewStateRequestReview {
+ continue
+ }
req := NewRequestf(t, http.MethodDelete, "/api/v1/repos/%s/pulls/%d/reviews/%d", repo.FullName(), pullIssue.Index, review.ID).
AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
@@ -93,7 +96,7 @@ func TestAPIPullReviewCreateDeleteComment(t *testing.T) {
DecodeJSON(t, resp, &getReview)
require.EqualValues(t, getReview, review)
}
- requireReviewCount(1)
+ requireReviewCount(2)
newCommentBody := "first new line"
var reviewComment api.PullReviewComment
@@ -140,7 +143,7 @@ func TestAPIPullReviewCreateDeleteComment(t *testing.T) {
AddTokenAuth(token)
MakeRequest(t, req, http.StatusNoContent)
}
- requireReviewCount(0)
+ requireReviewCount(1)
})
}
}
@@ -160,7 +163,7 @@ func TestAPIPullReview(t *testing.T) {
var reviews []*api.PullReview
DecodeJSON(t, resp, &reviews)
- if !assert.Len(t, reviews, 6) {
+ if !assert.Len(t, reviews, 8) {
return
}
for _, r := range reviews {
diff --git a/tests/integration/api_repo_branch_test.go b/tests/integration/api_repo_branch_test.go
index 5488eca1dc..83159022ea 100644
--- a/tests/integration/api_repo_branch_test.go
+++ b/tests/integration/api_repo_branch_test.go
@@ -29,9 +29,13 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
repo3 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
session := loginUser(t, user1.LowerName)
- token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+ // public only token should be forbidden
+ publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteRepository)
link, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches", repo3.Name)) // a plain repo
+ MakeRequest(t, NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+
+ token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
resp := MakeRequest(t, NewRequest(t, "GET", link.String()).AddTokenAuth(token), http.StatusOK)
bs, err := io.ReadAll(resp.Body)
require.NoError(t, err)
@@ -43,6 +47,8 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
assert.EqualValues(t, "master", branches[1].Name)
link2, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches/test_branch", repo3.Name))
+ MakeRequest(t, NewRequest(t, "GET", link2.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+
resp = MakeRequest(t, NewRequest(t, "GET", link2.String()).AddTokenAuth(token), http.StatusOK)
bs, err = io.ReadAll(resp.Body)
require.NoError(t, err)
@@ -50,6 +56,8 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
require.NoError(t, json.Unmarshal(bs, &branch))
assert.EqualValues(t, "test_branch", branch.Name)
+ MakeRequest(t, NewRequest(t, "POST", link.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+
req := NewRequest(t, "POST", link.String()).AddTokenAuth(token)
req.Header.Add("Content-Type", "application/json")
req.Body = io.NopCloser(bytes.NewBufferString(`{"new_branch_name":"test_branch2", "old_branch_name": "test_branch", "old_ref_name":"refs/heads/test_branch"}`))
@@ -74,6 +82,7 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
link3, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches/test_branch2", repo3.Name))
MakeRequest(t, NewRequest(t, "DELETE", link3.String()), http.StatusNotFound)
+ MakeRequest(t, NewRequest(t, "DELETE", link3.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
MakeRequest(t, NewRequest(t, "DELETE", link3.String()).AddTokenAuth(token), http.StatusNoContent)
require.NoError(t, err)
diff --git a/tests/integration/api_token_test.go b/tests/integration/api_token_test.go
index 9c7bf37330..01d18ef6f1 100644
--- a/tests/integration/api_token_test.go
+++ b/tests/integration/api_token_test.go
@@ -23,10 +23,10 @@ func TestAPICreateAndDeleteToken(t *testing.T) {
defer tests.PrepareTestEnv(t)()
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
- newAccessToken := createAPIAccessTokenWithoutCleanUp(t, "test-key-1", user, nil)
+ newAccessToken := createAPIAccessTokenWithoutCleanUp(t, "test-key-1", user, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
deleteAPIAccessToken(t, newAccessToken, user)
- newAccessToken = createAPIAccessTokenWithoutCleanUp(t, "test-key-2", user, nil)
+ newAccessToken = createAPIAccessTokenWithoutCleanUp(t, "test-key-2", user, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
deleteAPIAccessToken(t, newAccessToken, user)
}
@@ -72,19 +72,19 @@ func TestAPIDeleteTokensPermission(t *testing.T) {
user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
// admin can delete tokens for other users
- createAPIAccessTokenWithoutCleanUp(t, "test-key-1", user2, nil)
+ createAPIAccessTokenWithoutCleanUp(t, "test-key-1", user2, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
req := NewRequest(t, "DELETE", "/api/v1/users/"+user2.LoginName+"/tokens/test-key-1").
AddBasicAuth(admin.Name)
MakeRequest(t, req, http.StatusNoContent)
// non-admin can delete tokens for himself
- createAPIAccessTokenWithoutCleanUp(t, "test-key-2", user2, nil)
+ createAPIAccessTokenWithoutCleanUp(t, "test-key-2", user2, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
req = NewRequest(t, "DELETE", "/api/v1/users/"+user2.LoginName+"/tokens/test-key-2").
