Drop `*http.Request` from handlers that only needed it for the request
context or `URL.Query()`, and replace `params := c.Params()` indexing
with `c.Param(...)` lookups. Every handler in webapi_repo.go now takes
just `(c flamego.Context, user *database.User)`.
Apply review feedback on PR #8295. Flatten `repoHeaderCounts` into
`repoHeader` and rename fields to be more descriptive on the JSON wire
(`isViewerAdmin`, `issuesEnabled`, `pullRequestsEnabled`, `wikiEnabled`,
`watches`, `openPullRequests`, `isViewerWatching`, `hasViewerStarred`).
Apply the same naming to `repoActionResponse`. Rename `getRepoRaw` ->
`getRepoRawFile` with `{file}` param. Update the TS types and consumers
in `RepoHeader.tsx` to match.
Merge the author and parent/commit/buttons rows into a single
wrap-friendly flex line on desktop. Drop the committer line, since
showing it twice (author + committer) is rarely useful for the
common case where they match. Render each parent SHA as its own
clickable chip so multi-parent merge commits link to every parent.
Align View patch and Browse files to the left on mobile.
The commit diff page only ships the patch hunks, so unmodified context
between hunks is invisible. Add a per-file "Expand all lines" toggle so
the reader can pull in the full file when the surrounding code matters.
Backend:
- Migrate `repo.SingleDownload` to a new Flamego `getRepoRaw` handler.
Same URL shape (`/{owner}/{name}/raw/{ref}/{path}`) so external
consumers (`curl`, scripts) keep working. Bridged from the Macaron
router via `flamegoBridger` so the legacy path doesn't double-route
through `RepoRef` middleware. The ref segment accepts a branch, tag,
or commit SHA; commit SHAs match first (the common case from the
React diff page).
- Delete `repo.SingleDownload` and the legacy `m.Get("/raw/*", ...)`
Macaron handler. `repo.ServeBlob` stays because `internal/route/api/v1`
still uses it for the public REST API.
Frontend:
- Add an `UnfoldVertical` icon button to each file header. Click fetches
the pre + post file contents in parallel via the legacy raw URL,
calls `parseDiffFromFile` to upgrade the `FileDiffMetadata` to
`isPartial: false`, and stores the result keyed by item id.
- The `items` useMemo swaps in the upgraded `fileDiff` when present and
bumps the item `version` so Pierre's `CodeView` re-renders that file.
Set `expandUnchanged: true` globally so non-partial files immediately
render all context lines.
- Show a spinner during fetch, hide the button once expansion succeeds.
Skip the button for added/deleted files (no opposite side to expand).
- Added/deleted files preserve the old behaviour (no expansion).
Migrate the React commit diff page off of mocked repo metadata and onto
live web API endpoints, and take over the legacy `/owner/repo/commit/{sha}`
URL so the React page is the canonical commit view.
Backend:
- Split `webapi.go` into `webapi.go` (shared infra), `webapi_user.go`
(user handlers), and `webapi_repo.go` (repo handlers).
- Add `GET /api/web/{owner}/{name}/info` returning repo header data
(avatar, visibility, counts, mirror, viewer state). Mirrors legacy
`RepoAssignment` access logic: admin shortcut + partial-public masking.
- Add `GET /api/web/{owner}/{name}/commit/{sha}` returning commit
metadata only. Patch text lives on the existing `.diff` URL so it
avoids JSON-string escaping and caches independently.
- Migrate `repo.RawDiff` to Flamego `getRepoCommitRawDiff`. Now supports
`?whitespace=` for the React diff toggle. Public URL unchanged.
- Add `POST/DELETE /api/web/{owner}/{name}/watch` and `.../star` returning
the new viewer state + count so the client can update without refetch.
- Delete legacy `repo.Diff` and `repo.DiffJSON`. Add a SPA pass-through
Macaron route at `/owner/repo/commit/{sha}` with the legacy
`[a-f0-9]{7,40}` SHA regex.
Frontend:
- Install `@tanstack/react-query` and wire `QueryClientProvider` in
`router.tsx`. Pass `queryClient` through router context so loaders can
prefetch via `ensureQueryData`.
- Add `lib/queries/repo.ts` with `repoInfoQuery` + watch/star mutations.
