Skip to content

Commit bec4d38

Browse files
zjjhotzjjhot
committed
Merge remote-tracking branch 'giteaofficial/main'
* giteaofficial/main: Allow render HTML with css/js external links (go-gitea#19017) Use correct count for `NumOpenIssues` (go-gitea#19980) In code search, get code unit accessible repos in one (main) query (go-gitea#19764) [skip ci] Updated translations via Crowdin Always try to fetch repo for mirrors (go-gitea#19975) Remove tab/TabName usage where it's not needed (go-gitea#19973) Fix cli command restore-repo: "units" should be parsed as StringSlice (go-gitea#19953) Uppercase first languages letters (go-gitea#19965) Move tests as seperate sub packages to reduce duplicated file names (go-gitea#19951) Replace unstyled meter with progress (go-gitea#19968) [skip ci] Updated translations via Crowdin [skip ci] Updated translations via Crowdin Remove singuliere from MAINTAINERS (go-gitea#19883) Fix aria for logo (go-gitea#19955) Fix mirror template bug (go-gitea#19959)
2 parents 1bdfd75 + b01dce2 commit bec4d38

File tree

98 files changed

+1579
-1328
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+1579
-1328
lines changed

‎MAINTAINERS

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,5 @@ Steven Kriegler <[email protected]> (@justusbunsi)
4545
Jimmy Praet <[email protected]> (@jpraet)
4646
Leon Hofmeister <[email protected]> (@delvh)
4747
Gusted <[email protected]) (@Gusted)
48-
singuliere <[email protected]> (@singuliere)
4948
silentcode <[email protected]> (@silentcodeg)
5049
Wim <[email protected]> (@42wim)

‎cmd/restore_repo.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ var CmdRestoreRepository = cli.Command{
3737
Value: "",
3838
Usage: "Restore destination repository name",
3939
},
40-
cli.StringFlag{
40+
cli.StringSliceFlag{
4141
Name: "units",
42-
Value: "",
43-
Usage: `Which items will be restored, one or more units should be separated as comma.
42+
Value: nil,
43+
Usage: `Which items will be restored, one or more units should be repeated with this flag.
4444
wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
4545
},
4646
cli.BoolFlag{

‎custom/conf/app.example.ini

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2125,7 +2125,7 @@ PATH =
21252125
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
21262126
;; The first locale will be used as the default if user browser's language doesn't match any locale in the list.
21272127
;LANGS = en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,uk-UA,ja-JP,es-ES,pt-BR,pt-PT,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR,el-GR,fa-IR,hu-HU,id-ID,ml-IN
2128-
;NAMES = English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,français,Nederlands,latviešu,русский,Українська,日本語,español,português do Brasil,Português de Portugal,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어,ελληνικά,فارسی,magyar nyelv,bahasa Indonesia,മലയാളം
2128+
;NAMES = English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,Français,Nederlands,Latviešu,Русский,Українська,日本語,Español,Português do Brasil,Português de Portugal,Polski,Български,Italiano,Suomi,Türkçe,Čeština,Српски,Svenska,한국어,Ελληνικά,فارسی,Magyar nyelv,Bahasa Indonesia,മലയാളം
21292129

21302130
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
21312131
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2181,8 +2181,11 @@ PATH =
21812181
;RENDER_COMMAND = "asciidoc --out-file=- -"
21822182
;; Don't pass the file on STDIN, pass the filename as argument instead.
21832183
;IS_INPUT_FILE = false
2184-
; Don't filter html tags and attributes if true
2185-
;DISABLE_SANITIZER = false
2184+
;; How the content will be rendered.
2185+
;; * sanitized: Sanitize the content and render it inside current page, default to only allow a few HTML tags and attributes. Customized sanitizer rules can be defined in [markup.sanitizer.*] .
2186+
;; * no-sanitizer: Disable the sanitizer and render the content inside current page. It's **insecure** and may lead to XSS attack if the content contains malicious code.
2187+
;; * iframe: Render the content in a separate standalone page and embed it into current page by iframe. The iframe is in sandbox mode with same-origin disabled, and the JS code are safely isolated from parent page.
2188+
;RENDER_CONTENT_MODE=sanitized
21862189