AddBasicAuth(user2.Name)
MakeRequest(t, req, http.StatusNoContent)
// non-admin can't delete tokens for other users
- createAPIAccessTokenWithoutCleanUp(t, "test-key-3", user2, nil)
+ createAPIAccessTokenWithoutCleanUp(t, "test-key-3", user2, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
req = NewRequest(t, "DELETE", "/api/v1/users/"+user2.LoginName+"/tokens/test-key-3").
AddBasicAuth(user4.Name)
MakeRequest(t, req, http.StatusForbidden)
@@ -520,7 +520,7 @@ func runTestCase(t *testing.T, testCase *requiredScopeTestCase, user *user_model
unauthorizedScopes = append(unauthorizedScopes, cateogoryUnauthorizedScopes...)
}
- accessToken := createAPIAccessTokenWithoutCleanUp(t, "test-token", user, &unauthorizedScopes)
+ accessToken := createAPIAccessTokenWithoutCleanUp(t, "test-token", user, unauthorizedScopes)
defer deleteAPIAccessToken(t, accessToken, user)
// Request the endpoint. Verify that permission is denied.
@@ -532,20 +532,12 @@ func runTestCase(t *testing.T, testCase *requiredScopeTestCase, user *user_model
// createAPIAccessTokenWithoutCleanUp Create an API access token and assert that
// creation succeeded. The caller is responsible for deleting the token.
-func createAPIAccessTokenWithoutCleanUp(t *testing.T, tokenName string, user *user_model.User, scopes *[]auth_model.AccessTokenScope) api.AccessToken {
+func createAPIAccessTokenWithoutCleanUp(t *testing.T, tokenName string, user *user_model.User, scopes []auth_model.AccessTokenScope) api.AccessToken {
payload := map[string]any{
- "name": tokenName,
- }
- if scopes != nil {
- for _, scope := range *scopes {
- scopes, scopesExists := payload["scopes"].([]string)
- if !scopesExists {
- scopes = make([]string, 0)
- }
- scopes = append(scopes, string(scope))
- payload["scopes"] = scopes
- }
+ "name": tokenName,
+ "scopes": scopes,
}
+
log.Debug("Requesting creation of token with scopes: %v", scopes)
req := NewRequestWithJSON(t, "POST", "/api/v1/users/"+user.LoginName+"/tokens", payload).
AddBasicAuth(user.Name)
@@ -563,8 +555,7 @@ func createAPIAccessTokenWithoutCleanUp(t *testing.T, tokenName string, user *us
return newAccessToken
}
-// createAPIAccessTokenWithoutCleanUp Delete an API access token and assert that
-// deletion succeeded.
+// deleteAPIAccessToken deletes an API access token and assert that deletion succeeded.
func deleteAPIAccessToken(t *testing.T, accessToken api.AccessToken, user *user_model.User) {
req := NewRequestf(t, "DELETE", "/api/v1/users/"+user.LoginName+"/tokens/%d", accessToken.ID).
AddBasicAuth(user.Name)
diff --git a/tests/integration/api_user_search_test.go b/tests/integration/api_user_search_test.go
index 2ecd338987..97c42aa696 100644
--- a/tests/integration/api_user_search_test.go
+++ b/tests/integration/api_user_search_test.go
@@ -40,6 +40,19 @@ func TestAPIUserSearchLoggedIn(t *testing.T) {
assert.Contains(t, user.UserName, query)
assert.NotEmpty(t, user.Email)
}
+
+ publicToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopePublicOnly)
+ req = NewRequestf(t, "GET", "/api/v1/users/search?q=%s", query).
+ AddTokenAuth(publicToken)
+ resp = MakeRequest(t, req, http.StatusOK)
+ results = SearchResults{}
+ DecodeJSON(t, resp, &results)
+ assert.NotEmpty(t, results.Data)
+ for _, user := range results.Data {
+ assert.Contains(t, user.UserName, query)
+ assert.NotEmpty(t, user.Email)
+ assert.Equal(t, "public", user.Visibility)
+ }
}
func TestAPIUserSearchNotLoggedIn(t *testing.T) {
diff --git a/tests/integration/attachment_test.go b/tests/integration/attachment_test.go
index 95c9c9f753..7cbc2545d5 100644
--- a/tests/integration/attachment_test.go
+++ b/tests/integration/attachment_test.go
@@ -60,7 +60,8 @@ func createAttachment(t *testing.T, session *TestSession, repoURL, filename stri
func TestCreateAnonymousAttachment(t *testing.T) {
defer tests.PrepareTestEnv(t)()
session := emptyTestSession(t)
- createAttachment(t, session, "user2/repo1", "image.png", generateImg(), http.StatusSeeOther)
+ // this test is not right because it just doesn't pass the CSRF validation
+ createAttachment(t, session, "user2/repo1", "image.png", generateImg(), http.StatusBadRequest)
}
func TestCreateIssueAttachment(t *testing.T) {
