mirror/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-11-15 06:26:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 9
16186 commits 19 branches 233 tags 621 MiB
Commit graph

16186 commits

This branch
This branch
All branches
Author SHA1 Message Date
Gusted
ef05332c3b
[SECURITY] Fix XSS in wiki last commit information 
- On the wiki and revisions page, information is shown about the last
commit that modified that wiki page. This includes the time it was last
edited and by whom. That whole string is not being sanitized (passed
trough `Safe` in the templates), because the last edited bit is
formatted as an HTML element and thus shouldn't be sanitized. The
problem with this is that now `.Author.Name` is not being sanitized.
- This can be exploited, the names of authors and commiters on a Git
commit is user controlled, they can be any value and thus also include
HTML. It's not easy to actually exploit this, as you cannot use the
official git binary to do use, as they actually strip `<` and `>` from
user names (trivia: this behaviour was introduced in the initial commit
of Git). In the integration testing, go-git actually has to generate
this commit as they don't have such restrictions.
- Pass `.Author.Name` trough `Escape` in order to be sanitized.

(cherry picked from commit d24c37e132)

Conflicts:
	templates/repo/wiki/revision.tmpl
	templates/repo/wiki/view.tmpl
	trivial context conflict
 2024-02-22 22:36:14 +01:00
jolheiser
09635b6b12
[SECURITY] review(kn4ck3r): more template escapes 
Signed-off-by: jolheiser <john.olheiser@gmail.com>
(cherry picked from commit 33af169223)

Conflicts:
	templates/repo/migrate/migrating.tmpl
	templates/repo/settings/options.tmpl
	trivial context conflict
 2024-02-22 22:33:06 +01:00
Earl Warren
496b0acd22 Merge pull request '[CI] fix the release simulation test' (#2123) from earl-warren/forgejo:wip-ci-release-simulation into v1.20/forgejo 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2123
Reviewed-by: Loïc Dachary <dachary@noreply.codeberg.org>
 2024-01-09 13:36:28 +00:00
Earl Warren
fcf3261cba
[CI] fix the release simulation test 2024-01-09 13:26:57 +01:00
Earl Warren
aa8dd51dc1
[CI] Forgejo Actions based release process (squash) no ownca 
The private Forgejo instance trusted with the release signing keys no
longer requires the installation of the ownca certificate authority.

Refs: https://codeberg.org/forgejo/docs/pulls/338
(cherry picked from commit 72f9ae796d)
 2023-12-28 17:29:00 +01:00
Earl Warren
ad93e1ad2d
[GITEA] Update crypto dependency 2023-12-20 00:25:39 +01:00
Earl Warren
bfb5a97d8c
[CI] upgrade moved to https://code.forgejo.org/forgejo/end-to-end/ 2023-12-19 23:48:15 +01:00
Earl Warren
8c786eb2ed
[SEMVER] 5.0.8+0-gitea-1.20.6 2023-12-12 22:31:25 +01:00
Lunny Xiao
7aa1e1a54d
Do some missing checks (#28423) 
(cherry picked from commit 717d0f5934)

Conflicts:
	routers/api/v1/api.go
	trivial contextual conflict
 2023-12-12 22:25:17 +01:00
Gusted
5528072d04 Merge pull request '[GITEA] Add download URL for executable files' (#1847) from Gusted/forgejo:forgejo-bp-1839-120 into v1.20/forgejo 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1847
 2023-12-05 22:50:55 +00:00
Gusted
7f0c874781 [GITEA] Add download URL for executable files 
- Backport https://codeberg.org/forgejo/forgejo/pulls/1839
- Consider executable files as a valid case when returning a downloadURL
for them. They are just regular files with the difference being the
executable permission bit being set.
- Not integration testing as it's not possible without adding adjusting
the existing repositories to have a executable file.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1825