21872190
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
21882191
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -631,7 +631,7 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type
631631
- Built-in networks:
632632
- `loopback`: 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
633633
- `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
634-
- `external`: A valid non-private unicast IP, you can access all hosts on public internet.
634+
- `external`: A valid non-private unicast IP, you can access all hosts on public internet.
635635
- `*`: All hosts are allowed.
636636
- CIDR list: `1.2.3.0/8` for IPv4 and `2001:db8::/32` for IPv6
637637
- Wildcard hosts: `*.mydomain.com`, `192.168.100.*`
@@ -763,7 +763,7 @@ Default templates for project boards:
763763
- `STACKTRACE_LEVEL`: **None**: Default log level at which to log create stack traces. \[Trace, Debug, Info, Warn, Error, Critical, Fatal, None\]
764764
- `ENABLE_SSH_LOG`: **false**: save ssh log to log file
765765
- `ENABLE_XORM_LOG`: **true**: Set whether to perform XORM logging. Please note SQL statement logging can be disabled by setting `LOG_SQL` to false in the `[database]` section.
766-
766+
767767
### Router Log (`log`)
768768
- `DISABLE_ROUTER_LOG`: **false**: Mute printing of the router log.
769769
- `ROUTER`: **console**: The mode or name of the log the router should log to. (If you set this to `,` it will log to default Gitea logger.)
@@ -998,9 +998,9 @@ Default templates for project boards:
998998

999999
## i18n (`i18n`)
10001000

1001-
- `LANGS`: **en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,ja-JP,es-ES,pt-BR,pt-PT,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR,el-GR,fa-IR,hu-HU,id-ID,ml-IN**:
1001+
- `LANGS`: **en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,uk-UA,ja-JP,es-ES,pt-BR,pt-PT,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR,el-GR,fa-IR,hu-HU,id-ID,ml-IN**:
10021002
List of locales shown in language selector. The first locale will be used as the default if user browser's language doesn't match any locale in the list.
1003-
- `NAMES`: **English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,français,Nederlands,latviešu,русский,日本語,español,português do Brasil,Português de Portugal,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어,ελληνικά,فارسی,magyar nyelv,bahasa Indonesia,മലയാളം**: Visible names corresponding to the locales
1003+
- `NAMES`: **English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,Français,Nederlands,Latviešu,Русский,Українська,日本語,Español,Português do Brasil,Português de Portugal,Polski,Български,Italiano,Suomi,Türkçe,Čeština,Српски,Svenska,한국어,Ελληνικά,فارسی,Magyar nyelv,Bahasa Indonesia,മലയാളം**: Visible names corresponding to the locales
10041004

10051005
## U2F (`U2F`) **DEPRECATED**
10061006
- `APP_ID`: **`ROOT_URL`**: Declares the facet of the application which is used for authentication of previously registered U2F keys. Requires HTTPS.
@@ -1026,13 +1026,16 @@ IS_INPUT_FILE = false
10261026
command. Multiple extensions needs a comma as splitter.
10271027
- RENDER\_COMMAND: External command to render all matching extensions.
10281028
- IS\_INPUT\_FILE: **false** Input is not a standard input but a file param followed `RENDER_COMMAND`.
1029-
- DISABLE_SANITIZER: **false** Don't filter html tags and attributes if true. Don't change this to true except you know what that means.
1029+
- RENDER_CONTENT_MODE: **sanitized** How the content will be rendered.
1030+
- sanitized: Sanitize the content and render it inside current page, default to only allow a few HTML tags and attributes. Customized sanitizer rules can be defined in `[markup.sanitizer.*]`.
1031+
- no-sanitizer: Disable the sanitizer and render the content inside current page. It's **insecure** and may lead to XSS attack if the content contains malicious code.
1032+
- iframe: Render the content in a separate standalone page and embed it into current page by iframe. The iframe is in sandbox mode with same-origin disabled, and the JS code are safely isolated from parent page.
10301033

