Commit Graph

38 Commits

Author SHA1 Message Date
zeripath
bbffcc3aec
Multiple Escaping Improvements (#17551)
There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
    
This is an extensive PR attempting to fix these issues.

1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future. 
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-11-16 18:18:25 +00:00
Lunny Xiao
99b2858e62
Move unit into models/unit/ (#17576)
* Move unit into models/unit/

* Rename unit.UnitType as unit.Type
2021-11-09 20:57:58 +01:00
zeripath
9302eba971
DBContext is just a Context (#17100)
* DBContext is just a Context

This PR removes some of the specialness from the DBContext and makes it context
This allows us to simplify the GetEngine code to wrap around any context in future
and means that we can change our loadRepo(e Engine) functions to simply take contexts.

Signed-off-by: Andrew Thornton <art27@cantab.net>

* fix unit tests

Signed-off-by: Andrew Thornton <art27@cantab.net>

* another place that needs to set the initial context

Signed-off-by: Andrew Thornton <art27@cantab.net>

* avoid race

Signed-off-by: Andrew Thornton <art27@cantab.net>

* change attachment error

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-09-23 23:45:36 +08:00
Lunny Xiao
a4bfef265d
Move db related basic functions to models/db (#17075)
* Move db related basic functions to models/db

* Fix lint

* Fix lint

* Fix test

* Fix lint

* Fix lint

* revert unnecessary change

* Fix test

* Fix wrong replace string

* Use *Context

* Correct committer spelling and fix wrong replaced words

Co-authored-by: zeripath <art27@cantab.net>
2021-09-19 19:49:59 +08:00
Lunny Xiao
e2f0ab3343
Add doctor dbconsistency check for release and attachment (#16978) 2021-09-14 20:41:40 +01:00
Lunny Xiao
ddc709ff7f
Add repo_id for attachment (#16958)
When create a new issue or comment and paste/upload an attachment/image, it will not assign an issue id before submit. So if user give up the creating, the attachments will lost key feature and become dirty content. We don't know if we need to delete the attachment even if the repository deleted.

This PR add a repo_id in attachment table so that even if a new upload attachment with no issue_id or release_id but should have repo_id. When deleting a repository, they could also be deleted.

Co-authored-by: 6543 <6543@obermui.de>
2021-09-08 17:19:30 +02:00
Lunny Xiao
a807031a30
Fix storage Iterate bug and Add storage doctor to delete garbage attachments (#16971)
* Fix storage Iterate bug and Add storage doctor to delete garbage attachments

* Close object when used
2021-09-06 16:46:20 +02:00
zeripath
0bb8bd8190
Add size to Save function (#15264)
Fix #15253

Signed-off-by: Andrew Thornton <art27@cantab.net>
2021-04-03 18:19:59 +02:00
Lunny Xiao
8567cba0d9
Implement delete release attachments and update release attachments' name (#14130)
* Implement delete release attachment

* Add attachments on release edit page

* Fix bug

* Finish del release attachments

* Fix frontend lint

* Fix tests

* Support edit release attachments

* Added tests

* Remove the unnecessary parameter isCreate from UpdateReleaseOrCreatReleaseFromTag

* Rename UpdateReleaseOrCreatReleaseFromTag to UpdateRelease

* Fix middle align
2021-03-23 00:09:51 +08:00
Bo-Yi Wu
167b0f46ef
chore(models): rewrite code format. (#14754)
* chore: rewrite format.

* chore: update format

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

* chore: update format

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

* chore: Adjacent parameters with the same type should be grouped together

* chore: update format.
2021-03-14 19:52:12 +01:00
6543
d453533beb
[Refactor] Move APIFormat functions into convert package (#12856)
* USER APIFormat -> ToUser

* Migrate more and mark APIFormat deprecated

* models.Comment APIFormat() -> convert.ToComment

* models.Release APIFormat() -> convert.ToRelease

* models.Attachments APIFormat() -> convert.ToReleaseAttachments

* models.CommitStatus APIFormat() -> convert.ToCommitStatus

* finish migration to convert.ToUser

* Move Test

* Imprufe Test

* fix test

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
2020-10-17 00:23:08 -04:00
Lunny Xiao
62e6c9bc6c
Add a storage layer for attachments (#11387)
* Add a storage layer for attachments

