Commit Graph

26 Commits

Author SHA1 Message Date
Michael Kuhn
0222623be9 Explicitly disable Git credential helper (#5367)
* Explicitly disable Git credential helper

If the user running Gitea has configured a credential helper, Git
credentials might leak out of Gitea.

There are two problems with credential helpers when combined with Gitea:

1. Credentials entered by a user when doing a migration or setting up a
   mirror will end up in the credential store. In the worst case, this
   is the plain text file ~/.git-credentials.
2. Credentials in the credential store will be used for migrations and
   mirrors by all users. For example, if user A sets up a mirror, their
   credentials will be stored. If user B later sets up a mirror from the
   same host and does not enter any credentials, user A's credentials
   will be used.

This PR prepends -c credential.helper= to all Git commands to clear the
list of helpers. This requires at least Git version 2.9, as previous
versions will try to load an empty helper instead. For more details, see
24321375cd

* Update git module
2018-11-28 09:00:25 +02:00
Lauris BH
08bf443016 Implement git refs API for listing references (branches, tags and other) (#5354)
* Inital routes to git refs api

* Git refs API implementation

* Update swagger

* Fix copyright

* Make swagger happy add basic test

* Fix test

* Fix test again :)
2018-11-27 16:52:20 -05:00
Peter Hoffmann
e08c7e521b Add raw blob endpoint to get objects by SHA ID (#5334)
* Add raw blob endpoint

This should make it possible to download raw blobs directly from
/:repo/:username/raw/blob/:sha1 URLs.

* fix: Make it work

* As an SHA-ID is no path getRefNameFromPath can't be used to verify
file specifying parameter
* added relevant change in go-gitea/git #132

Signed-off-by: Berengar W. Lehr <Berengar.Lehr@kompetenztest.de>

* Update Gopkg.lock

Can't update all vendors due to errors

Signed-off-by: Berengar W. Lehr <Berengar.Lehr@kompetenztest.de>

* style: Add Gitea copyright header

* feat: Added integration test for /repo/u/r/raw/blob

* fix: correct year in copyright header
2018-11-18 13:45:40 -05:00
Antoine GIRARD
4c1f1f9646 Remove x/net/context vendor by using std package (#5202)
* Update dep github.com/markbates/goth

* Update dep github.com/blevesearch/bleve

* Update dep golang.org/x/oauth2

* Fix github.com/blevesearch/bleve to c74e08f039e56cef576e4336382b2a2d12d9e026

* Update dep golang.org/x/oauth2
2018-11-10 18:55:36 -05:00
Lunny Xiao
b3000ae623 Fix create team, update team missing units (#5188) 2018-11-10 14:45:32 -05:00
Stanislav
078c404c3b Prometheus endpoint (#5256)
* Add prometheus collector and route

* dep ensure -add github.com/prometheus/client_golang/prometheus

* dep ensure -update github.com/golang/protobuf

* add metrics to reserved usernames

* add comment head in metrics package

* fix style imports

* add metrics settings

* add bearer token check

* mapping metrics configs

* fix lint

* update config cheat sheet

* update conf sample, typo fix
2018-11-04 22:20:00 -05:00
Peter Hoffmann
fb14458010 fix: Add secret to all webhook's payload where it has been missing (#5199)
* fix: Add secret to all webhook's payload where it has been missing

affects webhooks for:
* Delete
* Fork
* IssueComment
* Release
2018-10-28 18:03:02 -04:00
Antonio Huete Jimenez
99c09dfbfa Update vendor/golang.org/x/sys (#5059) 2018-10-26 19:18:40 -04:00
Antoine GIRARD
2af57c7820 Update x/net (#5169) 2018-10-26 19:05:56 -04:00
Kim "BKC" Carlbäcker
aeb5655c25 Update go-macaron/session to latest mast to fix RCE-bug (#5177) 2018-10-25 19:53:39 +08:00
Mura Li
317ddb7283 Update vendor/github.com/mattn/go-sqlite3 (#5162)
To fix build failure on Windows/386
2018-10-24 16:18:51 +08:00
Mura Li
2ce72d4e00 Update vendor/go-sqlite3 (#5133) 2018-10-23 13:28:10 +08:00
Mura Li
dba955be7c Upgrade gopkg.in/testfixtures.v2 (#4999) 2018-10-02 15:20:02 -04:00
Lauris BH
ab5b245182 Disable debug routes unless PPROF is enabled in configuration (#4995) 2018-09-29 18:44:06 -04:00
OvermindDL1
07af31d004 Fix #4877 to follow the OpenID Connect Audiences spec (#4878)
Signed-off-by: Gabriel Robertson <overminddl1@gmail.com>
2018-09-20 22:17:34 +03:00
Lauris BH
fa4663e61e Add push webhook support for mirrored repositories (#4127) 2018-09-06 22:06:09 -04:00
EnricoFerro
912953e82a API /admin/users/{username} missing parameter (#4775) 2018-08-23 19:59:47 -04:00
Fluf
b82c14b3d2 add letsencrypt to Gitea (#4189) 2018-08-21 09:56:50 -04:00
Lauris BH
0c59edaafa Update xorm to latest version and fix correct user table referencing in sql (#4473) 2018-07-20 10:10:17 +08:00
techknowlogick
ab55ca7ebd
Add ability to delete a token (#4235)
Fix #4234
2018-07-06 21:54:30 -04:00
Antoine GIRARD
74f9f98f78 Simply remove tidb and deps (#3993) 2018-07-04 16:23:23 -04:00
techknowlogick
9d4c1ddfa1
Dep upgrade mysql lib (#4161)
*  update gopkg file to add sql dep
2018-07-03 17:58:31 -04:00
David Schneiderbauer
0be2b34cec update git vendor (#4059) 2018-05-27 21:47:34 +03:00
Magnus Lindvall
cdb9478774 LDAP Public SSH Keys synchronization (#1844)
* Add LDAP Key Synchronization feature

Signed-off-by: Magnus Lindvall <magnus@dnmgns.com>

* Add migration: add login source id column for public_key table

* Only update keys if needed

* Add function to only list pubkey synchronized from ldap

* Only list pub ssh keys synchronized from ldap. Do not sort strings as ExistsInSlice does it.

* Only get keys belonging to current login source id

* Set default login source id to 0

* Some minor cleanup. Add integration tests (updete dep testify)
2018-05-24 07:59:02 +03:00
Aleksandr Bulyshchenko
ee878e3951 Support secure cookie for csrf-token (#3839)
* dep: Update github.com/go-macaron/csrf

Update github.com/go-macaron/csrf with dep to revision 503617c6b372
to fix issue of csrf-token security.

This update includes following commits:
- Add support for the Cookie HttpOnly flag
- Support secure mode for csrf cookie

Signed-off-by: Aleksandr Bulyshchenko <A.Bulyshchenko@globallogic.com>

* routers: set csrf-token security depending on COOKIE_SECURE

Signed-off-by: Aleksandr Bulyshchenko <A.Bulyshchenko@globallogic.com>
2018-05-22 02:09:48 +03:00
Antoine GIRARD
3f3383dc0a Migrate to dep (#3972)
* Update makefile to use dep

* Migrate to dep

* Fix some deps

* Try to find a better version for golang.org/x/net

* Try to find a better version for golang.org/x/oauth2
2018-05-21 15:34:20 +03:00