10311034
Two special environment variables are passed to the render command:
10321035
- `GITEA_PREFIX_SRC`, which contains the current URL prefix in the `src` path tree. To be used as prefix for links.
10331036
- `GITEA_PREFIX_RAW`, which contains the current URL prefix in the `raw` path tree. To be used as prefix for image paths.
10341037

1035-
If `DISABLE_SANITIZER` is false, Gitea supports customizing the sanitization policy for rendered HTML. The example below will support KaTeX output from pandoc.
1038+
If `RENDER_CONTENT_MODE` is `sanitized`, Gitea supports customizing the sanitization policy for rendered HTML. The example below will support KaTeX output from pandoc.
10361039

10371040
```ini
10381041
[markup.sanitizer.TeX]

‎docs/content/doc/advanced/config-cheat-sheet.zh-cn.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -318,14 +318,17 @@ IS_INPUT_FILE = false
318318
- FILE_EXTENSIONS: 关联的文档的扩展名，多个扩展名用都好分隔。
319319
- RENDER_COMMAND: 工具的命令行命令及参数。
320320
- IS_INPUT_FILE: 输入方式是最后一个参数为文件路径还是从标准输入读取。
321-
- DISABLE_SANITIZER: **false** 如果为 true 则不过滤 HTML 标签和属性。除非你知道这意味着什么，否则不要设置为 true。
321+
- RENDER_CONTENT_MODE: **sanitized** 内容如何被渲染。
322+
- sanitized: 对内容进行净化并渲染到当前页面中，仅有一部分 HTML 标签和属性是被允许的。
323+
- no-sanitizer: 禁用净化器，把内容渲染到当前页面中。此模式是**不安全**的，如果内容中含有恶意代码，可能会导致 XSS 攻击。
324+
- iframe: 把内容渲染在一个独立的页面中并使用 iframe 嵌入到当前页面中。使用的 iframe 工作在沙箱模式并禁用了同源请求，JS 代码被安全的从父页面中隔离出去。
322325

323326
以下两个环境变量将会被传递给渲染命令：
324327

325328
- `GITEA_PREFIX_SRC`：包含当前的`src`路径的URL前缀，可以被用于链接的前缀。
326329
- `GITEA_PREFIX_RAW`：包含当前的`raw`路径的URL前缀，可以被用于图片的前缀。
327330

328-
如果 `DISABLE_SANITIZER` 为 false，则 Gitea 支持自定义渲染 HTML 的净化策略。以下例子将用 pandoc 支持 KaTeX 输出。
331+
如果 `RENDER_CONTENT_MODE` 为 `sanitized`，则 Gitea 支持自定义渲染 HTML 的净化策略。以下例子将用 pandoc 支持 KaTeX 输出。
329332

330333
```ini
331334
[markup.sanitizer.TeX]

‎integrations/links_test.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ func TestLinksNoLogin(t *testing.T) {
2222

2323
links := []string{
2424
"/explore/repos",
25-
"/explore/repos?q=test&tab=",
25+
"/explore/repos?q=test",
2626
"/explore/users",
27-
"/explore/users?q=test&tab=",
27+
"/explore/users?q=test",
2828
"/explore/organizations",
29-
"/explore/organizations?q=test&tab=",
29+
"/explore/organizations?q=test",
3030
"/",
3131
"/user/sign_up",
3232
"/user/login",
@@ -81,11 +81,11 @@ func TestNoLoginNotExist(t *testing.T) {
8181
func testLinksAsUser(userName string, t *testing.T) {
8282
links := []string{
8383
"/explore/repos",
84-
"/explore/repos?q=test&tab=",
84+
"/explore/repos?q=test",
8585
"/explore/users",
86-
"/explore/users?q=test&tab=",
86+
"/explore/users?q=test",
8787
"/explore/organizations",
88-
"/explore/organizations?q=test&tab=",
88+
"/explore/organizations?q=test",
8989
"/",
9090
"/user/forgot_password",
9191
"/api/swagger",

