Commit graph

4652 commits

Author SHA1 Message Date
Gergely Nagy 8eba631f8d
hooks: Harden when we accept push options that change repo settings
It is possible to change some repo settings (its visibility, and
template status) via `git push` options: `-o repo.private=true`, `-o
repo.template=true`.

Previously, there weren't sufficient permission checks on these, and
anyone who could `git push` to a repository - including via an AGit
workflow! - was able to change either of these settings. To guard
against this, the pre-receive hook will now check if either of these
options are present, and if so, will perform additional permission
checks to ensure that these can only be set by a repository owner or
an administrator. Additionally, changing these settings is disabled for
forks, even for the fork's owner.

There's still a case where the owner of a repository can change the
visibility of it, and it will not propagate to forks (it propagates to
forks when changing the visibility via the API), but that's an
inconsistency, not a security issue.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Signed-off-by: Earl Warren <contact@earl-warren.org>
2024-04-19 16:53:14 +02:00
Earl Warren d07f12e010 Merge pull request 'Do not require login_name & source_id for /admin/user/{username}' (#3278) from algernon/forgejo:leave-your-name-at-the-door into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3278
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-17 11:05:13 +00:00
Gergely Nagy d07c8c821c
Do not require login_name & source_id for /admin/user/{username}
When editing a user via the API, do not require setting `login_name` or
`source_id`: for local accounts, these do not matter. However, when
editing a non-local account, require *both*, as before.

Fixes #1861.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-17 10:33:52 +02:00
Gergely Nagy df8e58c5cb
Allow changing global wiki editability via the API
The global wiki editability can be set via the web UI, this patch makes
it possible to set the same thing via the API too. This is accomplished
by adjusting the GET and PATCH handlers of the
`/api/v1/repos/{owner}/{repo}` route.

The first will include the property when checking the repo's settings,
the second allows a repo admin to change the setting too.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-16 22:51:36 +02:00
oliverpool ada8bfa52f Merge pull request 'Fix release published actions not triggering for releases created from existing tags' (#3220) from zotan/forgejo:forgejo into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3220
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-16 18:27:59 +00:00
Zettat123 463ea8fdd2
Check the token's owner and repository when registering a runner (#30406)
Fix #30378

(cherry picked from commit 0fe9f93eb4c94d55e43b18b9c3cc6d513a34c0b5)

Conflicts:
	- models/organization/org.go
	- services/repository/delete.go
	- services/user/delete.go
	In all three cases, conflicts were resolved by manually adding
        the lines added by the Gitea patch, keeping the Forgejo code
        surrounding them.
2024-04-16 09:38:26 +02:00
Laura Hausmann 46977b0f01
Fix release published actions not triggering for releases created from existing tags 2024-04-15 22:53:53 +02:00
Gergely Nagy 5bf959a3a5
Convert the remaining interface{}s to any
Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-15 20:01:36 +02:00
yp05327 9987b75662
Fix network error when open/close organization/individual projects and redirect to project page (#30387)
Follow #27734

![image](https://github.com/go-gitea/gitea/assets/18380374/02ed6b9a-cbb6-4f49-a54a-ca76a0d052a9)

Updated:
Redirect to project page instead of project list page.

(cherry picked from commit af02b8a0e9b00a324fb92f1f73ea386dd9595c3d)
2024-04-15 20:01:36 +02:00
Lunny Xiao f544bb25b5
Fix missed doer (#30231)
Fix #29879

Co-authored-by: Giteabot <teabot@gitea.io>
(cherry picked from commit 908426aa0fcc58961c345994f0f66056f6cf5f48)
2024-04-15 20:01:35 +02:00
wxiaoguang 9b8de15797
Clean up log messages (#30313)
`log.Xxx("%v")` is not ideal, this PR adds necessary context messages.
Remove some unnecessary logs.

Co-authored-by: Giteabot <teabot@gitea.io>
(cherry picked from commit 83f83019ef3471b847a300f0821499b3896ec987)

Conflicts:
	- modules/util/util.go
          Conflict resolved by picking `util.Iif` from 654cfd1dfbd3f3f1d94addee50b6fe2b018a49c3
2024-04-15 20:01:35 +02:00
0ko ceba1abe06 Merge pull request 'Improve English locale' (#2941) from 0ko/forgejo:english20240401 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2941
Reviewed-by: Otto <otto@codeberg.org>
2024-04-15 17:34:52 +00:00
Gusted db39b8f4a7
[PORT] gitea#30430: Fix rename branch 500 when the target branch is deleted but exist in database
Fix https://github.com/go-gitea/gitea/issues/30428

---

Conflict resolution: trivial and move test to own subtest run directly
after `Normal`.