(cherry picked from commit ca32891d54)
 2023-12-04 18:35:04 +00:00
Gergely Nagy
b4947b78e7 [GITEA] new doctor check: fix-push-mirrors-without-git-remote (#1853) 
This is the same as https://codeberg.org/forgejo/forgejo/pulls/1853, backported to v1.20/forgejo.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1855
Co-authored-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Co-committed-by: Gergely Nagy <forgejo@gergo.csillger.hu>
 2023-12-01 13:52:27 +00:00
Gusted
c722ce6cd4 Merge pull request '[DB] Ensure forgejo migration up to date (squash)' (#1851) from Gusted/forgejo:forgejo-bp-1849-120 into v1.20/forgejo 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/1851
 2023-11-28 23:05:09 +00:00
Gusted
457564044a
[DB] Ensure forgejo migration up to date (squash) 
- Backport https://codeberg.org/forgejo/forgejo/pulls/1849
- Hook Forgejo's `EnsureUpToDate` to Gitea's `EnsureUpToDate`, such that
the Forgejo migrations are also being checked to be up to date.
- I'm not sure how I missed this and if this has caused any problems,
but due to the lack of any open issue about it it seems to not be a big
problem.

(cherry picked from commit 6c65b6dcf6)
 2023-11-28 23:28:06 +01:00
Earl Warren
684f56dd6d
[SEMVER] 5.0.7+0-gitea-1.20.6 2023-11-26 07:28:43 +01:00
Loïc Dachary
e286a15034
test GET /{owner}/{repo}/comments/{id}/attachments 
(cherry picked from commit 888dda12cf9bc95f9ef85ba5a518cf40152e07ea)
(cherry picked from commit 4903135a93)
 2023-11-26 06:50:26 +01:00
Loïc Dachary
92450913a8
fix POST /{username}/{reponame}/{type:issues|pulls}/move_pin 
(cherry picked from commit d97efb777f)
 2023-11-26 06:50:26 +01:00
Loïc Dachary
1c18625ac5
test POST /{username}/{reponame}/{type:issues|pulls}/move_pin 
(cherry picked from commit 52f50792606a22cbf1e144e1bd480984abf6f53f)
(cherry picked from commit 1e5940b020)
 2023-11-26 06:50:26 +01:00
Loïc Dachary
f1c5e63fe1
test POST /{username}/{reponame}/{tags,release}/delete 
(cherry picked from commit 463d713fac)
 2023-11-26 06:48:49 +01:00
Loïc Dachary
494728f919
test GET /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/detail 
(cherry picked from commit c0cf68e381)
 2023-11-26 06:48:49 +01:00
Loïc Dachary
9ea9ba8e7e
fix POST /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/soft-delete 
(cherry picked from commit a82cb96480)
 2023-11-26 06:48:49 +01:00
Loïc Dachary
381c66ddef
test POST /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/soft-delete 
(cherry picked from commit 6edae51a23)
 2023-11-26 06:48:49 +01:00
Loïc Dachary
9ce97ac685
test POST /{owner}/{repo}/comments/{id} 
Conflicts:
	tests/integration/issue_test.go

(cherry picked from commit 9c14e4f103)
 2023-11-26 06:40:03 +01:00
Loïc Dachary
ed87de558f
test DELETE /api/v1/repos/{owner}/{repo}/issues/comments/{id} 
Conflicts:
	tests/integration/api_comment_test.go

(cherry picked from commit 236c5e172c)
 2023-11-26 06:40:03 +01:00
Loïc Dachary
dac56f7ed7
test PATCH /api/v1/repos/{owner}/{repo}/issues/comments/{id} 
Conflicts:
	tests/integration/api_comment_test.go

(cherry picked from commit 49a246f407)
 2023-11-26 06:40:03 +01:00
Lunny Xiao
db0d71ec0f
Fix comment permissions (#28213) (#28217) 
backport #28213

This PR will fix some missed checks for private repositories' data on
web routes and API routes.