‎models/db/context.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ type Context struct {
3232
e Engine
3333
}
3434

35-
// WithEngine returns a db.Context from a context.Context and db.Engine
35+
// WithEngine returns a Context from a context.Context and Engine
3636
func WithEngine(ctx context.Context, e Engine) *Context {
3737
return &Context{
3838
Context: ctx,

‎models/db/engine_test.go

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// Copyright 2019 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package db_test
6+
7+
import (
8+
"os"
9+
"path/filepath"
10+
"testing"
11+
12+
"code.gitea.io/gitea/models/db"
13+
issues_model "code.gitea.io/gitea/models/issues"
14+
"code.gitea.io/gitea/models/unittest"
15+
"code.gitea.io/gitea/modules/setting"
16+
17+
"github.com/stretchr/testify/assert"
18+
)
19+
20+
func TestDumpDatabase(t *testing.T) {
21+
assert.NoError(t, unittest.PrepareTestDatabase())
22+
23+
dir, err := os.MkdirTemp(os.TempDir(), "dump")
24+
assert.NoError(t, err)
25+
26+
type Version struct {
27+
ID int64 `xorm:"pk autoincr"`
28+
Version int64
29+
}
30+
assert.NoError(t, db.GetEngine(db.DefaultContext).Sync2(new(Version)))
31+
32+
for _, dbType := range setting.SupportedDatabaseTypes {
33+
assert.NoError(t, db.DumpDatabase(filepath.Join(dir, dbType+".sql"), dbType))
34+
}
35+
}
36+
37+
func TestDeleteOrphanedObjects(t *testing.T) {
38+
assert.NoError(t, unittest.PrepareTestDatabase())
39+
40+
countBefore, err := db.GetEngine(db.DefaultContext).Count(&issues_model.PullRequest{})
41+
assert.NoError(t, err)
42+
43+
_, err = db.GetEngine(db.DefaultContext).Insert(&issues_model.PullRequest{IssueID: 1000}, &issues_model.PullRequest{IssueID: 1001}, &issues_model.PullRequest{IssueID: 1003})
44+
assert.NoError(t, err)
45+
46+
orphaned, err := db.CountOrphanedObjects("pull_request", "issue", "pull_request.issue_id=issue.id")
47+
assert.NoError(t, err)
48+
assert.EqualValues(t, 3, orphaned)
49+
50+
err = db.DeleteOrphanedObjects("pull_request", "issue", "pull_request.issue_id=issue.id")
51+
assert.NoError(t, err)
52+
53+
countAfter, err := db.GetEngine(db.DefaultContext).Count(&issues_model.PullRequest{})
54+
assert.NoError(t, err)
55+
assert.EqualValues(t, countBefore, countAfter)
56+
}

‎models/db/main_test.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright 2020 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package db_test
6+
7+
import (
8+
"path/filepath"
9+
"testing"
10+
11+
"code.gitea.io/gitea/models/unittest"
12+
13+
_ "code.gitea.io/gitea/models"
14+
_ "code.gitea.io/gitea/models/repo"
15+
)
16+
17+
func TestMain(m *testing.M) {
18+
unittest.MainTest(m, &unittest.TestOptions{
19+
GiteaRootPath: filepath.Join("..", ".."),
20+
})
21+
}

‎models/engine_test.go

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎models/git/lfs.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"code.gitea.io/gitea/models/db"
1313
"code.gitea.io/gitea/models/perm"
1414
repo_model "code.gitea.io/gitea/models/repo"
15+
"code.gitea.io/gitea/models/unit"
1516
user_model "code.gitea.io/gitea/models/user"
1617
"code.gitea.io/gitea/modules/lfs"
1718
"code.gitea.io/gitea/modules/log"
@@ -213,7 +214,7 @@ func LFSObjectAccessible(user *user_model.User, oid string) (bool, error) {
213214
count, err := db.GetEngine(db.DefaultContext).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
214215
return count > 0, err
215216
}
216-
cond := repo_model.AccessibleRepositoryCondition(user)
217+
cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
217218
count, err := db.GetEngine(db.DefaultContext).Where(cond).Join("INNER", "repository", "`lfs_meta_object`.repository_id = `repository`.id").Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
218219
return count > 0, err
219220
}
@@ -244,7 +245,7 @@ func LFSAutoAssociate(metas []*LFSMetaObject, user *user_model.User, repoID int6
244245
newMetas := make([]*LFSMetaObject, 0, len(metas))
245246
cond := builder.In(
246247
"`lfs_meta_object`.repository_id",
247-
builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user)),
248+
builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)),
248249
)
249250
err = sess.Cols("oid").Where(cond).In("oid", oids...).GroupBy("oid").Find(&newMetas)
250251
if err != nil {