diff --git a/tests/integration/csrf_test.go b/tests/integration/csrf_test.go
index a789859889..fcb9661b8a 100644
--- a/tests/integration/csrf_test.go
+++ b/tests/integration/csrf_test.go
@@ -5,12 +5,10 @@ package integration
import (
"net/http"
- "strings"
"testing"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
- "code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
@@ -25,28 +23,12 @@ func TestCsrfProtection(t *testing.T) {
req := NewRequestWithValues(t, "POST", "/user/settings", map[string]string{
"_csrf": "fake_csrf",
})
- session.MakeRequest(t, req, http.StatusSeeOther)
-
- resp := session.MakeRequest(t, req, http.StatusSeeOther)
- loc := resp.Header().Get("Location")
- assert.Equal(t, setting.AppSubURL+"/", loc)
- resp = session.MakeRequest(t, NewRequest(t, "GET", loc), http.StatusOK)
- htmlDoc := NewHTMLParser(t, resp.Body)
- assert.Equal(t, "Bad Request: invalid CSRF token",
- strings.TrimSpace(htmlDoc.doc.Find(".ui.message").Text()),
- )
+ resp := session.MakeRequest(t, req, http.StatusBadRequest)
+ assert.Contains(t, resp.Body.String(), "Invalid CSRF token")
// test web form csrf via header. TODO: should use an UI api to test
req = NewRequest(t, "POST", "/user/settings")
req.Header.Add("X-Csrf-Token", "fake_csrf")
- session.MakeRequest(t, req, http.StatusSeeOther)
-
- resp = session.MakeRequest(t, req, http.StatusSeeOther)
- loc = resp.Header().Get("Location")
- assert.Equal(t, setting.AppSubURL+"/", loc)
- resp = session.MakeRequest(t, NewRequest(t, "GET", loc), http.StatusOK)
- htmlDoc = NewHTMLParser(t, resp.Body)
- assert.Equal(t, "Bad Request: invalid CSRF token",
- strings.TrimSpace(htmlDoc.doc.Find(".ui.message").Text()),
- )
+ resp = session.MakeRequest(t, req, http.StatusBadRequest)
+ assert.Contains(t, resp.Body.String(), "Invalid CSRF token")
}
diff --git a/tests/integration/links_test.go b/tests/integration/links_test.go
index 68d7008e02..e9ad933b24 100644
--- a/tests/integration/links_test.go
+++ b/tests/integration/links_test.go
@@ -12,6 +12,7 @@ import (
"code.gitea.io/gitea/modules/setting"
api "code.gitea.io/gitea/modules/structs"
"code.gitea.io/gitea/modules/test"
+ forgejo_context "code.gitea.io/gitea/services/context"
"code.gitea.io/gitea/tests"
"github.com/stretchr/testify/assert"
@@ -190,11 +191,6 @@ func TestRedirectsWebhooks(t *testing.T) {
{from: "/user/settings/hooks/" + kind + "/new", to: "/user/login", verb: "GET"},
{from: "/admin/system-hooks/" + kind + "/new", to: "/user/login", verb: "GET"},
{from: "/admin/default-hooks/" + kind + "/new", to: "/user/login", verb: "GET"},
- {from: "/user2/repo1/settings/hooks/" + kind + "/new", to: "/", verb: "POST"},
- {from: "/admin/system-hooks/" + kind + "/new", to: "/", verb: "POST"},
- {from: "/admin/default-hooks/" + kind + "/new", to: "/", verb: "POST"},
- {from: "/user2/repo1/settings/hooks/1", to: "/", verb: "POST"},
- {from: "/admin/hooks/1", to: "/", verb: "POST"},
}
for _, info := range redirects {
req := NewRequest(t, info.verb, info.from)
@@ -202,6 +198,24 @@ func TestRedirectsWebhooks(t *testing.T) {
assert.EqualValues(t, path.Join(setting.AppSubURL, info.to), test.RedirectURL(resp), info.from)
}
}
+
+ for _, kind := range []string{"forgejo", "gitea"} {
+ csrf := []struct {
+ from string
+ verb string
+ }{
+ {from: "/user2/repo1/settings/hooks/" + kind + "/new", verb: "POST"},
+ {from: "/admin/hooks/1", verb: "POST"},
+ {from: "/admin/system-hooks/" + kind + "/new", verb: "POST"},
+ {from: "/admin/default-hooks/" + kind + "/new", verb: "POST"},
+ {from: "/user2/repo1/settings/hooks/1", verb: "POST"},
+ }
+ for _, info := range csrf {
+ req := NewRequest(t, info.verb, info.from)
+ resp := MakeRequest(t, req, http.StatusBadRequest)
+ assert.Contains(t, resp.Body.String(), forgejo_context.CsrfErrorString)
+ }
+ }
}
func TestRepoLinks(t *testing.T) {
diff --git a/tests/integration/oauth_test.go b/tests/integration/oauth_test.go
index 0d5e9a0472..f385b99e46 100644
--- a/tests/integration/oauth_test.go
+++ b/tests/integration/oauth_test.go
@@ -11,6 +11,7 @@ import (
"fmt"
"io"
"net/http"
+ "net/http/httptest"
"net/url"
"strings"
"testing"
@@ -24,6 +25,7 @@ import (
