## Dropping SSPI auth support
SSPI authentication relied on Microsoft Windows support, removal started in https://codeberg.org/forgejo/forgejo/pulls/5353, because it was broken anyway. We have no knowledge of any users using SSPI authentication. However, if you somehow managed to run Forgejo on Windows, or want to upgrade from a Gitea version which does, please ensure that you do not use SSPI as an authentication mechanism for user accounts. Feel free to reach out if you need assistance.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7148
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Otto Richter <otto@codeberg.org>
Co-committed-by: Otto Richter <otto@codeberg.org>
- Some email clients send inline attachments using the `multipart/related` Mime-Type and enmime collects these in the `Envelope.OtherParts` list; until now only Envelope.Attachments and Envelope.Inline were considered while parsing incoming mail.
- As some email clients send attachments without filename, especially in the multipart/related case, this PR implements `constructFilename`, which guesses the filename based on the ContentType.
How the issue was disovered:
I implemented an otherwise unrelated application written in go that parses emails with enmime just like Forgejo does.
I noticed that in a few occasions that system would fail to detect all attachments.
Investigating this issue led me to realize the above described issue.
After implementing a fix for that application, I looked through the Forgejo email parsing code and discovered the same problem.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7136
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: christopher-besch <mail@chris-besch.com>
Co-committed-by: christopher-besch <mail@chris-besch.com>
- The security patch of forgejo/forgejo#6843 fixed the issue where project boards loaded all issues without considering if the doer actually had permission to view that issue. Within that patch the call to `Issues` was modified to include this permission checking.
- The query being generated was not entirely correct. Issues in public repositories weren't considered correctly (partly the fault of not setting `AllPublic` unconditionally) in the cause an authenticated user loaded the project.
- This is now fixed by setting `AllPublic` unconditionally and subsequently fixing the `Issue` function to ensure that the combination of setting `AllPublic` and `User` generates the correct query, by combining the permission check and issues in public repositories as one `AND` query.
- Added unit testing.
- Added integration testing.
- ResolvesCodeberg/Community#1809
- Regression of https://codeberg.org/forgejo/forgejo/pulls/6843
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7143
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
Some email clients like to be special and only set the "Precedence" header to "auto_reply" when sending automatic replies.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7137
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: christopher-besch <mail@chris-besch.com>
Co-committed-by: christopher-besch <mail@chris-besch.com>
- Simplify if-else expression to `NotFoundOrServerError`.
- I cannot find an existing scenario where `Getdiff` returns an error
and where it therefore should show a 404 error in the context of
rendering a diff of a commit. So simply return it as an Internal Server
Error, this also helps with debugging if an actual error occurs
here (404 errors are only logged at the DEBUG level).
- The first change is already covered under existing testing, the second
change is not trivial to test.
Closes: https://codeberg.org/forgejo/forgejo/issues/6042
Continuation of: https://codeberg.org/forgejo/forgejo/pulls/6284
Replaces: https://codeberg.org/forgejo/forgejo/pulls/6285
Context: https://codeberg.org/forgejo/forgejo/pulls/6284#issuecomment-2518599
Create a new type of comment: `CommentTypeAggregator`
Replaces the grouping of labels and review request in a single place: the comment aggregator
The whole list of comments is "scanned", if they can get aggregated (diff of time < 60secs, same poster, open / close issue, add / del labels, add /del review req), they are added to the aggregator.
Once needed, the list of all the aggregated comments are replaced with a single aggregated comment containing all the data required.
In templates, have a specific HTML rendering part for the comment aggregator, reuse the same rendering as with the other types of comments.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6523
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Litchi Pi <litchi.pi@proton.me>
Co-committed-by: Litchi Pi <litchi.pi@proton.me>
Encapsulates the federation server counterpart & makes the test more configurable.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7115
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
Co-committed-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
This fixes an issue with Simplified Chinese (and likely other languages)
where the "Actions" button would be shown in English and have a different
height compared to the other buttons in Chinese.
This solution was proposed by Codeberg user "aimuz".
Co-authored-by: aimuz
- If the caller function has generics then
`runtime.FuncForPC(...).Name()` will not show the generic types and
instead collapse it to `[...]`. Remove this suffix from the function
name.
- This fixes an issue where the logging of functions that use generics
such as `db.Find` to be logged as `]()` instead of `Find()`, as the last
dot in `[...]` was being used as a cutoff point.
- Unit test added.
So it is consistent with the icon used in the tab with comments.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7099
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
- In the case that the `ROOT_URL` does not match the site a person is visiting Forgejo gives zero guarantees that any of the functionality will still work.
- Make the error i18n, use `local_next`.
- Reflect in the error that the any part of the application can break, don't be specific - it is plain wrong and should not be used.
- Always check for this case on the login page. This was previously only the case if OAuth2 was enabled, but this code was checking for elements that are always present on the login page regardless if the OAuth2 was enabled or not. Technically nothing changed, but reading the code it is now more clear when this check is being run.
- Add E2E testing.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7103
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
* use en-US quotes: _there are no quotes in the part of the text it refers to_
* small reword to fix `a issue`
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7089
Reviewed-by: floss4good <floss4good@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
- no change except CI and dependency upgrades
- release v1.0.0
The initial motivation for moving this dependency into Forgejo space was to fix a rare queue corruption, which turns out to not really be fixable, because leveldb has no transactions.
Moving the package to Forgejo where it is upgraded via renovate makes for a better environment for future maintenance.
Refs: https://codeberg.org/forgejo/forgejo/issues/7054
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7074
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
