Skip to content

Commit 1619dc1

Browse files
achilleas-kachilleas-k
authored
Merge pull request #107 from mpsonntag/release0123
Merge of upstream 'release' into G-Node/gogs 'master' LGTM
2 parents 85a0212 + b66a68f commit 1619dc1

File tree

327 files changed

+17149
-13750
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

327 files changed

+17149
-13750
lines changed

‎.codebeatignore

-7
This file was deleted.

‎.codebeatsettings

-7
This file was deleted.

‎.dockerignore

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
packager
2-
packager/**
1+
.packager
2+
.packager/**
33
scripts
44
scripts/**
55
.github/
@@ -8,7 +8,6 @@ config.codekit
88
.dockerignore
99
*.yml
1010
*.md
11-
.bra.toml
1211
.editorconfig
1312
.gitignore
1413
Dockerfile*

‎.editorconfig

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ indent_size = 4
1616
indent_style = tab
1717
indent_size = 2
1818

19-
[*.{less,yml}]
19+
[*.{less, yml}]
2020
indent_style = space
2121
indent_size = 2
2222

‎.gitattributes

-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ conf/license/* linguist-vendored
33
public/assets/* linguist-vendored
44
public/plugins/* linguist-vendored
55
public/css/themes/* linguist-vendored
6-
public/css/github.min.css linguist-vendored
76
public/css/semantic-2.4.2.min.css linguist-vendored
87
public/js/libs/* linguist-vendored
98
public/js/jquery-3.4.1.min.js linguist-vendored

‎.github/ISSUE_TEMPLATE/bug_report.md

+5-2
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,11 @@ The issue will be closed without any explanation if it does not satisfy any of f
2222
**Describe the bug**
2323
<!-- A clear and concise description of what the bug is -->
2424

25-
**Gogs version or commit**
26-
<!-- The version number or the commit SHA of the Gogs instance you use -->
25+
**Gogs version and commit**
26+
<!--
27+
The version number or the commit SHA of the Gogs instance you use.
28+
You can find these information in the admin dashboard ("/admin").
29+
-->
2730

2831
**Git version**
2932

‎.github/workflows/codeql.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "Code scanning - action"
2+
3+
on:
4+
push:
5+
branches: [master]
6+
schedule:
7+
- cron: '0 19 * * 0'
8+
9+
jobs:
10+
CodeQL-Build:
11+
12+
# CodeQL runs on ubuntu-latest and windows-latest
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v2
18+
with:
19+
# We must fetch at least the immediate parents so that if this is
20+
# a pull request then we can checkout the head.
21+
fetch-depth: 2
22+
23+
# If this run was triggered by a pull request event, then checkout
24+
# the head of the pull request instead of the merge commit.
25+
- run: git checkout HEAD^2
26+
if: ${{ github.event_name == 'pull_request' }}
27+
28+
# Initializes the CodeQL tools for scanning.
29+
- name: Initialize CodeQL
30+
uses: github/codeql-action/init@v1
31+
# Override language selection by uncommenting this and choosing your languages
32+
# with:
33+
# languages: go, javascript, csharp, python, cpp, java
34+
35+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
36+
# If this step fails, then you should remove it and run the build manually (see below)
37+
- name: Autobuild
38+
uses: github/codeql-action/autobuild@v1
39+
40+
# ℹ️ Command-line programs to run using the OS shell.
41+
# 📚 https://git.io/JvXDl
42+
43+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
44+
# and modify them (or add more) to build your code if your project
45+
# uses a compiled language
46+
47+
#- run: |
48+
# make bootstrap
49+
# make release
50+
51+
- name: Perform CodeQL Analysis
52+
uses: github/codeql-action/analyze@v1