api "code.gitea.io/gitea/modules/structs"
"code.gitea.io/gitea/modules/test"
"code.gitea.io/gitea/routers/web/auth"
+ forgejo_context "code.gitea.io/gitea/services/context"
"code.gitea.io/gitea/tests"
"github.com/markbates/goth"
@@ -803,6 +805,16 @@ func TestOAuthIntrospection(t *testing.T) {
})
}
+func requireCookieCSRF(t *testing.T, resp http.ResponseWriter) string {
+ for _, c := range resp.(*httptest.ResponseRecorder).Result().Cookies() {
+ if c.Name == "_csrf" {
+ return c.Value
+ }
+ }
+ require.True(t, false, "_csrf not found in cookies")
+ return ""
+}
+
func TestOAuth_GrantScopesReadUser(t *testing.T) {
defer tests.PrepareTestEnv(t)()
@@ -840,19 +852,18 @@ func TestOAuth_GrantScopesReadUser(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
@@ -921,19 +932,18 @@ func TestOAuth_GrantScopesFailReadRepository(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
@@ -1000,19 +1010,18 @@ func TestOAuth_GrantScopesReadRepository(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
@@ -1082,19 +1091,18 @@ func TestOAuth_GrantScopesReadPrivateGroups(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
@@ -1164,19 +1172,18 @@ func TestOAuth_GrantScopesReadOnlyPublicGroups(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
@@ -1260,19 +1267,18 @@ func TestOAuth_GrantScopesReadPublicGroupsWithTheReadScope(t *testing.T) {
authorizeResp := ctx.MakeRequest(t, authorizeReq, http.StatusSeeOther)
authcode := strings.Split(strings.Split(authorizeResp.Body.String(), "?code=")[1], "&")[0]
- htmlDoc := NewHTMLParser(t, authorizeResp.Body)
grantReq := NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
- "_csrf": htmlDoc.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"client_id": app.ClientID,
"redirect_uri": "a",
"state": "thestate",
"granted": "true",
})
- grantResp := ctx.MakeRequest(t, grantReq, http.StatusSeeOther)
- htmlDocGrant := NewHTMLParser(t, grantResp.Body)
+ grantResp := ctx.MakeRequest(t, grantReq, http.StatusBadRequest)
+ assert.NotContains(t, grantResp.Body.String(), forgejo_context.CsrfErrorString)
accessTokenReq := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
- "_csrf": htmlDocGrant.GetCSRF(),
+ "_csrf": requireCookieCSRF(t, authorizeResp),
"grant_type": "authorization_code",
"client_id": app.ClientID,
"client_secret": app.ClientSecret,
diff --git a/tests/integration/org_test.go b/tests/integration/org_test.go
index a1e448be8a..ad7e31f290 100644
--- a/tests/integration/org_test.go
+++ b/tests/integration/org_test.go
@@ -10,6 +10,9 @@ import (
"testing"
auth_model "code.gitea.io/gitea/models/auth"
+ "code.gitea.io/gitea/models/organization"
+ "code.gitea.io/gitea/models/perm"
+ "code.gitea.io/gitea/models/unit"
"code.gitea.io/gitea/models/unittest"
user_model "code.gitea.io/gitea/models/user"
api "code.gitea.io/gitea/modules/structs"
@@ -247,3 +250,22 @@ func TestOrgDashboardLabels(t *testing.T) {
assert.True(t, ok)
assert.Contains(t, labelFilterHref, "labels=3%2c-4")
}
+
+func TestOwnerTeamUnit(t *testing.T) {
+ defer tests.PrepareTestEnv(t)()
+
+ user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+ org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
+ session := loginUser(t, user.Name)
+
+ unittest.AssertExistsAndLoadBean(t, &organization.TeamUnit{TeamID: 1, Type: unit.TypeIssues, AccessMode: perm.AccessModeOwner})
+
+ req := NewRequestWithValues(t, "GET", fmt.Sprintf("/org/%s/teams/owners/edit", org.Name), map[string]string{
+ "_csrf": GetCSRF(t, session, fmt.Sprintf("/org/%s/teams/owners/edit", org.Name)),
+ "team_name": "Owners",
+ "Description": "Just a description",
+ })
+ session.MakeRequest(t, req, http.StatusOK)
+
+ unittest.AssertExistsAndLoadBean(t, &organization.TeamUnit{TeamID: 1, Type: unit.TypeIssues, AccessMode: perm.AccessModeOwner})
+}
diff --git a/tests/integration/pull_commit_test.go b/tests/integration/pull_commit_test.go
new file mode 100644
index 0000000000..477f01725d
--- /dev/null
+++ b/tests/integration/pull_commit_test.go
@@ -0,0 +1,34 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+ "net/http"
+ "net/url"
+ "testing"
+
+ pull_service "code.gitea.io/gitea/services/pull"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestListPullCommits(t *testing.T) {
