Commit graph

632 commits

Author SHA1 Message Date
Gergely Nagy 8eba631f8d
hooks: Harden when we accept push options that change repo settings
It is possible to change some repo settings (its visibility, and
template status) via `git push` options: `-o repo.private=true`, `-o
repo.template=true`.

Previously, there weren't sufficient permission checks on these, and
anyone who could `git push` to a repository - including via an AGit
workflow! - was able to change either of these settings. To guard
against this, the pre-receive hook will now check if either of these
options are present, and if so, will perform additional permission
checks to ensure that these can only be set by a repository owner or
an administrator. Additionally, changing these settings is disabled for
forks, even for the fork's owner.

There's still a case where the owner of a repository can change the
visibility of it, and it will not propagate to forks (it propagates to
forks when changing the visibility via the API), but that's an
inconsistency, not a security issue.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Signed-off-by: Earl Warren <contact@earl-warren.org>
2024-04-19 16:53:14 +02:00
0ko 67d6c674df Merge pull request 'Remove EasyMDE from various areas' (#2916) from 0ko/forgejo:easymde into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2916
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-19 13:48:34 +00:00
Earl Warren 6316e21be2
fix(tests): 30s to cancel processes to avoid false negatives
on slower machines it can take more than 1 second to cancel leftover
tasks
2024-04-18 18:47:49 +02:00
Earl Warren d07f12e010 Merge pull request 'Do not require login_name & source_id for /admin/user/{username}' (#3278) from algernon/forgejo:leave-your-name-at-the-door into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3278
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-17 11:05:13 +00:00
Gergely Nagy d07c8c821c
Do not require login_name & source_id for /admin/user/{username}
When editing a user via the API, do not require setting `login_name` or
`source_id`: for local accounts, these do not matter. However, when
editing a non-local account, require *both*, as before.

Fixes #1861.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-17 10:33:52 +02:00
Earl Warren e4aa7bd511 Merge pull request 'webhook: improve UX for sourcehut and matrix' (#3156) from oliverpool/forgejo:webhook_sourcehut_polish into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3156
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-17 06:39:54 +00:00
Gergely Nagy ea4071ca9f Allow admins to fork repos even when creation limits are exhausted (#3277)
This is a continuation of #2728, with a test case added.

Fixes #2633.

I kept @zareck 's commit as is, because I believe it is correct. We can't move the check to `owner.CanForkRepo()`, because `owner` is the future owner of the forked repo, and may be an organization. We need to check the admin permission of the `doer`, like in the case of repository creation.

I verified that the test fails without the `ForkRepository` change, and passes with it.

Co-authored-by: Cassio Zareck <cassiomilczareck@gmail.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3277
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Co-committed-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-17 05:52:02 +00:00
Gergely Nagy df8e58c5cb
Allow changing global wiki editability via the API
The global wiki editability can be set via the web UI, this patch makes
it possible to set the same thing via the API too. This is accomplished
by adjusting the GET and PATCH handlers of the
`/api/v1/repos/{owner}/{repo}` route.

The first will include the property when checking the repo's settings,
the second allows a repo admin to change the setting too.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-16 22:51:36 +02:00
oliverpool ada8bfa52f Merge pull request 'Fix release published actions not triggering for releases created from existing tags' (#3220) from zotan/forgejo:forgejo into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3220
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-16 18:27:59 +00:00
Laura Hausmann 8506dbe2e5
Add tests for webhook release events
Co-authored-by: oliverpool <git@olivier.pfad.fr>
2024-04-16 19:25:26 +02:00
Earl Warren a5a0fc7344 Merge pull request '[BUG] Escape editor.add_tmpl translation' (#3269) from gusted/forgejo-escape-tr into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3269
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-16 16:19:47 +00:00
Gusted a0f47b8de7
[BUG] Escape editor.add_tmpl translation
- Previously translations were escaped, but now translations are
accepted as-is and will be rendered as HTML. Use `TrString` to escape
the translation value.
- Adds integration test.
- Regression of 65248945c9.
- Resolves #3260
2024-04-16 15:50:49 +02:00
Lunny Xiao 6495741238
Add commit status summary table to reduce query from commit status table (#30223)
This PR adds a new table named commit status summary to reduce queries
from the commit status table. After this change, commit status summary
table will be used for the final result, commit status table will be for
details.