‎.github/workflows/go.yml

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: Go
2+
on:
3+
push:
4+
branches:
5+
- master
6+
- main
7+
- 'release/**'
8+
paths:
9+
- '**.go'
10+
pull_request:
11+
paths:
12+
- '**.go'
13+
env:
14+
GOPROXY: "https://proxy.golang.org"
15+
16+
jobs:
17+
lint:
18+
name: Lint
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v2
22+
- name: Run golangci-lint
23+
uses: actions-contrib/golangci-lint@v1
24+
with:
25+
args: 'run --timeout=30m'
26+
27+
test:
28+
name: Test
29+
strategy:
30+
matrix:
31+
go-version: [1.14.x, 1.15.x]
32+
platform: [ubuntu-latest, macos-latest, windows-latest]
33+
runs-on: ${{ matrix.platform }}
34+
steps:
35+
- name: Install Go
36+
uses: actions/setup-go@v1
37+
with:
38+
go-version: ${{ matrix.go-version }}
39+
- name: Checkout code
40+
uses: actions/checkout@v2
41+
- name: Run unit tests
42+
run: go test -v -race -coverprofile=coverage -covermode=atomic ./...
43+
- name: Upload coverage report to Codecov
44+
uses: codecov/[email protected]
45+
with:
46+
file: ./coverage
47+
flags: unittests
48+
- name: Cache downloaded modules
49+
uses: actions/cache@v1
50+
with:
51+
path: ~/go/pkg/mod
52+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
53+
restore-keys: |
54+
${{ runner.os }}-go-

‎.github/workflows/lsif.yml

+9-6
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,20 @@
11
name: LSIF
22
on: [push]
33
jobs:
4-
build:
4+
lsif-go:
5+
if: github.repository == 'gogs/gogs'
56
runs-on: ubuntu-latest
67
steps:
78
- uses: actions/checkout@v1
89
- name: Generate LSIF data
910
uses: sourcegraph/lsif-go-action@master
11+
- name: Upload LSIF data to sourcegraph.com
12+
continue-on-error: true
13+
uses: docker://sourcegraph/src-cli:latest
1014
with:
11-
verbose: 'true'
12-
- name: Upload LSIF data
13-
uses: sourcegraph/lsif-upload-action@master
15+
args: lsif upload -github-token=${{ secrets.GITHUB_TOKEN }}
16+
- name: Upload LSIF data to sourcegraph.unknwon.cn
1417
continue-on-error: true
18+
uses: docker://sourcegraph/src-cli:latest
1519
with:
16-
endpoint: https://sourcegraph.com
17-
github_token: ${{ secrets.GITHUB_TOKEN }}
20+
args: -endpoint=https://sourcegraph.unknwon.cn lsif upload -github-token=${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/shell.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Shell
2+
on:
3+
push:
4+
branches: [master]
5+
pull_request:
6+
jobs:
7+
shellcheck:
8+
name: Shellcheck
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@master
12+
- name: Run ShellCheck
13+
uses: ludeeus/action-shellcheck@master

‎.gitignore

-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
log/
55
custom/
66
data/
7-
.vendor/
87
.idea/
98
*.iml
109
public/img/avatar/

‎.travis.yml

-20
This file was deleted.

