Commit graph

12303 commits

Author SHA1 Message Date
zeripath
bbffcc3aec
Multiple Escaping Improvements (#17551)
There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
    
This is an extensive PR attempting to fix these issues.

1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-16 18:18:25 +00:00
Lunny Xiao
7e1ae38097
Move migrations into services and base into modules/migration (#17663)
* Move migrtions into services and base into modules/migration

* Fix imports

* Fix lint
2021-11-16 23:25:33 +08:00
Lunny Xiao
48ccd325a1
Move some functions into services/repository (#17660) 2021-11-16 21:30:11 +08:00
Gusted
447428f446
Remove superfluous argument (#17667)
As title.
2021-11-16 19:36:03 +08:00
wxiaoguang
81926d61db
Decouple unit test, remove intermediate unittestbridge package (#17662)
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-16 16:53:21 +08:00
silverwind
23bd7b1211
Add copy button to markdown code blocks (#17638)
* Add copy button to markdown code blocks

Done mostly in JS because I think it's better not to try getting buttons
past the markup sanitizer.

* add svg module tests

* fix sanitizer regexp

* remove outdated comment

* vertically center button in issue comments as well

* add comment to css

* fix undefined on view file line copy

* combine animation less files

* Update modules/markup/markdown/markdown.go

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

* add test for different sizes

* add cloneNode and add tests for it

* use deep clone

* remove useless optional chaining

* remove the svg node cache

* unify clipboard copy string and i18n

* remove unused var

* remove unused localization

* minor css tweaks to the button

* comment tweak

* remove useless attribute

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-16 16:16:05 +08:00
Lunny Xiao
d789670894
Migrating wiki don't require token, so we should move it out of the require form (#17645)
* Migrating wiki don't require token, so we should move it out of the require form

* Fix lint
2021-11-16 14:17:21 +08:00
silverwind
6f7082ff56
Fix GitBucket icon (#17644)
Partial fix for https://github.com/go-gitea/gitea/issues/17642.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-16 12:24:22 +08:00
wxiaoguang
6292603215
Fix database deadlock when update issue labels (#17649)
This fix updates issue labels one by one, and won't cause database deadlock.
In future, we can use a batch API to update all changed labels by one request.
2021-11-16 10:21:13 +08:00
GiteaBot
3a60e0ad89 [skip ci] Updated translations via Crowdin 2021-11-16 00:25:21 +00:00
KN4CK3R
ff9564a679
Changed migration text. (#17654) 2021-11-15 18:12:09 -05:00
Gusted
ab1379743e
Fix nil checking on typed interface (#17598)
* Fix nil checking on typed interface

- Partially resoles #17596
- Resolves SA4023 errors.
- Ensure correctly that typed interface are nil.

* Remove unnecessary code

`NewBleveIndexer` will never return nil, even on errors.

* Patch `NewBleveIndexer`

* Fix low-level functions

* Remove deadcode

* Fix GetSession

* Close Elastic search when err isn't nil

* Update elastic_search.go

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-15 21:16:11 +08:00
Gusted
253d9e4158
Remove unnecassary calls to filepath.Join (#17608)
- Partialy resolvess #17596
- Resolves `badCall` errors from go-critic `badCall: suspicious Join on
1 argument`
- When only 1 argument is passed into `filepath.Join`, it won't do
anything special other than `filepath.Clean(...)` will be applied over
it.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: 6543 <6543@obermui.de>
2021-11-15 14:02:53 +08:00
Gusted
562785ef4e
Add download button for file viewer (#17640)
- Resolves #17286
- Use the `download` attribute such that the browser will natively
initate a download dialog for the given URL.

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2021-11-15 09:05:12 +08:00
GiteaBot
10db864c66 [skip ci] Updated translations via Crowdin 2021-11-15 00:24:54 +00:00
缘生
83a04e42cc
fix typo (#17614) 2021-11-14 17:32:48 -05:00
silverwind
cd32b84811
Add icon to vscode clone link (#17641) 2021-11-14 16:48:26 -05:00
KN4CK3R
42ea0023a3
Add migration from GitBucket (#16767)
This PR adds [GitBucket](https://gitbucket.github.io/) as migration source.