+ onGiteaRun(t, func(t *testing.T, u *url.URL) {
+ session := loginUser(t, "user5")
+ req := NewRequest(t, "GET", "/user2/repo1/pulls/3/commits/list")
+ resp := session.MakeRequest(t, req, http.StatusOK)
+
+ var pullCommitList struct {
+ Commits []pull_service.CommitInfo `json:"commits"`
+ LastReviewCommitSha string `json:"last_review_commit_sha"`
+ }
+ DecodeJSON(t, resp, &pullCommitList)
+
+ if assert.Len(t, pullCommitList.Commits, 2) {
+ assert.Equal(t, "5f22f7d0d95d614d25a5b68592adb345a4b5c7fd", pullCommitList.Commits[0].ID)
+ assert.Equal(t, "4a357436d925b5c974181ff12a994538ddc5a269", pullCommitList.Commits[1].ID)
+ }
+ assert.Equal(t, "4a357436d925b5c974181ff12a994538ddc5a269", pullCommitList.LastReviewCommitSha)
+ })
+}
diff --git a/tests/integration/pull_create_test.go b/tests/integration/pull_create_test.go
index 8bf48f4f6e..b814642bc7 100644
--- a/tests/integration/pull_create_test.go
+++ b/tests/integration/pull_create_test.go
@@ -72,6 +72,30 @@ func testPullCreate(t *testing.T, session *TestSession, user, repo string, toSel
return resp
}
+func testPullCreateDirectly(t *testing.T, session *TestSession, baseRepoOwner, baseRepoName, baseBranch, headRepoOwner, headRepoName, headBranch, title string) *httptest.ResponseRecorder {
+ headCompare := headBranch
+ if headRepoOwner != "" {
+ if headRepoName != "" {
+ headCompare = fmt.Sprintf("%s/%s:%s", headRepoOwner, headRepoName, headBranch)
+ } else {
+ headCompare = fmt.Sprintf("%s:%s", headRepoOwner, headBranch)
+ }
+ }
+ req := NewRequest(t, "GET", fmt.Sprintf("/%s/%s/compare/%s...%s", baseRepoOwner, baseRepoName, baseBranch, headCompare))
+ resp := session.MakeRequest(t, req, http.StatusOK)
+
+ // Submit the form for creating the pull
+ htmlDoc := NewHTMLParser(t, resp.Body)
+ link, exists := htmlDoc.doc.Find("form.ui.form").Attr("action")
+ assert.True(t, exists, "The template has changed")
+ req = NewRequestWithValues(t, "POST", link, map[string]string{
+ "_csrf": htmlDoc.GetCSRF(),
+ "title": title,
+ })
+ resp = session.MakeRequest(t, req, http.StatusOK)
+ return resp
+}
+
func TestPullCreate(t *testing.T) {
onGiteaRun(t, func(t *testing.T, u *url.URL) {
session := loginUser(t, "user1")
@@ -505,3 +529,30 @@ func TestRecentlyPushed(t *testing.T) {
})
})
}
+
+/*
+Setup:
+The base repository is: user2/repo1
+Fork repository to: user1/repo1
+Push extra commit to: user2/repo1, which changes README.md
+Create a PR on user1/repo1
+
+Test checks:
+Check if pull request can be created from base to the fork repository.
+*/
+func TestPullCreatePrFromBaseToFork(t *testing.T) {
+ onGiteaRun(t, func(t *testing.T, u *url.URL) {
+ sessionFork := loginUser(t, "user1")
+ testRepoFork(t, sessionFork, "user2", "repo1", "user1", "repo1")
+
+ // Edit base repository
+ sessionBase := loginUser(t, "user2")
+ testEditFile(t, sessionBase, "user2", "repo1", "master", "README.md", "Hello, World (Edited)\n")
+
+ // Create a PR
+ resp := testPullCreateDirectly(t, sessionFork, "user1", "repo1", "master", "user2", "repo1", "master", "This is a pull title")
+ // check the redirected URL
+ url := test.RedirectURL(resp)
+ assert.Regexp(t, "^/user1/repo1/pulls/[0-9]*$", url)
+ })
+}
diff --git a/tests/integration/repo_branch_test.go b/tests/integration/repo_branch_test.go
index 2aa299479a..df9ea9a97c 100644
--- a/tests/integration/repo_branch_test.go
+++ b/tests/integration/repo_branch_test.go
@@ -18,7 +18,6 @@ import (
"code.gitea.io/gitea/models/unittest"
"code.gitea.io/gitea/modules/git"
"code.gitea.io/gitea/modules/graceful"
- "code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/test"
"code.gitea.io/gitea/modules/translation"
repo_service "code.gitea.io/gitea/services/repository"
@@ -157,15 +156,8 @@ func TestCreateBranchInvalidCSRF(t *testing.T) {
"_csrf": "fake_csrf",
"new_branch_name": "test",
})
- resp := session.MakeRequest(t, req, http.StatusSeeOther)
- loc := resp.Header().Get("Location")
- assert.Equal(t, setting.AppSubURL+"/", loc)
- resp = session.MakeRequest(t, NewRequest(t, "GET", loc), http.StatusOK)
- htmlDoc := NewHTMLParser(t, resp.Body)
- assert.Equal(t,
- "Bad Request: invalid CSRF token",