---------

Co-authored-by: Jason Song <i@wolfogre.com>
2024-04-16 12:01:20 +02:00
oliverpool 99830a40a1 webhook: matrix access_token helper text 2024-04-16 08:59:56 +02:00
oliverpool 36f05e6f4e webhook: sourcehut_builds: ask for access_token instead of authorization_header 2024-04-16 08:59:55 +02:00
Gergely Nagy 5bf959a3a5
Convert the remaining interface{}s to any
Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-15 20:01:36 +02:00
0ko 089e37026f Add integration test for EasyMDE button 2024-04-15 22:59:26 +05:00
Earl Warren 51c2daec6e Merge pull request 'fix(actions): call automerge service on successful commit state' (#3231) from viceice/forgejo:fix/actions/automerge-head into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3231
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-15 16:47:23 +00:00
Michael Kriese 36f4732e6a
fix(actions): call automerge service on successful commit state
- Backport of https://github.com/go-gitea/gitea/pull/30225
2024-04-15 16:17:45 +02:00
Gusted db39b8f4a7
[PORT] gitea#30430: Fix rename branch 500 when the target branch is deleted but exist in database
Fix https://github.com/go-gitea/gitea/issues/30428

---

Conflict resolution: trivial and move test to own subtest run directly
after `Normal`.

(cherrypicked commit 9466fec879f4f2c88c7c1e7a5cffba319282ab66)
2024-04-15 16:03:09 +02:00
Earl Warren b833e5e7db Merge pull request '[BUG] Fix code search in explore reporting as git grep even with indexer enabled' (#3173) from snematoda/fix-grep-tmpl into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3173
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-13 08:52:08 +00:00
Shiny Nematoda a67ca43f75 add test 2024-04-13 06:04:00 +00:00
Earl Warren 828ae39c22 Merge pull request '[BUG] Fix for PyPi Registry PEP 503 Compliance' (#3190) from Zottelchen/forgejo:bug/pep-503 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3190
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-12 22:19:51 +00:00
Zottelchen 14badb37fe Update tests/integration/api_packages_pypi_test.go 2024-04-12 21:02:42 +00:00
Gergely Nagy 65ed86e396
Fix the settings tab highlighting
When visiting a repos `/settings/units` page, highlight the active tab
properly: "Add more..." if the tab is displayed, or "Settings"
otherwise.

Fixes #3188.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
2024-04-12 19:11:21 +02:00
Gusted 0c42e3c755 Merge pull request '[CHORE] Remove println' (#3185) from gusted/forgejo-println into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3185
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-12 12:35:38 +00:00
Gusted 706846b628
[CHORE] Remove println
- It's not recommended to use it per the documentation: https://pkg.go.dev/builtin#println.
2024-04-12 13:36:31 +02:00
Antonin Delpeuch 592c20c7d4 Fix spelling mistakes caught by golangci-lint 2024-04-11 17:16:26 +02:00
Earl Warren ad8a3ed2a1 Merge pull request 'Do not update PRs based on events that happened before they existed' (#2932) from earl-warren/forgejo:wip-superfluous into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2932
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
2024-04-11 12:07:07 +00:00
Earl Warren 998a431747
Do not update PRs based on events that happened before they existed
* Split TestPullRequest out of AddTestPullRequestTask
* A Created field is added to the Issue table
* The Created field is set to the time (with nano resolution) on creation
* Record the nano time repo_module.PushUpdateOptions is created by the hook
* The decision to update a pull request created before a commit was
  pushed is based on the time (with nano resolution) the git hook
  was run and the Created field

It ensures the following happens:

* commit C is pushed
* the git hook queues AddTestPullRequestTask for processing and returns with success
* TestPullRequest is not called yet
* a pull request P with commit C as the head is created
* TestPullRequest runs and ignores P because it was created after the commit was received

When the "created" column is NULL, no verification is done, pull
requests that were created before the column was created in the
database cannot be newer than the latest call to a git hook.

