Commit graph

3 commits

Author SHA1 Message Date
Earl Warren a8538928f7
[DEADCODE] update deadcode-out
(cherry picked from commit ff0554a18464ff3c6bfaf9551984e8d2f54d8298)
(cherry picked from commit e9901814be58afa1aaa9c904b5b3e56e98bb96c5)
(cherry picked from commit 9ff7c41d53cc68e48a398bc666f82e94720899be)
(cherry picked from commit 9601dee4a3b792797df6207cd3431dd693e632bf)

[DEADCODE] update deadcode-out (squash) update

(cherry picked from commit aef379c5f5c3efa0dc959ea6e3b31acef43eb59a)
(cherry picked from commit 75473ea87af675b71dbae382199cd873627ac93c)

[DEADCODE] update deadcode-out (squash) update

(cherry picked from commit 868b7a436f37f2946d3b0095e3b91029876de5bb)
(cherry picked from commit 38787c8779bf461672dfef0b85a3bf4c1ffbf7ee)

[DEADCODE] update deadcode-out (squash) update again

(cherry picked from commit 91b2932907e0c21cb95bfcdff7258d0800273a51)
(cherry picked from commit 39adff772d209dd281d70412276cca5c72024243)
(cherry picked from commit 9f76193ea4c44d66c5ffc9506cae5156a15223ab)
(cherry picked from commit 8968396cbcbdf546f4cc6283b37a6e4fded56d74)
(cherry picked from commit f87e11e2ebdde6171b36bf8363b18d923f61fad3)
2024-02-05 15:08:04 +01:00
Gusted c6a53c3172
[SECURITY] Rework long-term authentication
- This is a 'front-port' of the already existing patch on v1.21 and
v1.20, but applied on top of what Gitea has done to rework the LTA
mechanism. Forgejo will stick with the reworked mechanism by the Forgejo
Security team for the time being. The removal of legacy code (AES-GCM) has been
left out.
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit e3d6622a63da9c33eed1e3d102cf28a92ff653d6)
(cherry picked from commit fef1a6dac5e25579e42d40209c4cfc06879948b9)
(cherry picked from commit b0c5165145fa52f2f7bbec1f50b308bdf1d20ef3)
(cherry picked from commit 7ad51b9f8d0647eecacd258f6ee26155da3872e1)
(cherry picked from commit 64f053f3834e764112cde26bb0d16c5e88d6b2af)
(cherry picked from commit f5e78e4c204ce50b800645d614218b6b6096eecb)

Conflicts:
	services/auth/auth_token_test.go
	https://codeberg.org/forgejo/forgejo/pulls/2069
(cherry picked from commit f69fc23d4bbadf388c7857040ee0774b824e418e)
(cherry picked from commit d955ab3ab02cbb7f1245a8cddec426d64d3ac500)
(cherry picked from commit 9220088f902a25c4690bcabf5a40a8d02e784182)
(cherry picked from commit c73ac636962c41c71814c273510146f0533264ab)
(cherry picked from commit 747a176048ea93085b406429db0e25bb21912eda)

Conflicts:
	models/user/user.go
	routers/web/user/setting/account.go
	https://codeberg.org/forgejo/forgejo/pulls/2295
2024-02-05 15:06:15 +01:00
Gusted 089f51a63c
[DEADCODE] Add deadcode linter
- Add the experimental
[deacode](https://pkg.go.dev/golang.org/x/tools/internal/cmd/deadcode)
linter to Forgejo.
- To deal with false positives that can happen due to build tags or with code
that's currently only referenced by test code, the output of the tool is
compared against a known-good output.
- This commit doesn't make any attempt to remove any deadcode.

(cherry picked from commit ac462279e9361070326d512fc209b6f148f27865)
(cherry picked from commit b5ea6e85acecb8c02d18d51ec489bb1d329a33ce)
(cherry picked from commit 5915f3643c1939ab09dcac8f9fcb74bd4231a16d)

[CLEANUP] Remove deadcode

- This is deadcode since https://codeberg.org/forgejo/forgejo/pulls/1802
removed the usage of it.

(cherry picked from commit d840b9923e1a7aad7306c6b4d02df771ed0f40f4)
(cherry picked from commit 9442bab6266807141a14a647d3bc383233fc56e9)
(cherry picked from commit 0de9d18863c6af44941c7021548cdb07173ba3c0)
(cherry picked from commit 26abf783746ef29e66eea966160e2f9c139add26)
(cherry picked from commit 05d3a143c3785f3cc5e7f561aa2ad2ba556b55cc)
(cherry picked from commit 4b3d38d5e15b0fd02839d5687b634e7999e12666)
(cherry picked from commit a726e7198613b330a58c8c6dfc8866c360fbe555)
(cherry picked from commit cb62ae5b9885bcd5c2b6cb60f0e9cce6a991cc3c)
(cherry picked from commit 8195ba06d52fc1a05e9907149bb441b66887870e)
(cherry picked from commit 4570fb591aac0359a36800c8cadcd71613bdc7df)
(cherry picked from commit 1f4d33de2b68c776a305fe38fe6be5ae510ce983)
2024-02-05 14:45:09 +01:00