* Fix some bug

* fix test

* Fix copyright head and lint

* Fix bug

* Add setting for minio and flags for migrate-storage

* Add documents

* fix lint

* Add test for minio store type on attachments

* fix test

* fix test

* Apply suggestions from code review

Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>

* Add warning when storage migrated successfully

* Fix drone

* fix test

* rebase

* Fix test

* display the error on console

* Move minio test to amd64 since minio docker don't support arm64

* refactor the codes

* add trace

* Fix test

* remove log on xorm

* Fi download bug

* Add a storage layer for attachments

* Add setting for minio and flags for migrate-storage

* fix lint

* Add test for minio store type on attachments

* Apply suggestions from code review

Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>

* Fix drone

* fix test

* Fix test

* display the error on console

* Move minio test to amd64 since minio docker don't support arm64

* refactor the codes

* add trace

* Fix test

* Add URL function to serve attachments directly from S3/Minio

* Add ability to enable/disable redirection in attachment configuration

* Fix typo

* Add a storage layer for attachments

* Add setting for minio and flags for migrate-storage

* fix lint

* Add test for minio store type on attachments

* Apply suggestions from code review

Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>

* Fix drone

* fix test

* Fix test

* display the error on console

* Move minio test to amd64 since minio docker don't support arm64

* don't change unrelated files

* Fix lint

* Fix build

* update go.mod and go.sum

* Use github.com/minio/minio-go/v6

* Remove unused function

* Upgrade minio to v7 and some other improvements

* fix lint

* Fix go mod

Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
Co-authored-by: Tyler <tystuyfzand@gmail.com>
2020-08-18 12:23:45 +08:00
zeripath
74bd9691c6
Re-attempt to delete temporary upload if the file is locked by another process (#12447)
Replace all calls to os.Remove/os.RemoveAll by retrying util.Remove/util.RemoveAll and remove circular dependencies from util.

Fix #12339

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: silverwind <me@silverwind.io>
2020-08-11 21:05:34 +01:00
Lunny Xiao
1dd3f19ee3
Use google/uuid to instead satori/go.uuid (#11943)
Co-authored-by: Lauris BH <lauris@nix.lv>
2020-06-18 17:18:44 +08:00
Lunny Xiao
1645d4a5d8
Use ID or Where to instead directly use Get when load object from database (#11925)
* Use ID or Where to instead directly use Get when load object from database

* Apply suggestions from code review

Co-authored-by: 6543 <6543@obermui.de>

Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: zeripath <art27@cantab.net>
2020-06-17 20:50:11 +03:00
6543
e57ac841de
Fix potential bugs (#10513)
* use e if it is an option
* potential nil so check err first
* check err first
* m == nil already checked
2020-02-27 20:10:27 -03:00
zeripath
41294b53b3
Reading pull attachments should depend on read UnitTypePullRequests (#10346)
* Make pull attachments depend on read UnitTypePullRequests

Fixes #10336

* Fix test
2020-02-18 21:36:19 -03:00
Antoine GIRARD
8b24073713 Only serve attachments when linked to issue/release and if accessible by user (#9340)
* test: add current attachement responses

* refactor: check if attachement is linked and accessible by user

* chore: clean TODO

* fix: typo attachement -> attachment

* revert un-needed go.sum change

* refactor: move models logic to models

* fix TestCreateIssueAttachment which was wrongly successful

* fix unit tests with unittype added

* fix unit tests with changes

* use a valid uuid format for pgsql int. test

* test: add unit test TestLinkedRepository

* refactor: allow uploader to access unlinked attachement

* add missing blank line

* refactor: move to a separate function repo.GetAttachment

* typo

* test: remove err test return

* refactor: use repo perm for access checking generally + 404 for all reject
2020-01-05 01:20:08 +02:00
Antoine GIRARD
c3d31e5534 refactor(models/attachement): use getAttachmentsByUUIDs (#9317) 2019-12-11 00:01:52 +00:00
Lunny Xiao
d151503d34 Upgrade xorm to v0.8.0 (#8536) 2019-10-17 11:26:49 +02:00
Lunny Xiao
3249c0ccba
Extract actions on deletereleasebyid from models to release service (#8219)
* extract actions on deletereleasebyid from models to release service

* fix tests
2019-10-01 00:10:00 +08:00
Lunny Xiao
85202d4784
Display ui time with customize time location (#7792)
* display ui time with customize time location

* fix lint

* rename UILocation to DefaultUILocation

* move time related functions to modules/timeutil

* fix tests

* fix tests

* fix build

* fix swagger
2019-08-15 22:46:21 +08:00
Lunny Xiao
34eee25bd4
Move sdk structs to modules/structs (#6905)
* move sdk structs to moduels/structs