- strings.TrimSpace(htmlDoc.doc.Find(".ui.message").Text()),
- )
+ resp := session.MakeRequest(t, req, http.StatusBadRequest)
+ assert.Contains(t, resp.Body.String(), "Invalid CSRF token")
}
func TestDatabaseMissingABranch(t *testing.T) {
diff --git a/tests/integration/repo_webhook_test.go b/tests/integration/repo_webhook_test.go
index b98fce0f4a..8f65b5c34f 100644
--- a/tests/integration/repo_webhook_test.go
+++ b/tests/integration/repo_webhook_test.go
@@ -172,6 +172,7 @@ func TestWebhookForms(t *testing.T) {
}))
t.Run("discord/required", testWebhookForms("discord", session, map[string]string{
+ "username": "john",
"payload_url": "https://discord.example.com",
}))
t.Run("discord/optional", testWebhookForms("discord", session, map[string]string{
diff --git a/web_src/fomantic/package-lock.json b/web_src/fomantic/package-lock.json
index 2401294105..0b9dc6eaa7 100644
--- a/web_src/fomantic/package-lock.json
+++ b/web_src/fomantic/package-lock.json
@@ -198,9 +198,9 @@
}
},
"node_modules/@octokit/core/node_modules/@octokit/request-error": {
- "version": "6.1.4",
- "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.4.tgz",
- "integrity": "sha512-VpAhIUxwhWZQImo/dWAN/NpPqqojR6PSLgLYAituLM6U+ddx9hCioFGwBr5Mi+oi5CLeJkcAs3gJ0PYYzU6wUg==",
+ "version": "6.1.5",
+ "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
+ "integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -211,9 +211,9 @@
}
},
"node_modules/@octokit/core/node_modules/@octokit/types": {
- "version": "13.5.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.5.0.tgz",
- "integrity": "sha512-HdqWTf5Z3qwDVlzCrP8UJquMwunpDiMPt5er+QjGzL4hqr/vBVY/MauQgS1xWxCDT1oMx1EULyqxncdCY/NVSQ==",
+ "version": "13.6.0",
+ "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.0.tgz",
+ "integrity": "sha512-CrooV/vKCXqwLa+osmHLIMUb87brpgUqlqkPGc6iE2wCkUvTrHiXFMhAKoDDaAAYJrtKtrFTgSQTg5nObBEaew==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -304,9 +304,9 @@
}
},
"node_modules/@octokit/graphql/node_modules/@octokit/request-error": {
- "version": "6.1.4",
- "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.4.tgz",
- "integrity": "sha512-VpAhIUxwhWZQImo/dWAN/NpPqqojR6PSLgLYAituLM6U+ddx9hCioFGwBr5Mi+oi5CLeJkcAs3gJ0PYYzU6wUg==",
+ "version": "6.1.5",
+ "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
+ "integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -317,9 +317,9 @@
}
},
"node_modules/@octokit/graphql/node_modules/@octokit/types": {
- "version": "13.5.0",
- "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.5.0.tgz",
- "integrity": "sha512-HdqWTf5Z3qwDVlzCrP8UJquMwunpDiMPt5er+QjGzL4hqr/vBVY/MauQgS1xWxCDT1oMx1EULyqxncdCY/NVSQ==",
+ "version": "13.6.0",
+ "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.0.tgz",
+ "integrity": "sha512-CrooV/vKCXqwLa+osmHLIMUb87brpgUqlqkPGc6iE2wCkUvTrHiXFMhAKoDDaAAYJrtKtrFTgSQTg5nObBEaew==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -492,9 +492,9 @@
"license": "MIT"
},
"node_modules/@types/node": {
- "version": "22.5.5",
- "resolved": "https://registry.npmjs.org/@types/node/-/node-22.5.5.tgz",
- "integrity": "sha512-Xjs4y5UPO/CLdzpgR6GirZJx36yScjh73+2NlLlkFRSoQN8B0DpfXPdZGnvVmLRLOsqDpOfTNv7D9trgGhmOIA==",
+ "version": "22.7.4",
+ "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.4.tgz",
+ "integrity": "sha512-y+NPi1rFzDs1NdQHHToqeiX2TIS79SWEAw9GYhkkx8bD0ChpfqC+n2j5OXOCpzfojBEBt6DnEnnG9MY0zk1XLg==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.19.2"
@@ -1115,9 +1115,9 @@
}
},
"node_modules/browserslist": {
- "version": "4.23.3",
- "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.3.tgz",
- "integrity": "sha512-btwCFJVjI4YWDNfau8RhZ+B1Q/VLoUITrm3RlP6y1tYGWIOa+InuYiRGXUBXo8nA1qKmHMyLB/iVQg5TT4eFoA==",
+ "version": "4.24.0",
+ "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.0.tgz",
+ "integrity": "sha512-Rmb62sR1Zpjql25eSanFGEhAxcFwfA1K0GuQcLoaJBAcENegrQut3hYdhXFF1obQfiDyqIW/cLM5HSJ/9k884A==",
"funding": [
{
"type": "opencollective",
@@ -1134,8 +1134,8 @@
],
"license": "MIT",
"dependencies": {
- "caniuse-lite": "^1.0.30001646",
- "electron-to-chromium": "^1.5.4",
+ "caniuse-lite": "^1.0.30001663",
+ "electron-to-chromium": "^1.5.28",
"node-releases": "^2.0.18",