(cherrypicked commit 9466fec879f4f2c88c7c1e7a5cffba319282ab66)
2024-04-15 16:03:09 +02:00
oliverpool 16879b07d2 [PORT] drop utils.IsExternalURL (and expand IsRiskyRedirectURL tests) (#3167)
Related to  #2773
Related to Refactor URL detection [gitea#29960](https://github.com/go-gitea/gitea/pull/29960)
Related to Refactor external URL detection [gitea#29973](https://github.com/go-gitea/gitea/pull/29973)

I added a bunch of tests to `httplib.TestIsRiskyRedirectURL` and some cases should be better handled (however it is not an easy task).

I also ported the removal of `utils.IsExternalURL`, since it prevents duplicated (subtle) code.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3167
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
2024-04-15 13:03:08 +00:00
Shiny Nematoda aec787b927 fix code search template 2024-04-11 14:52:37 +00:00
Earl Warren ad8a3ed2a1 Merge pull request 'Do not update PRs based on events that happened before they existed' (#2932) from earl-warren/forgejo:wip-superfluous into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2932
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
2024-04-11 12:07:07 +00:00
Earl Warren 998a431747
Do not update PRs based on events that happened before they existed
* Split TestPullRequest out of AddTestPullRequestTask
* A Created field is added to the Issue table
* The Created field is set to the time (with nano resolution) on creation
* Record the nano time repo_module.PushUpdateOptions is created by the hook
* The decision to update a pull request created before a commit was
  pushed is based on the time (with nano resolution) the git hook
  was run and the Created field

It ensures the following happens:

* commit C is pushed
* the git hook queues AddTestPullRequestTask for processing and returns with success
* TestPullRequest is not called yet
* a pull request P with commit C as the head is created
* TestPullRequest runs and ignores P because it was created after the commit was received

When the "created" column is NULL, no verification is done, pull
requests that were created before the column was created in the
database cannot be newer than the latest call to a git hook.

Fixes: https://codeberg.org/forgejo/forgejo/issues/2009
2024-04-11 11:16:23 +02:00
Earl Warren 9396edb2e3 Merge pull request 'Update checker setting updates' (#2925) from 0ko/forgejo:update_check_default into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2925
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-10 20:54:10 +00:00
oliverpool 9a94019db4 webhook: add admin-hooks tests 2024-04-09 20:02:14 +02:00
oliverpool e0b5f2d59b webhook: fix admin-hooks new dropdowns 2024-04-09 20:02:14 +02:00
Earl Warren 2d3705bb81 Merge pull request '[CHORE] Remove Microsoft SQL Server support' (#3040) from gusted/forgejo-rm-mssql into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3040
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-09 05:34:54 +00:00
Earl Warren 26fc7c3461 Merge pull request '[gitea] week 15 cherry pick' (#3091) from algernon/forgejo:wcp/week-15 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3091
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-09 05:31:44 +00:00
Earl Warren 7179ae8cc1 Merge pull request '[GITEA PORT] Do some performance optimize for issues list and view issue/pull (gitea#29515)' (#3116) from oliverpool/forgejo:port_29515 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3116
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-08 19:04:40 +00:00
Lunny Xiao c9854bee98 Do some performance optimize for issues list and view issue/pull (gitea#29515)
This PR do some performance optimzations.

- [x] Add `index` for the column `comment_id` of `Attachment` table to
accelerate query from the database.
- [x] Remove unnecessary database queries when viewing issues. Before
some conditions which id = 0 will be sent to the database
- [x] Remove duplicated load posters
- [x] Batch loading attachements, isread of comments on viewing issue

---------

Co-authored-by: Zettat123 <zettat123@gmail.com>
Conflicts:
models/issues/comment_code.go: function was renamed in Forgejo
models/migrations/migrations.go: migration already ported
2024-04-08 14:47:31 +02:00
JakobDev 613e5387c5 Count downloads for tag archives 2024-04-08 12:51:27 +02:00
Zettat123 87870ade49
Remove scheduled action tasks if the repo is archived (#30224)
Fix #30220

(cherry picked from commit 1ef2eb50d82d07b1e4ff312ef58953d1bba2437a)
2024-04-07 15:40:31 +02:00
Jack Hay e08f05b069
Add setting to disable user features when user login type is not plain (#29615)
- Adds setting `EXTERNAL_USER_DISABLE_FEATURES` to disable any supported
user features when login type is not plain
- In general, this is necessary for SSO implementations to avoid
inconsistencies between the external account management and the linked
account
- Adds helper functions to encourage correct use