‎models/git/main_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ import (
88
"path/filepath"
99
"testing"
1010

11-
_ "code.gitea.io/gitea/models"
1211
"code.gitea.io/gitea/models/unittest"
12+
13+
_ "code.gitea.io/gitea/models"
1314
)
1415

1516
func TestMain(m *testing.M) {

‎models/issues/issue.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1430,7 +1430,7 @@ func issuePullAccessibleRepoCond(repoIDstr string, userID int64, org *organizati
14301430
cond = cond.And(
14311431
builder.Or(
14321432
repo_model.UserOwnedRepoCond(userID), // owned repos
1433-
repo_model.UserCollaborationRepoCond(repoIDstr, userID), // collaboration repos
1433+
repo_model.UserAccessRepoCond(repoIDstr, userID), // user can access repo in a unit independent way
14341434
repo_model.UserAssignedRepoCond(repoIDstr, userID), // user has been assigned accessible public repos
14351435
repo_model.UserMentionedRepoCond(repoIDstr, userID), // user has been mentioned accessible public repos
14361436
repo_model.UserCreateIssueRepoCond(repoIDstr, userID, isPull), // user has created issue/pr accessible public repos
@@ -1499,7 +1499,7 @@ func GetRepoIDsForIssuesOptions(opts *IssuesOptions, user *user_model.User) ([]i
14991499

15001500
opts.setupSessionNoLimit(sess)
15011501

1502-
accessCond := repo_model.AccessibleRepositoryCondition(user)
1502+
accessCond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
15031503
if err := sess.Where(accessCond).
15041504
Distinct("issue.repo_id").
15051505
Table("issue").

‎models/issues/main_test.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,14 @@ import (
88
"path/filepath"
99
"testing"
1010

11-
_ "code.gitea.io/gitea/models"
1211
issues_model "code.gitea.io/gitea/models/issues"
13-
_ "code.gitea.io/gitea/models/repo"
1412
"code.gitea.io/gitea/models/unittest"
15-
_ "code.gitea.io/gitea/models/user"
1613
"code.gitea.io/gitea/modules/setting"
1714

15+
_ "code.gitea.io/gitea/models"
16+
_ "code.gitea.io/gitea/models/repo"
17+
_ "code.gitea.io/gitea/models/user"
18+
1819
"github.com/stretchr/testify/assert"
1920
)
2021

‎models/org.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"code.gitea.io/gitea/models/organization"
1515
access_model "code.gitea.io/gitea/models/perm/access"
1616
repo_model "code.gitea.io/gitea/models/repo"
17+
"code.gitea.io/gitea/models/unit"
1718
user_model "code.gitea.io/gitea/models/user"
1819

1920
"xorm.io/builder"
@@ -54,7 +55,7 @@ func GetUserOrgsList(user *user_model.User) ([]*MinimalOrg, error) {
5455
Join("LEFT", builder.
5556
Select("id as repo_id, owner_id as repo_owner_id").
5657
From("repository").
57-
Where(repo_model.AccessibleRepositoryCondition(user)), "`repository`.repo_owner_id = `team`.org_id").
58+
Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)), "`repository`.repo_owner_id = `team`.org_id").
5859
Where("`team_user`.uid = ?", user.ID).
5960
GroupBy(groupByStr)
6061

0 commit comments

Comments
 (0)