‎CHANGELOG.md

+66-2
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,69 @@
22

33
All notable changes to Gogs are documented in this file.
44

5-
## 0.12.0+dev (`master`)
5+
## 0.13.0+dev (`main`)
66

77
### Added
88

9+
- An unlisted option is added when create or migrate a repository. Unlisted repositories are public but not being listed for users without direct access in the UI. [#5733](https://github.com/gogs/gogs/issues/5733)
10+
- Add new configuration option `[git.timeout] DIFF` for customizing operation timeout of `git diff`. [#6315](https://github.com/gogs/gogs/issues/6315)
11+
12+
### Changed
13+
14+
- The default branch has been changed to `main`. [#6285](https://github.com/gogs/gogs/pull/6285)
15+
- MSSQL as database backend is deprecated, installation page no longer shows it as an option. Existing installations and manually craft configuration file continue to work. [#6295](https://github.com/gogs/gogs/pull/6295)
16+
- Use [Task](https://github.com/go-task/task) as the default build tool for development. [#6297](https://github.com/gogs/gogs/pull/6297)
17+
18+
### Fixed
19+
20+
- Add `X-Frame-Options` header to prevent Clickjacking. [#6409](https://github.com/gogs/gogs/issues/6409)
21+
- [Security] Potential SSRF attack by CRLF injection via repository migration. [#6413](https://github.com/gogs/gogs/issues/6413)
22+
23+
24+
### Removed
25+
26+
- ⚠️ Migrations before 0.12 are removed, installations not on 0.12 should upgrade to it to run the migrations and then upgrade to 0.13.
27+
- Configuration section `[mailer]` is no longer used.
28+
- Configuration section `[service]` is no longer used.
29+
- Configuration option `APP_NAME` is no longer used.
30+
- Configuration option `[security] REVERSE_PROXY_AUTHENTICATION_USER` is no longer used.
31+
- Configuration option `[database] PASSWD` is no longer used.
32+
- Configuration option `[auth] ACTIVE_CODE_LIVE_MINUTES` is no longer used.
33+
- Configuration option `[auth] RESET_PASSWD_CODE_LIVE_MINUTES` is no longer used.
34+
- Configuration option `[auth] ENABLE_CAPTCHA` is no longer used.
35+
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is no longer used.
36+
- Configuration option `[auth] REGISTER_EMAIL_CONFIRM` is no longer used.
37+
- Configuration option `[session] GC_INTERVAL_TIME` is no longer used.
38+
- Configuration option `[session] SESSION_LIFE_TIME` is no longer used.
39+
- Configuration option `[server] ROOT_URL` is no longer used.
40+
- Configuration option `[server] LANDING_PAGE` is no longer used.
41+
- Configuration option `[database] DB_TYPE` is no longer used.
42+
- Configuration option `[database] PASSWD` is no longer used.
43+
44+
## 0.12.1
45+
46+
### Fixed
47+
48+
- The `updated_at` field is now correctly updated when updates an issue. [#6209](https://github.com/gogs/gogs/issues/6209)
49+
- Fixed a regression which created `login_source.cfg` column to have `VARCHAR(255)` instead of `TEXT` in MySQL. [#6280](https://github.com/gogs/gogs/issues/6280)
50+
51+
## 0.12.0
52+
53+
### Added
54+
55+
- Support for Git LFS, you can read documentation for both [user](https://github.com/gogs/gogs/blob/master/docs/user/lfs.md) and [admin](https://github.com/gogs/gogs/blob/master/docs/admin/lfs.md). [#1322](https://github.com/gogs/gogs/issues/1322)
956
- Allow admin to remove observers from the repository. [#5803](https://github.com/gogs/gogs/pull/5803)
1057
- Use `Last-Modified` HTTP header for raw files. [#5811](https://github.com/gogs/gogs/issues/5811)
1158
- Support syntax highlighting for SAS code files (i.e. `.r`, `.sas`, `.tex`, `.yaml`). [#5856](https://github.com/gogs/gogs/pull/5856)
1259
- Able to fill in pull request title with a template. [#5901](https://github.com/gogs/gogs/pull/5901)
1360
- Able to override static files under `public/` directory, please refer to [documentation](https://gogs.io/docs/features/custom_template) for usage. [#5920](https://github.com/gogs/gogs/pull/5920)
61+
- New API endpoint `GET /admin/teams/:teamid/members` to list members of a team. [#5877](https://github.com/gogs/gogs/issues/5877)
62+
- Support backup with retention policy for Docker deployments. [#6140](https://github.com/gogs/gogs/pull/6140)
1463

1564
### Changed
1665

17-
- The required Go version to compile source code changed to 1.13.
66+
- The organization profile page has changed to display at most 12 members. [#5506](https://github.com/gogs/gogs/issues/5506)
67+
- The required Go version to compile source code changed to 1.14.
1868
- All assets are now embedded into binary and served from memory by default. Set `[server] LOAD_ASSETS_FROM_DISK = true` to load them from disk. [#5920](https://github.com/gogs/gogs/pull/5920)
1969
- Application and Go versions are removed from page footer and only show in the admin dashboard.
2070
- Build tag for running as Windows Service has been changed from `miniwinsvc` to `minwinsvc`.
@@ -32,18 +82,31 @@ All notable changes to Gogs are documented in this file.
3282
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is deprecated and will end support in 0.13.0, please start using `[user] ENABLE_EMAIL_NOTIFICATION`.
3383
- Configuration option `[session] GC_INTERVAL_TIME` is deprecated and will end support in 0.13.0, please start using `[session] GC_INTERVAL`.
3484
- Configuration option `[session] SESSION_LIFE_TIME` is deprecated and will end support in 0.13.0, please start using `[session] MAX_LIFE_TIME`.
85+
- The name `-` is reserved and cannot be used for users or organizations.
3586