(cherry picked from commit dfd511faf3)
 2023-11-26 06:35:50 +01:00
Loïc Dachary
a7a9876dd4
Revert "enforce reqRepoReader(unit.TypeIssues) GET /repos/{owner}/{repo}/issues/pinned" 
This reverts commit c70eb32280.
 2023-11-26 06:34:40 +01:00
Loïc Dachary
140dbb3918
Revert "enforce reqRepoReader(unit.TypeIssues) POST /repos/{owner}/{repo}/issues" 
This reverts commit 6b4cb070cc.
 2023-11-26 06:34:40 +01:00
Loïc Dachary
d2de912c95
Revert "fix API usage of a PR index in place of issue index and vice versa" 
This reverts commit 3ddfca10ac.
 2023-11-26 06:34:40 +01:00
Loïc Dachary
a6adf7fc01
Revert "test PATCH /api/v1/repos/{owner}/{repo}/issues/comments/{id}" 
This reverts commit 8726ce2635.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
4ece6a4b19
Revert "fix PATCH /api/v1/repos/{owner}/{repo}/issues/comments/{id}" 
This reverts commit e291ea5e33.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
8aed1fa594
Revert "test GET /api/v1/repos/{owner}/{repo}/issues/comments/{id}/assets/{attachment_id}" 
This reverts commit e02448bbf5.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
d0bafb6775
Revert "test {DELETE,POST} /repos/{owner}/{repo}/issues/comments/{id}/reactions" 
This reverts commit f59a6cc0e4.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
ba352ef4b1
Revert "fix {DELETE,POST} /repos/{owner}/{repo}/issues/comments/{id}/reactions" 
This reverts commit 685ebdba63.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
d8204f3e8f
Revert "test GET /repos/{owner}/{repo}/issues/comments/{id}/reactions" 
This reverts commit 2af5a75d71.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
3869f80b52
Revert "fix GET /repos/{owner}/{repo}/issues/comments/{id}/reactions" 
This reverts commit 585f74c2ca.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
5209a09375
Revert "test DELETE /api/v1/repos/{owner}/{repo}/issues/comments/{id}" 
This reverts commit 939a66e25c.
 2023-11-26 06:34:39 +01:00
Loïc Dachary
fc3825f6b2
Revert "fix DELETE /api/v1/repos/{owner}/{repo}/issues/comments/{id}" 
This reverts commit 0b0b506b74.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
9d8249d9d6
Revert "test POST /{owner}/{repo}/comments/{id}/delete" 
This reverts commit d2c16d9c2d.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
c21cc34116
Revert "fix POST /{owner}/{repo}/comments/{id}/delete" 
This reverts commit 44f2592028.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
027e3a7206
Revert "test POST /{owner}/{repo}/comments/{id}" 
This reverts commit 0d7893ca8a.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
db1bd78d71
Revert "fix POST /{owner}/{repo}/comments/{id}" 
This reverts commit 5cc6361e31.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
5fc5d186e0
Revert "fix POST /{owner}/{repo}/comments/{id}/reactions/{action}" 
This reverts commit 6f87e71f0c.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
2e1d6d2ef2
Revert "test GET /{owner}/{repo}/comments/{id}/attachments" 
This reverts commit 4903135a93.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
710eee48a1
Revert "fix GET /{owner}/{repo}/comments/{id}/attachments" 
This reverts commit 48bcb1937e.
 2023-11-26 06:34:38 +01:00
Loïc Dachary
e587faae57
Revert "fix POST /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/soft-delete" 
This reverts commit 75730a6ded.
 2023-11-26 06:34:37 +01:00
Loïc Dachary
d7f5ff0782
Revert "fix GET /{username}/{reponame}/{type:issues|pulls}/{index}/content-history/detail" 
This reverts commit 5ef4992fd7.
 2023-11-26 06:34:37 +01:00
Loïc Dachary
15cc486204
Revert "test POST /{username}/{reponame}/{tags,release}/delete" 
This reverts commit d7b11f5378.
 2023-11-26 06:34:37 +01:00
Loïc Dachary
53115c7c17
Revert "fix POST /{username}/{reponame}/{tags,release}/delete" 
This reverts commit a2b1082dda.
 2023-11-26 06:34:37 +01:00
Loïc Dachary
98098de1f7
Revert "test GET /api/v1/repos/{owner}/{repo}/keys/{id}" 
This reverts commit d095e4fdc5.
 2023-11-26 06:34:37 +01:00