Backport #35584 by @shashank-netapp
# Summary
The Gitea codebase was logging `Elasticsearch` and `Meilisearch`
connection strings directly to log files without sanitizing them. Since
connection strings often contain credentials in the format
`protocol://username:password@host:port`, this resulted in passwords
being exposed in plain text in log output.
Fix:
- wrapped all instances of setting.Indexer.RepoConnStr and
setting.Indexer.IssueConnStr with the `util.SanitizeCredentialURLs()`
function before logging them.
Fixes: #35530
Co-authored-by: shashank-netapp <108022276+shashank-netapp@users.noreply.github.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #35604 by @silverwind
The test calls out to a web service which may be down or unreachable as
seen in the linked issue. It's better for tests to not have such
external dependencies to make them absolutely stable.
Fixes: https://github.com/go-gitea/gitea/issues/35571
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #35410 by ahanoff
Fixes#35159
Swift Package Manager expects an 'author.name' field in package
metadata, but Gitea was only providing schema.org format fields
(givenName, middleName, familyName). This caused SPM to fail with
keyNotFound error when fetching package metadata.
Changes:
- Add 'name' field to Person struct (inherited from
https://schema.org/Thing)
- Populate 'name' field in API response using existing String() method
- Maintains backward compatibility with existing schema.org fields
- Provides both formats for maximum compatibility
The fix ensures Swift Package Manager can successfully resolve packages
while preserving full schema.org compliance.
Co-authored-by: Akhan Zhakiyanov <ahanoff@gmail.com>
Backport #35402 by @silverwind
As per https://github.com/bitnami/containers/issues/83267, my
understanding is that the `docker.io/bitnami` images will be deleted on
September 29.
To prevent this failure mode, use the images on the `bitnamilegacy` org
instead which are snapshots from when they stopped updating them.
Long-term, we should replace these images with official ones.
Co-authored-by: silverwind <me@silverwind.io>
Backport #35287 by @alexblackie
GitHub changed where the attachments on releases are stored, which means
repo migrations with releases now fail because the redirect URLs don't
match the base URL validation. We need to update the base URL check to
check for the `release-assets` subdomain as well.
Co-authored-by: Alex Blackie <alex@blackie.ca>
Backport #35198 by @lunny
Fix#31113
After #22385 introduced LFS GC, it never worked due to a bug in the INI
library: fields in structs embedded more than one level deep are not
populated from the INI file.
This PR fixes the issue by replacing the multi-level embedded struct
with a single-level struct for parsing the cron.gc_lfs configuration.
Added a new test for retrieving cron settings to demonstrate the bug in
the INI package.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #35156 by @bartvdbraak
Instead of always hiding the dropzone when it's not active:
- hide it when when there are no uploaded files and it becomes inactive
- don't hide it when there are uploaded files
Fixes#35125
Co-authored-by: Bart van der Braak <bartvdbraak@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34863 by @wxiaoguang
Remove the misleading error log, fix#34738
Make the "search" input auto-focused, fix#34807
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34632 by @anthony-zh
By default, the code extracts 200 package versions. If too many packages
are generated every day or if rule cleaning is enabled later, which
means there are more than 200 versions corresponding to the library
package, it may not be cleaned up completely, resulting in residue
Fix#31961
Co-authored-by: anthony-zh <118415914+anthony-zh@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34703 by @lunny
Fix#34688
This PR will store the `publisher_id` of `release`(tag) table as
pusher's id. It could be a real userID or a system user id. If the user
is deleted, ghost will be replaced.
This PR will also correct the wrong user `Ghost` in the feeds and wrong
committer on tag list page if pushing a tag from an actions. Now the
behavior is the same as Github. Some codes are deleted because it tries
to get commit author as pusher which is not right.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #34745 by MaxWebZ
When adding a link using the "Add a link" button in comment editor,
pasting a URL resulted in incorrect Markdown formatting (double
brackets) instead of replacing the placeholder text.
This fix adds a context check to prevent creating a new markdown link
when we're already inside an existing one.
Fixes#34740
Co-authored-by: MaxWebZ <5054326@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34666 by wxiaoguang
Fix#25846
1. the ImageConfig can be empty, fall back to default
2. the blob size can be empty, it still needs "Content-Length" header
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34509 by @lunny
If user leaves the page, the context will become cancelled, so that the
update process maybe terminal in an unexpected status. This PR haven't
resolve the problem totally. It uses a background context to not cancel
the update process even if the user leaved the pull request view page.
Fix#31779
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #34575 by @badhezi
Fixes https://github.com/go-gitea/gitea/issues/34560
explanation of the bug in the issue
setting `issue.isLabelsLoaded = false` before calling `deleteIssueLabel`
guarantee we will load the new state of the labels into the issue object
before sending it in the webhook.
Co-authored-by: badhezi <zlilaharon@gmail.com>
Backport #34142 by @lunny
Fix the bug when deleting orphaned issues attachments. The attachments
maybe stored on other storages service rather than disk.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #34573 by @raucao
This fixes 3 issues I encountered when debugging problems with our LDAP
sync:
1. The comparison of the hashed image data in `IsUploadAvatarChanged` is
wrong. It seems to be from before avatar hashing was changed and unified
in #22289. This results in the function always returning `true` for any
avatars, even if they weren't changed.
2. Even if there's no avatar to upload (i.e. no avatar available for the
LDAP entry), the upload function would still be called for every single
user, only to then fail, because the data isn't valid. This is
unnecessary.
3. Another small issue is that the comparison function (and thus hashing
of data) is called for every user, even if there is no avatar attribute
configured at all for the LDAP source. Thus, I switched the condition
nesting, so that no cycles are wasted when avatar sync isn't configured
in the first place.
I also added a trace log for when there is actually a new avatar being
uploaded for an existing user, which is now only shown when that is
actually the case.
Co-authored-by: Râu Cao <842+raucao@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34512 by tclin914
If the message from form.MergeMessageField is empty, we will miss a "\n"
between the title and the "Co-authored-by:" line. The title and message
should have a blank line between of them.
Co-authored-by: Jim Lin <jim@andestech.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Backport #34525 by @MarkusAmshove
closes#34171
Adds a new sort option `recentclose` for issues and pull requests which
will return items in a descending order of when they were closed
Co-authored-by: Markus Amshove <scm@amshove.org>
Backport #34514 by @silverwind
postgres 12 is end of life since 6 months. 13 and above are still
supported but I think it's overall better if we test a more recent
version of postgres because that's what new users will be running on.
Ref: https://endoflife.date/postgresql
Co-authored-by: silverwind <me@silverwind.io>
Backport #34355 by @lunny
The tags synchronization is very slow for a non-mirror repository with
many tags especially forking. This PR make all repositories' tags
synchronization use the same function and remove the low performance
synchronization function. The commit count of tag now will not be stored
into database when syncing. Since the commits count will always be read
from cache or git data, the `NumCommits` in the release table will be
updated for the first read from git data.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Backport #34480 by @ChristopherHX
* previously deleting an already deleted runner returned http 500
* previously any database error for the get endpoint was http 404 and
never 500
Co-authored-by: ChristopherHX <christopher.homberger@web.de>
Backport #34449 by @ChristopherHX
* mssql does not support fetching 0 repositories
* remove paging by NumRepos that might be 0
* extend admin api test to purge user 2
Fixes#34448
Co-authored-by: ChristopherHX <christopher.homberger@web.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
