fedi/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-20 07:38:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
forgejo/modules
History
Gusted a14be197eb
[GITEA] rework long-term authentication 
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit eff097448b)

[GITEA] rework long-term authentication (squash) add migration

Reminder: the migration is run via integration tests as explained
in the commit "[DB] run all Forgejo migrations in integration tests"

(cherry picked from commit 4accf7443c)
2023-10-09 22:17:28 +02:00
..
actions [CI] Search .forgejo/workflows first 2023-10-09 18:25:28 +02:00
activitypub make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
analyze Rename code_langauge.go to code_language.go (#26377) 2023-08-07 15:00:53 -04:00
assetfs Use Set[Type] instead of map[Type]bool/struct{}. (#26804) 2023-08-30 06:55:25 +00:00
auth [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
avatar [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
base [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
cache improve unit test for caching (#26185) 2023-07-27 22:24:40 +02:00
charset Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
container
context [GITEA] rework long-term authentication 2023-10-09 22:17:28 +02:00
contexttest Avoid double-unescaping of form value (#26853) 2023-09-01 12:01:36 +00:00
csv
doctor Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
emoji Update emoji set to Unicode 15 (#25595) 2023-06-29 16:29:48 +00:00
eventsource More db.DefaultContext refactor (#27265) 2023-09-29 12:12:54 +00:00
generate Handle base64 decoding correctly to avoid panic (#26483) 2023-08-14 10:30:16 +00:00
git [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
gitgraph More db.DefaultContext refactor (#27265) 2023-09-29 12:12:54 +00:00
graceful Allow the use of alternative net.Listener implementations by downstreams (#25855) 2023-07-24 07:18:17 +00:00
hcaptcha
highlight Upgrade go dependencies (#25819) 2023-07-14 11:00:31 +08:00
hostmatcher
html Refactor backend SVG package and add tests (#26335) 2023-08-05 04:34:59 +00:00
httpcache Less naked returns (#25713) 2023-07-07 05:31:56 +00:00
httplib Less naked returns (#25713) 2023-07-07 05:31:56 +00:00
indexer [CI] disable meilisearch/elasticsearch test, no server yet in CI 2023-10-09 18:25:28 +02:00
issue/template Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
json Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
label
lfs [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
log Reduce some allocations in type conversion (#26772) 2023-08-29 00:43:16 +08:00
markup [GITEA] Use restricted sanitizer for repository description 2023-10-09 20:44:24 +02:00
mcaptcha
metrics Reduce usage of db.DefaultContext (#27073) 2023-09-14 17:09:32 +00:00
migration Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
nosql Update tool dependencies, lock govulncheck and actionlint (#25655) 2023-07-09 11:58:06 +00:00
options
packages Use docs.gitea.com instead of docs.gitea.io (#26739) 2023-08-27 11:59:12 +00:00
paginator
pprof
private [CLI] implement forgejo-cli 2023-10-09 17:15:31 +02:00
process Less naked returns (#25713) 2023-07-07 05:31:56 +00:00
proxy
proxyprotocol
public Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974) 2023-07-21 12:14:20 +00:00
queue [CI] disable redis test, no redis server yet in CI 2023-10-09 17:15:31 +02:00
recaptcha
references Replace 'userxx' with 'orgxx' in all test files when the user type is org (#27052) 2023-09-14 02:59:53 +00:00
regexplru Upgrade go dependencies (#25819) 2023-07-14 11:00:31 +08:00
repository Refactor system setting (#27000) 2023-10-05 09:08:19 +08:00
secret [GITEA] Drop sha256-simd in favor of stdlib 2023-10-09 22:17:14 +02:00
session Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
setting [GITEA] rework long-term authentication 2023-10-09 22:17:28 +02:00
sitemap
ssh [GITEA] Remove SSH workaround 2023-10-09 22:17:17 +02:00
storage [CI] Forgejo Actions based CI for PR & branches 2023-10-09 18:25:28 +02:00
structs [v1.22] [FEAT] allow setting the update date on issues and comments 2023-10-09 19:11:03 +02:00
svg Refactor backend SVG package and add tests (#26335) 2023-08-05 04:34:59 +00:00
sync
system make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
templates Improve feed icons and feed merge text color (#27498) 2023-10-07 23:26:27 +00:00
test Move web/api context related testing function into a separate package (#26859) 2023-09-01 11:26:07 +00:00
testlogger Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
timeutil
translation Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
turnstile
typesniffer Detect ogg mime-type as audio or video (#26494) 2023-08-15 10:31:25 +08:00
updatechecker
upload
uri
user
util [GITEA] rework long-term authentication 2023-10-09 22:17:28 +02:00
validation [GITEA] add option for banning dots in usernames 2023-10-09 20:25:23 +02:00
web [GITEA] Use maintained gziphandler 2023-10-09 22:17:23 +02:00
webhook New webhook trigger for receiving Pull Request review requests (#24481) 2023-05-24 22:06:27 -04:00