Go to file
Jack Hay 4e879fed90
Deprecate query string auth tokens (#28390)
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

---------

Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 03:48:53 +00:00
.devcontainer
.gitea
.github Remove stale since giteabot has similiar feature (#28401) 2023-12-09 13:38:46 +02:00
assets
build
cmd Improve doctor cli behavior (#28422) 2023-12-11 15:55:10 +00:00
contrib Update environment-to-ini flag parsing (#27914) 2023-11-06 21:36:58 +01:00
custom/conf Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
docker Dockerfile small refactor (#27757) 2023-10-29 09:44:06 +08:00
docs Fix links in docs (#28302) 2023-12-01 19:42:42 +08:00
models Second part of refactor db.Find (#28194) 2023-12-11 16:56:48 +08:00
modules Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
options [skip ci] Updated translations via Crowdin 2023-12-12 00:25:05 +00:00
public Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
routers Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
services Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
snap
templates Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
tests Also sync DB branches on push if necessary (#28361) 2023-12-09 13:30:56 +00:00
web_src Use appSubUrl for OAuth2 callback URL tip (#28266) 2023-11-29 01:37:12 +00:00
.air.toml
.changelog.yml Adapt .changelog.yml to new labeling system (#27701) 2023-10-20 00:22:00 +02:00
.dockerignore
.editorconfig
.eslintrc.yaml Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
.gitattributes
.gitignore
.gitpod.yml
.golangci.yml Remove go versions from .golangci.yml (#27953) 2023-11-07 22:03:27 +01:00
.ignore
.markdownlint.yaml
.npmrc
.spectral.yaml
.stylelintrc.yaml Enable shorthands in declaration-strict-value linter (#27597) 2023-10-13 08:19:21 +00:00
.yamllint.yaml
BSDmakefile Fix build errors on BSD (in BSDMakefile) (#27594) 2023-10-13 15:38:27 +00:00
build.go
CHANGELOG.md Fix release link in changelog for v1.21.0 2023-11-14 15:03:49 +01:00
CODE_OF_CONDUCT.md
CONTRIBUTING.md Require clear descriptions both for feature and breaking PRs prior to the merge (#28112) 2023-11-19 09:53:31 +08:00
DCO
Dockerfile Dockerfile small refactor (#27757) 2023-10-29 09:44:06 +08:00
Dockerfile.rootless Dockerfile small refactor (#27757) 2023-10-29 09:44:06 +08:00
go.mod Remove SSH workaround (#27893) 2023-11-03 15:21:05 +00:00
go.sum Remove SSH workaround (#27893) 2023-11-03 15:21:05 +00:00
LICENSE
main.go
MAINTAINERS
Makefile Add --no-root to update-py (#27937) 2023-11-06 15:44:04 +00:00
package-lock.json Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
package.json Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
playwright.config.js
poetry.lock Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
poetry.toml
pyproject.toml Update JS and PY dependencies (#28120) 2023-11-20 01:02:57 +01:00
README.md Edit Discord Badge (#28188) 2023-11-23 19:58:12 -05:00
README_ZH.md Update readme to remove drone svg (#27624) 2023-10-14 16:11:54 +00:00
SECURITY.md
vitest.config.js
webpack.config.js

Gitea

Gitea - Git with a cup of tea

Contribute with Gitpod

View this document in Chinese

Purpose

The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service.

As Gitea is written in Go, it works across all the platforms and architectures that are supported by Go, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. You can try it out using the online demo. This project has been forked from Gogs since November of 2016, but a lot has changed.

Building

From the root of the source tree, run:

TAGS="bindata" make build

or if SQLite support is required:

TAGS="bindata sqlite sqlite_unlock_notify" make build

The build target is split into two sub-targets:

  • make backend which requires Go Stable, the required version is defined in go.mod.
  • make frontend which requires Node.js LTS or greater.

Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js.

Parallelism (make -j <num>) is not supported.

More info: https://docs.gitea.com/installation/install-from-source

Using

./gitea web

NOTE: If you're interested in using our APIs, we have experimental support with documentation.

Contributing

Expected workflow is: Fork -> Patch -> Push -> Pull Request

NOTES:

  1. YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.
  2. If you have found a vulnerability in the project, please write privately to security@gitea.io. Thanks!

Translating

Translations are done through Crowdin. If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.

You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope to fill it as questions pop up.

https://docs.gitea.com/contributing/localization

Crowdin

Further information

For more information and instructions about how to install Gitea, please look at our documentation. If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.

We maintain a list of Gitea-related projects at gitea/awesome-gitea.

The official Gitea CLI is developed at gitea/tea.

Authors

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

FAQ

How do you pronounce Gitea?

Gitea is pronounced /ɡɪti:/ as in "gi-tea" with a hard g.

Why is this not hosted on a Gitea instance?

We're working on it.

License

This project is licensed under the MIT License. See the LICENSE file for the full license text.

Screenshots

Looking for an overview of the interface? Check it out!

Dashboard User Profile Global Issues
Branches Web Editor Activity
New Migration Migrating Pull Request View
Pull Request Dark Diff Review Dark Diff Dark