(cherry picked from commit 59d4aadba5c15d02f3b9f0e61abb7476870c20a5)

Conflicts:
	- docs/content/administration/config-cheat-sheet.en-us.md
          Removed.
	- modules/setting/admin.go
          Trivial resolution: pick the newly added struct member.
2024-04-07 11:09:21 +02:00
sillyguodong 16696a42f5
Add API for Variables (#29520)
close #27801

---------

Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit 62b073e6f31645e446c7e8d6b5a506f61b47924e)

Conflicts:
	- modules/util/util.go
          Trivial resolution, only picking the newly introduced function
	- routers/api/v1/swagger/options.go
          Trivial resolution. We don't have UserBadges, don't pick that part.
	- templates/swagger/v1_json.tmpl
          Regenerated.
2024-04-07 10:57:53 +02:00
Gusted a3f1249f0a
[BUG] Fix unblock action
- At some point the unblock button was transformed into being handled by
Javascript, however the endpoint didn't yet respond in JSON.
- Ref: https://codeberg.org/kita/.profile/raw/branch/main/img/G94IqS9.png
2024-04-06 20:57:51 +02:00
0ko 3b23633721 [I18N] Improve English locale
- user settings/profile: renamed Description fild of biography to Biography
2024-04-06 23:06:39 +05:00
Gusted 5691becace Merge pull request 'Fix "view file" button in diff compare view' (#3046) from Mai-Lapyst/forgejo:fix-diffcompare-viewfile-url into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3046
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 12:25:12 +00:00
Gusted d8eebe7698 Merge pull request 'Add optional pronoun field in user settings' (#1518) from hazy/forgejo:feat/pronoun-field into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1518
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Gergely Nagy <algernon@noreply.codeberg.org>
2024-04-06 12:23:54 +00:00
Gusted d5fd40821e Merge pull request 'feat: extend webfinger to respond to profile page URIs' (#2883) from realaravinth/forgejo:cb-2870 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2883
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 12:21:35 +00:00
Earl Warren 3093f8765f Merge pull request 'Fix #3030 add Cache-Control header for health-check' (#3060) from adaaa/forgejo:cache-control-healthz into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3060
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 08:09:39 +00:00
Ada 84f5115bd1
Add health-check test 2024-04-06 00:34:55 +02:00
Michael Kriese bc72fd7f46
feat: improve nuget nuspec api 2024-04-05 23:39:45 +02:00
Gusted 2d9afd0c21
[CHORE] Remove Microsoft SQL Server Support
- Per https://codeberg.org/forgejo/discussions/issues/122
2024-04-05 23:37:36 +02:00
Ada d2ff8f8720
Remove old proxy backwards compatibility 2024-04-05 22:08:22 +02:00
Earl Warren 8205ed9495 Merge pull request '[FEAT] sourcehut webhooks' (#3022) from oliverpool/forgejo:webhook_7_sourcehut into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3022
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
2024-04-05 19:23:54 +00:00
Ada b210a3ebd5
Fix #3030 add Cache-Control header for health-check 2024-04-05 18:44:17 +02:00
Mai-Lapyst 33e8926efe
Fix view file button in diff compare 2024-04-05 05:27:20 +02:00
Aravinth Manivannan fc3c944c16 fix: cleanup webfinger URI parsing 2024-04-04 16:52:25 +00:00
Aravinth Manivannan f7ca56557c feat: parse for all ForgeFed actors 2024-04-04 16:52:25 +00:00
Aravinth Manivannan 8273f8b756 feat: improve URI parsing in webfinger endpoint 2024-04-04 16:52:25 +00:00
Aravinth Manivannan fc31f14507 feat: extend webfinger to respond to profile page URIs 2024-04-04 16:52:25 +00:00
iminfinity 8d13ed4a8d add label filters in org/{org_name}/issues 2024-04-04 17:57:11 +05:30
oliverpool 04a398a1af [REFACTOR] webhook shared code to prevent import cycles 2024-04-04 08:24:33 +02:00
Gergely Nagy 6aba69ce85
Enable user pronoun editing from the admin ui
While users can edit their own pronouns, the admin UI enables an admin
to edit *any* user setting. As such, pronouns should be editable here,
too.

For the sake of simplicity, the input here is a simple text input field,
rather than a dropdown.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-03 15:18:02 -05:00
hazycora 454ceb2ada
add some comments 2024-04-03 15:16:40 -05:00
hazycora 75890e8f37
gofumpt 2024-04-03 15:15:53 -05:00