"update-browserslist-db": "^1.1.0"
},
@@ -1219,9 +1219,9 @@
}
},
"node_modules/caniuse-lite": {
- "version": "1.0.30001660",
- "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001660.tgz",
- "integrity": "sha512-GacvNTTuATm26qC74pt+ad1fW15mlQ/zuTzzY1ZoIzECTP8HURDfF43kNxPgf7H1jmelCBQTTbBNxdSXOA7Bqg==",
+ "version": "1.0.30001664",
+ "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001664.tgz",
+ "integrity": "sha512-AmE7k4dXiNKQipgn7a2xg558IRqPN3jMQY/rOsbxDhrd0tyChwbITBfiwtnqz8bi2M5mIWbxAYBvk7W7QBUS2g==",
"funding": [
{
"type": "opencollective",
@@ -1961,9 +1961,9 @@
}
},
"node_modules/electron-to-chromium": {
- "version": "1.5.23",
- "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.23.tgz",
- "integrity": "sha512-mBhODedOXg4v5QWwl21DjM5amzjmI1zw9EPrPK/5Wx7C8jt33bpZNrC7OhHUG3pxRtbLpr3W2dXT+Ph1SsfRZA==",
+ "version": "1.5.29",
+ "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.29.tgz",
+ "integrity": "sha512-PF8n2AlIhCKXQ+gTpiJi0VhcHDb69kYX4MtCiivctc2QD3XuNZ/XIOlbGzt7WAjjEev0TtaH6Cu3arZExm5DOw==",
"license": "ISC"
},
"node_modules/emoji-regex": {
@@ -2618,7 +2618,7 @@
"version": "1.2.13",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-1.2.13.tgz",
"integrity": "sha512-oWb1Z6mkHIskLzEJ/XWX0srkpkTQ7vaopMQkyaEIoq0fmtFVxOthb8cCxeT+p3ynTdkk/RZwbgG4brR5BeWECw==",
- "deprecated": "The v1 package contains DANGEROUS / INSECURE binaries. Upgrade to safe fsevents v2",
+ "deprecated": "Upgrade to fsevents v2 to mitigate potential security issues",
"hasInstallScript": true,
"license": "MIT",
"optional": true,
@@ -6239,9 +6239,9 @@
}
},
"node_modules/package-json-from-dist": {
- "version": "1.0.0",
- "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.0.tgz",
- "integrity": "sha512-dATvCeZN/8wQsGywez1mzHtTlP22H8OEfPrVMLNr4/eGa+ijtLn/6M5f0dY8UKNrC2O9UCU6SSoG3qRKnt7STw==",
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+ "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
"license": "BlueOak-1.0.0"
},
"node_modules/parse-filepath": {
@@ -8229,9 +8229,9 @@
}
},
"node_modules/update-browserslist-db": {
- "version": "1.1.0",
- "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.0.tgz",
- "integrity": "sha512-EdRAaAyk2cUE1wOf2DkEhzxqOQvFOoRJFNS6NeyJ01Gp2beMRpBAINjM2iDXE3KCuKhwnvHIQCJm6ThL2Z+HzQ==",
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
+ "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
"funding": [
{
"type": "opencollective",
@@ -8248,8 +8248,8 @@
],
"license": "MIT",
"dependencies": {
- "escalade": "^3.1.2",
- "picocolors": "^1.0.1"
+ "escalade": "^3.2.0",
+ "picocolors": "^1.1.0"
},
"bin": {
"update-browserslist-db": "cli.js"
diff --git a/web_src/js/components/DashboardRepoList.vue b/web_src/js/components/DashboardRepoList.vue
index 69a8ced47d..e5874133b1 100644
--- a/web_src/js/components/DashboardRepoList.vue
+++ b/web_src/js/components/DashboardRepoList.vue
@@ -78,7 +78,6 @@ const sfc = {
searchURL() {
return `${this.subUrl}/repo/search?sort=updated&order=desc&uid=${this.uid}&team_id=${this.teamId}&q=${this.searchQuery
}&page=${this.page}&limit=${this.searchLimit}&mode=${this.repoTypes[this.reposFilter].searchMode
- }${this.reposFilter !== 'all' ? '&exclusive=1' : ''
}${this.archivedFilter === 'archived' ? '&archived=true' : ''}${this.archivedFilter === 'unarchived' ? '&archived=false' : ''
}${this.privateFilter === 'private' ? '&is_private=true' : ''}${this.privateFilter === 'public' ? '&is_private=false' : ''
}`;
diff --git a/web_src/js/features/repo-issue.js b/web_src/js/features/repo-issue.js
index feba449c16..c4bd70b71d 100644
--- a/web_src/js/features/repo-issue.js
+++ b/web_src/js/features/repo-issue.js
@@ -12,6 +12,26 @@ import {emojiHTML} from './emoji.js';
const {appSubUrl} = window.config;
+// if there are draft comments, confirm before reloading, to avoid losing comments
+export function reloadConfirmDraftComment() {
+ const commentTextareas = [
+ document.querySelector('.edit-content-zone:not(.tw-hidden) textarea'),
+ document.querySelector('#comment-form textarea'),
+ ];
+ for (const textarea of commentTextareas) {
+ // Most users won't feel too sad if they lose a comment with 10 chars, they can re-type these in seconds.