3687
### Fixed
3788

3889
- [Security] Potential open redirection with i18n.
3990
- [Security] Potential ability to delete files outside a repository.
91+
- [Security] Potential ability to set primary email on others' behalf from their verified emails.
92+
- [Security] Potential XSS attack via `.ipynb`. [#5170](https://github.com/gogs/gogs/issues/5170)
93+
- [Security] Potential SSRF attack via webhooks. [#5366](https://github.com/gogs/gogs/issues/5366)
94+
- [Security] Potential CSRF attack in admin panel. [#5367](https://github.com/gogs/gogs/issues/5367)
95+
- [Security] Potential stored XSS attack in some browsers. [#5397](https://github.com/gogs/gogs/issues/5397)
4096
- [Security] Potential RCE on mirror repositories. [#5767](https://github.com/gogs/gogs/issues/5767)
4197
- [Security] Potential XSS attack with raw markdown API. [#5907](https://github.com/gogs/gogs/pull/5907)
98+
- File both modified and renamed within a commit treated as separate files. [#5056](https://github.com/gogs/gogs/issues/5056)
99+
- Unable to restore the database backup to MySQL 8.0 with syntax error. [#5602](https://github.com/gogs/gogs/issues/5602)
42100
- Open/close milestone redirects to a 404 page. [#5677](https://github.com/gogs/gogs/issues/5677)
43101
- Disallow multiple tokens with same name. [#5587](https://github.com/gogs/gogs/issues/5587) [#5820](https://github.com/gogs/gogs/pull/5820)
44102
- Enable Federated Avatar Lookup could cause server to crash. [#5848](https://github.com/gogs/gogs/issues/5848)
45103
- Private repositories are hidden in the organization's view. [#5869](https://github.com/gogs/gogs/issues/5869)
104+
- Users have access to base repository cannot view commits in forks. [#5878](https://github.com/gogs/gogs/issues/5878)
46105
- Server error when changing email address in user settings page. [#5899](https://github.com/gogs/gogs/issues/5899)
106+
- Fall back to use RFC 3339 as time layout when misconfigured. [#6098](https://github.com/gogs/gogs/issues/6098)
107+
- Unable to update team with server error. [#6185](https://github.com/gogs/gogs/issues/6185)
108+
- Webhooks are not fired after push when `[service] REQUIRE_SIGNIN_VIEW = true`.
109+
- Files with identical content are randomly displayed one of them.
47110

48111
### Removed
49112

@@ -54,6 +117,7 @@ All notable changes to Gogs are documented in this file.
54117
- Configuration option `[session] ENABLE_SET_COOKIE`
55118
- Configuration option `[release.attachment] PATH`
56119
- Configuration option `[webhook] QUEUE_LENGTH`
120+
- Build tag `sqlite`, which means CGO is now required.
57121

58122
---
59123

‎Dockerfile

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:alpine3.10 AS binarybuilder
1+
FROM golang:alpine3.11 AS binarybuilder
22
RUN apk --no-cache --no-progress add --virtual \
33
build-deps \
44
build-base \
@@ -7,10 +7,10 @@ RUN apk --no-cache --no-progress add --virtual \
77

88
WORKDIR /go/src/github.com/G-Node/gogs
99
COPY . .
10-
RUN make build-no-gen TAGS="sqlite cert pam"
10+
RUN make build-no-gen TAGS="cert pam"
1111

12-
FROM alpine:3.10
13-
ADD https://github.com/tianon/gosu/releases/download/1.10/gosu-amd64 /usr/sbin/gosu
12+
FROM alpine:3.11
13+
ADD https://github.com/tianon/gosu/releases/download/1.11/gosu-amd64 /usr/sbin/gosu
1414
RUN chmod +x /usr/sbin/gosu \
1515
&& echo http://dl-2.alpinelinux.org/alpine/edge/community/ >> /etc/apk/repositories \
1616
&& apk --no-cache --no-progress add \
@@ -49,7 +49,7 @@ COPY --from=binarybuilder /go/src/github.com/G-Node/gogs/gogs .
4949
RUN ./docker/finalize.sh
5050

5151
# Configure Docker Container
52-
VOLUME ["/data"]
52+
VOLUME ["/data", "/backup"]
5353
EXPOSE 22 3000
5454
ENTRYPOINT ["/app/gogs/docker/start.sh"]
5555
CMD ["/bin/s6-svscan", "/app/gogs/docker/s6/"]

0 commit comments

Comments
 (0)