Fixes: https://codeberg.org/forgejo/forgejo/issues/2009
2024-04-11 11:16:23 +02:00
Earl Warren fd62033b98
[TESTS] disable test failure on log.Error for now (part 2)
Fixes: https://codeberg.org/forgejo/forgejo/issues/3153
2024-04-11 07:36:59 +02:00
Earl Warren 0905961fde Merge pull request '[BUG] webhook: fix admin-hooks and add more tests' (#3125) from oliverpool/forgejo:webhook_admin_fix into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3125
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-09 21:55:54 +00:00
oliverpool 8ffaa08b04 add missing defer 2024-04-09 21:14:51 +02:00
oliverpool aba99ab8fc [TEST] cancel all processes on PrepareTestEnv 2024-04-09 21:14:51 +02:00
oliverpool 9a94019db4 webhook: add admin-hooks tests 2024-04-09 20:02:14 +02:00
oliverpool c1f7c49804 webhook: add admin-hooks new list test 2024-04-09 20:02:14 +02:00
oliverpool 07d044a32c Makefile: test-e2e-sqlite-firefox 2024-04-09 16:50:10 +02:00
oliverpool 7d95cf6472 webhook: add org tests 2024-04-09 12:02:10 +02:00
Earl Warren 2d3705bb81 Merge pull request '[CHORE] Remove Microsoft SQL Server support' (#3040) from gusted/forgejo-rm-mssql into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3040
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-09 05:34:54 +00:00
Earl Warren 26fc7c3461 Merge pull request '[gitea] week 15 cherry pick' (#3091) from algernon/forgejo:wcp/week-15 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3091
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-09 05:31:44 +00:00
JakobDev 613e5387c5 Count downloads for tag archives 2024-04-08 12:51:27 +02:00
sillyguodong 16696a42f5
Add API for Variables (#29520)
close #27801

---------

Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit 62b073e6f31645e446c7e8d6b5a506f61b47924e)

Conflicts:
	- modules/util/util.go
          Trivial resolution, only picking the newly introduced function
	- routers/api/v1/swagger/options.go
          Trivial resolution. We don't have UserBadges, don't pick that part.
	- templates/swagger/v1_json.tmpl
          Regenerated.
2024-04-07 10:57:53 +02:00
Shiny Nematoda baac15f316 [FEAT] Support Include/Exclude Filters for Grep (#3058)
fixes `TestRepoSearch` failing occasionally

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3058
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
Co-committed-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
2024-04-06 13:25:39 +00:00
Gusted 5691becace Merge pull request 'Fix "view file" button in diff compare view' (#3046) from Mai-Lapyst/forgejo:fix-diffcompare-viewfile-url into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3046
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 12:25:12 +00:00
Gusted d8eebe7698 Merge pull request 'Add optional pronoun field in user settings' (#1518) from hazy/forgejo:feat/pronoun-field into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1518
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Gergely Nagy <algernon@noreply.codeberg.org>
2024-04-06 12:23:54 +00:00
Gusted d5fd40821e Merge pull request 'feat: extend webfinger to respond to profile page URIs' (#2883) from realaravinth/forgejo:cb-2870 into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2883
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 12:21:35 +00:00
Mai-Lapyst ca8479c681
Update integration test 2024-04-06 11:19:32 +02:00
Earl Warren 3093f8765f Merge pull request 'Fix #3030 add Cache-Control header for health-check' (#3060) from adaaa/forgejo:cache-control-healthz into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3060
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 08:09:39 +00:00
Earl Warren 6077d10be3 Merge pull request 'feat: improve nuget nuspec api' (#2996) from viceice/forgejo:feat/nuget/nuspec-api into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2996
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2024-04-06 07:48:31 +00:00
Earl Warren a015ada29a Merge pull request '[BUG] fix webhook creation payload ref' (#3055) from oliverpool/forgejo:webhook_fix_create_payload_ref into forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/3055
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-04-06 07:25:20 +00:00