+ // But if they have typed more (like 50) chars and the comment is lost, they will be very unhappy.
+ if (textarea && textarea.value.trim().length > 10) {
+ textarea.parentElement.scrollIntoView();
+ if (!window.confirm('Page will be reloaded, but there are draft comments. Continuing to reload will discard the comments. Continue?')) {
+ return;
+ }
+ break;
+ }
+ }
+ window.location.reload();
+}
+
export function initRepoIssueTimeTracking() {
$(document).on('click', '.issue-add-time', () => {
$('.issue-start-time-modal').modal({
@@ -668,6 +688,40 @@ export function initRepoIssueBranchSelect() {
});
}
+export function initRepoIssueAssignMe() {
+ // Assign to me button
+ document.querySelector('.ui.assignees.list .item.no-select .select-assign-me')
+ ?.addEventListener('click', (e) => {
+ e.preventDefault();
+ const selectMe = e.target;
+ const noSelect = selectMe.parentElement;
+ const selectorList = document.querySelector('.ui.select-assignees .menu');
+
+ if (selectMe.getAttribute('data-action') === 'update') {
+ (async () => {
+ await updateIssuesMeta(
+ selectMe.getAttribute('data-update-url'),
+ selectMe.getAttribute('data-action'),
+ selectMe.getAttribute('data-issue-id'),
+ selectMe.getAttribute('data-id'),
+ );
+ reloadConfirmDraftComment();
+ })();
+ } else {
+ for (const item of selectorList.querySelectorAll('.item')) {
+ if (item.getAttribute('data-id') === selectMe.getAttribute('data-id')) {
+ item.classList.add('checked');
+ item.querySelector('.octicon-check').classList.remove('tw-invisible');
+ }
+ }
+ document.querySelector(selectMe.getAttribute('data-id-selector')).classList.remove('tw-hidden');
+ noSelect.classList.add('tw-hidden');
+ document.querySelector(selectorList.getAttribute('data-id')).value = selectMe.getAttribute('data-id');
+ return false;
+ }
+ });
+}
+
export function initSingleCommentEditor($commentForm) {
// pages:
// * normal new issue/pr page, no status-button
diff --git a/web_src/js/features/repo-legacy.js b/web_src/js/features/repo-legacy.js
index b25fc28dea..73aaa457f2 100644
--- a/web_src/js/features/repo-legacy.js
+++ b/web_src/js/features/repo-legacy.js
@@ -4,6 +4,7 @@ import {
initRepoIssueComments, initRepoIssueDependencyDelete, initRepoIssueReferenceIssue,
initRepoIssueTitleEdit, initRepoIssueWipToggle,
initRepoPullRequestUpdate, updateIssuesMeta, handleReply, initIssueTemplateCommentEditors, initSingleCommentEditor,
+ initRepoIssueAssignMe, reloadConfirmDraftComment,
} from './repo-issue.js';
import {initUnicodeEscapeButton} from './repo-unicode-escape.js';
import {svg} from '../svg.js';
@@ -29,26 +30,6 @@ import {POST, GET} from '../modules/fetch.js';
const {csrfToken} = window.config;
-// if there are draft comments, confirm before reloading, to avoid losing comments
-function reloadConfirmDraftComment() {
- const commentTextareas = [
- document.querySelector('.edit-content-zone:not(.tw-hidden) textarea'),
- document.querySelector('#comment-form textarea'),
- ];
- for (const textarea of commentTextareas) {
- // Most users won't feel too sad if they lose a comment with 10 chars, they can re-type these in seconds.
- // But if they have typed more (like 50) chars and the comment is lost, they will be very unhappy.
- if (textarea && textarea.value.trim().length > 10) {
- textarea.parentElement.scrollIntoView();
- if (!window.confirm('Page will be reloaded, but there are draft comments. Continuing to reload will discard the comments. Continue?')) {
- return;
- }
- break;
- }
- }
- window.location.reload();
-}
-
export function initRepoCommentForm() {
const $commentForm = $('.comment.form');
if (!$commentForm.length) return;
@@ -243,6 +224,7 @@ export function initRepoCommentForm() {
// Init labels and assignees
initListSubmits('select-label', 'labels');
initListSubmits('select-assignees', 'assignees');
+ initRepoIssueAssignMe();
initListSubmits('select-assignees-modify', 'assignees');
initListSubmits('select-reviewers-modify', 'assignees');
@@ -274,7 +256,7 @@ export function initRepoCommentForm() {
icon = svg('octicon-milestone', 18, 'tw-mr-2');
} else if (input_id === '#project_id') {
icon = svg('octicon-project', 18, 'tw-mr-2');
- } else if (input_id === '#assignee_id') {
+ } else if (input_id === '#assignee_ids') {
icon = `.data('avatar')})
`;
}
@@ -314,7 +296,7 @@ export function initRepoCommentForm() {
// Milestone, Assignee, Project
selectItem('.select-project', '#project_id');
selectItem('.select-milestone', '#milestone_id');
- selectItem('.select-assignee', '#assignee_id');
+ selectItem('.select-assignee', '#assignee_ids');
}
async function onEditContent(event) {