Supported:
- Milestones
- Issues
- Pull Requests
- Comments
- Reviews
- Labels

There is no public usable instance so no integration tests added.
2021-11-14 20:11:10 +01:00
Gusted
d2163df6a0
Fix offBy1 errors (#17606)
* Fix offBy1 errors

- Partially resolves #17596
- Resolve errors from go-critic `offBy1: Index() can return -1; maybe
you wanted to do Index()+1`.

* Match golang spec

* Remove comments

* Update migrations.go

* Apply suggestions from code review

Co-authored-by: delvh <dev.lh@web.de>

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-14 10:11:49 +02:00
Gusted
8eddb75508
perf: only generate data-comment-url once (#17618) 2021-11-14 00:28:57 -05:00
GiteaBot
424959e07c [skip ci] Updated licenses and gitignores 2021-11-14 00:26:06 +00:00
zeripath
bab95c3a86
Correctly handle failed migrations (#17575)
* Correctly handle failed migrations

There is a bug in handling failed migrations whereby the migration task gets decoupled
from the migration repository. This leads to a failure of the task to get deleted with
the repository and also leads to the migration failed page resulting in a ISE.

This PR removes the zeroing out of the task id from the migration but also makes
the migration handler tolerate missing tasks much nicer.

Fix #17571

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-13 19:28:50 +08:00
Michael Grigoryan
47448083a1
Minor readability patch. (#17627) 2021-11-12 18:27:18 -05:00
wxiaoguang
df64fa4865
Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
wxiaoguang
7f802631c5
Fix some incorrect async functions, improve frontend document. (#17597) 2021-11-12 20:37:45 +08:00
Lunny Xiao
0db7a32b92
unbind the CheckConsistency for some structs so that they can be moved to sub packages easier (#17612)
* unbind the CheckConsistency for some structs so that they can be moved to sub packages easier

* Fix functions name

* Fix typo
2021-11-12 08:56:45 +08:00
Lunny Xiao
90eb9fb889
Move EmailAddress & UserRedirect into models/user/ (#17607)
* Move EmailAddress into models/user/

* Fix test

* rename user_mail to user_email

* Fix test

* Move UserRedirect into models/user/

* Fix lint & test

* Fix lint

* Fix lint

* remove nolint comment

* Fix lint
2021-11-11 15:03:30 +08:00
Gusted
492e1c2fbd
Refactor commentTags functionality (#17558)
* feat: Allow multiple tags on comments

- Allow for multiples tags(Currently Poster + {Owner, Writer}).
- Utilize the Poster tag within the commentTag function and remove the
checking from templates.
- Use bitwise on CommentTags to enable specific tags.
- Don't show poster tag(view_content.tmpl) on the initial issue comment.

* Change parameters naming

* Change function name

* refactor variable wording

* Merge 'master' branch into 'tags-comments' branch

* Change naming

* `tag` -> `role`

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-11 14:29:30 +08:00
Gusted
a4dc0c5a82
Remove golint as linter (#17609)
- Partialy resolvess #17596
- In the newer versions of `golangci-lint`, golint is  deprecated and
replaced by the `revive` linter. Thus removing the `golint` linter is a
good idea, as we're already using the `revive` linter which covers all
the current `golint` cases.

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-11 13:28:45 +08:00
silverwind
433e81aecf
Update JS dependencies (#17611)
- Update monaco, adapting to breaking changes
- Update dropzone, adapting to breaking changes
- Update linters, fix new issues, disable opinionated stylelint rules
- Rebuild SVGs and images
- Tested Dropzone and Monaco

Replaces: https://github.com/go-gitea/gitea/pull/17574
2021-11-11 09:52:16 +08:00
Lunny Xiao
0e189eecaa
Move oauth2 error to oauth2 service package (#17603) 2021-11-11 01:51:09 +08:00
Lunny Xiao
43bbc54783
Fix 500 when a comment was deleted which has a notification (#17550)
* Fix 500 when a comment was deleted which has a notification