* fix tests

* fix fmt

* fix swagger

* fix vendor
2019-05-11 18:21:34 +08:00
Lunny Xiao
09fb036ad6 fix upload attachments (#6481)
* fix upload attachments

* add migration for new column uploader_id on table attachment

* fix imports sequence
2019-04-02 15:25:05 -04:00
gdeverlant
d3dc07f282 Added URL mapping for Release attachments like on github.com (#1707) 2019-01-06 17:37:30 -05:00
Jonas Franz
3e06490d38 Add Size column to attachment (#3734)
* Add size column to attachment
Migrate attachments by calculating file sizes

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Calculate attachment size on creation

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Log error instead of returning error

Signed-off-by: Jonas Franz <info@jonasfranz.software>
2018-03-31 09:10:44 +08:00
Jonas Franz
43fc430c07 Improve release page UI (#3693)
* Improve release page ui by adding size

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add documentation to a.MustSize()

Signed-off-by: Jonas Franz <info@jonasfranz.software>
2018-03-19 18:06:00 +02:00
Jonas Franz
9a5e628a7e Add Attachment API (#3478)
* Add Attachment API
* repos/:owner/:repo/releases (add attachments)
* repos/:owner/:repo/releases/:id (add attachments)
* repos/:owner/:repo/releases/:id/attachments
* repos/:owner/:repo/releases/:id/attachments/:attachment_id

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Add unit tests for new attachment functions
Fix comments

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* fix lint

* Update vendor.json

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* remove version of sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix unit tests
Add missing license header

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add CreateReleaseAttachment
Add EditReleaseAttachment
Add DeleteReleaseAttachment

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add filename query parameter for choosing another name for an attachment

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Fix order of imports

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Restricting updatable attachment columns

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* gofmt

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update go-sdk
Replace Attachments with Assets

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Update go-sdk

Signed-off-by: Jonas Franz <info@jonasfranz.de>

* Updating go-sdk and regenerating swagger

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Add missing file of go-sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Change origin of code.gitea.io/sdk to code.gitea.io/sdk
Update code.gitea.io/sdk

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update swagger

Signed-off-by: Jonas Franz <info@jonasfranz.software>

* Update updateAttachment
2018-03-06 09:22:16 +08:00
Lunny Xiao
f5155b9913 Small improve on deleting attachements (#3145)
* Small improve on deleting attachements

* improve the sequence of deletion
2017-12-24 23:04:22 +02:00
Lunny Xiao
956354885a simple usage of x (#3144) 2017-12-11 09:16:23 +02:00
Lunny Xiao
f2e20c81b6 Refactor struct's time to remove unnecessary memory usage (#3142)
* refactor struct's time to remove unnecessary memory usage

* use AsTimePtr simple code

* fix tests

* fix time compare

* fix template on gpg

* use AddDuration instead of Add
2017-12-11 06:37:04 +02:00
Lunny Xiao
a8717e5e3a Use AfterLoad instead of AfterSet on Structs (#2628)
* use AfterLoad instead of AfterSet on Structs

* fix the comments on AfterLoad

* fix the comments on action AfterLoad
2017-10-01 19:52:35 +03:00
Lunny Xiao
005900baea Use created & updated instead BeforeInsert & BeforeUpdate (#2482)
* use created & updated instead BeforeInsert & BeforeUpdate

* fix vendor checksum

* only show generated SQL when development mode

* remove extra update column updated_unix

* remove trace config
2017-09-13 08:18:22 +03:00
Lauris BH
6db387a21e Refactor session close as xorm already does everything needed internally (#2020) 2017-06-21 08:57:05 +08:00
Bo-Yi Wu
fa2a513c62 feat: add download count field and unit testing for attachment. (#1512)
* feat: add download count field and unit testing.

* fix: unit testing

* refactor: improve testing.

* fix: update comment

* add default value.

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
2017-04-20 10:31:31 +08:00
Ethan Koenig
136e6beb0f Fix unused Engine bugs (#1064) 2017-02-27 10:16:35 +08:00
Thomas Boerger
78535fb08e Allow custom public files (#782)
* Allow custom public files

* Gofmt code, lots of places not related to this pr
2017-01-28 23:14:56 +01:00
Philip Couling
1610b9f547 Spun attachments into seperate go file (#701)
Moved attachments into seperate go file
2017-01-20 07:58:46 +01:00