* Tolerate missing Comment in other places too

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-10 13:48:45 +08:00
Lunny Xiao
33fca2b537
Move webhook into models/webhook/ (#17579) 2021-11-10 13:13:16 +08:00
KN4CK3R
edbaa5d3f0
Added GetUserByIDCtx. (#17602)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-09 22:21:01 -05:00
GiteaBot
465fb4169e [skip ci] Updated translations via Crowdin 2021-11-10 00:25:15 +00:00
Lunny Xiao
99b2858e62
Move unit into models/unit/ (#17576)
* Move unit into models/unit/

* Rename unit.UnitType as unit.Type
2021-11-09 20:57:58 +01:00
wxiaoguang
b6b1e71665
tune sqlite3 message (#17601) 2021-11-09 13:55:24 -05:00
Andrey Nering
aa4355ba1f
Remove me from the maintainers (#17599)
I haven't being involved in a while.
2021-11-09 22:40:16 +08:00
Lunny Xiao
d6d147c2c4
Fix 500 when review pull request with anonymous (#17594) 2021-11-09 13:14:12 +00:00
Gusted
062b051687
Move merge-section to > .content (#17582)
* Move `> .merge-section` to `> .content` scope

- Fixes a issue that started from
https://github.com/go-gitea/gitea/pull/17317
- Move `> .merge-section` to the `> .content` scope.
- Resolves #17480

* Move `.merge-section` back to outside scope

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2021-11-09 19:56:15 +08:00
wxiaoguang
a5b4720b91
Update User model comments about permissions (#17583) 2021-11-09 18:42:58 +08:00
wxiaoguang
bb71ceeeb2
Improve async/await usage, and sort init calls in index.js (#17386)
* clean up async/await, and sort init calls in `index.js
* use `const _promise` to indicate that we do not need await an async function
2021-11-09 17:27:25 +08:00
Gusted
3a693bd18c
Use provided database Engine (#17595)
- Don't get the engine from `db.DefaultContext`, instead use the
provided one which is passed as paramater `e`.
2021-11-09 08:54:46 +00:00
Lunny Xiao
03de593402
Fix bug on detect issue/comment writer (#17591) 2021-11-09 15:44:12 +08:00
Kamil Domański
021df29623
Allow U2F 2FA without TOTP (#11573)
This change enables the usage of U2F without being forced to enroll an TOTP authenticator.
The `/user/auth/u2f` has been changed to hide the "use TOTP instead" bar if TOTP is not enrolled.

Fixes #5410
Fixes #17495
2021-11-08 23:47:19 +01:00
Gusted
a3f9e9234c
Fix stats upon searching issues (#17566)
* Fix stat chunks searching

- Fixes a issue whereby the given chunk of issueIDs wasn't respected and
thus the returned results where not the correct results.

* Add tests

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: zeripath <art27@cantab.net>
2021-11-08 23:14:46 +02:00
Gusted
640f0e1ddf
Only allow returned deleted branche to be on repo (#17570)
- This will only allow `GetDeletedBranchByID` to return deletedBranch
which are on the repo, and thus don't return a deletedBranch from
another repo.
- This just should prevent possible bugs in the futher when a code is
passing the wrong ID into this function.
2021-11-08 23:45:37 +08:00
Gusted
ebaf4c48ea
Avoid double imports (#17569)
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2021-11-08 09:04:13 +02:00
zeripath
513951bc16
Remove appSubUrl from pasted images (#17572)
* Remove appSubUrl from pasted images

Since we fixed the url base for the links in repositories we no longer need to add
the appsuburl to pasted image links.

Fix #17057

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-08 14:27:40 +08:00
wxiaoguang
d168f0498b
Fix documents for ALLOWED_HOST_LIST, its default value differs between 1.15 and 1.16 (#17530)
* fix documents for ALLOWED_HOST_LIST, its default value differs between 1.15 and 1.16
2021-11-08 11:25:41 +08:00