- Move `CommitDiff.tsx` → `pages/repo/Commit.tsx` and `CommitDiff.search.ts`
→ `pages/repo/Commit.search.ts`. Rename `CommitDiff` → `RepoCommit`,
`CommitDiffPage` → `RepoCommitPage`, etc.
- Change route from `/$owner/$repo/_diff/$sha` to
`/$owner/$repo/commit/$sha`. Enforce SHA regex via TanStack `params.parse`
and convert API 404s to router `notFound()` so they render the NotFound
page instead of ServerError.
- Loader fetches metadata + raw diff in parallel (plus repo info via
Query cache), assembles them into `RepoCommitPage`.
- Replace `RepoHeader`'s `RepoHeaderRepo` interface with the live
`RepoInfo` type. Watch/Star buttons fire `useMutation` with optimistic
cache updates via `setQueryData`. Anonymous users see sign-in links.
- Swap the "Public"/"Private" pill for a Globe/Lock icon with tooltip.
- Add a collapsible desktop file tree. The toolbar's "Showing N changed
files" row owns a single toggle icon that opens the Sheet on mobile
and toggles the persistent sidebar on desktop. State persists to
localStorage.
- Hide the always-on "Verified" badge until commit signature
verification lands.
- DiffSearch: walk hunks by addition/deletionCount so matches on context
lines and pure-deletion hunks are no longer dropped.
- DiffSearch: nudge popup up to top-1 so it sits closer to the toolbar.
- RepoHeader: add per-repo avatar slot (mocked to favicon for now),
fold mobile tabs past the third into a hamburger overflow, swap
Issues icon from Clock to CircleDot, nudge avatar down 2px to
optically center the off-center favicon glyph.
- CommitDiff: render the authored timestamp as a relative string with
RFC1123 tooltip (matches Gogs's TimeSince template helper); helper
lives in web/src/lib/relative-time.ts.
- CommitDiff: inject GitHub-style yellow into Pierre's selected-line
background overrides so search matches read clearly in both themes.
- AGENTS.md: note that chrome-devtools MCP should run headless.
Adds the full commit diff experience around the @pierre/diffs CodeView
and @pierre/trees FileTree spike from the prior commit:
- RepoHeader, DiffToolbar, FileHeaderMenu, ResizableSidebar components
for the page chrome and per-file actions
- Sheet and Tooltip shadcn primitives
- CommitDiff.search.ts encodes diff toggles in the URL via TanStack
Router validation so the view is shareable
- Sticky workspace lock that pins the toolbar plus tree plus diff to
the viewport once the user scrolls past the commit metadata
- Whitespace mode wired through to git via the diff API's new
whitespace query (ignore-all, ignore-change)
- Per-file collapse, status filter, unified/split toggle, wrap, expand
all and collapse all
- New --color-success, --color-diff-added, --color-diff-removed
tokens documented in DESIGN.md, replacing ad-hoc Tailwind palette
references
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>
## Describe the pull request
A simple fix in public/js/gogs.js making bug upload not result in a
timeout (added just one line)
Link to the issue: closes https://github.com/gogs/gogs/issues/6149
## Test plan
- Set the max_size of `attachment` to a high number
```toml
[release.attachment]
ENABLED = true
ALLOWED_TYPES = */*
MAX_SIZE = 512
MAX_FILES = 20
```
- Upload a file to releases
It doesn't randomly timeout!
Related to #7864
## Describe the pull request
Fix the path of the s6-svscan binary path in the Dockerfile. As
mentionned in the issue, it is probably to the alpine base image change
(from `3.17` to `3.21`).
Link to the issue:
https://github.com/gogs/gogs/issues/7864#issuecomment-2558323928
Credit to @cryptovaltt
## Test plan
Build the image and check if the application can be ran. E.g.:
```bash
docker build -t gogs:working-7864 -f Dockerfile .
docker run --name=gogs -p 10022:22 -p 10880:3000 -v gogs:working-7864 --rm
```
This pull request targets issue #6573.
It provides a new API endpoint: `/api/v1/repos/{org}/{repo}/commits?pageSize=<int>` with a default page size of 30 commits (the same as the UI).
This implementation currently only focuses on the main/master branch of the repository, and does not provide the ability to return commit history for other branches.
- Note: Since the logic for converting a git.Commit to api.Commit had to be used in `GetAllCommits` and `GetSingleCommit`, I decided to pull the code out into a helper function, ` gitCommitToAPICommit(commit, context)`.
innodb_file_format and innodb_large_prefix have been deprecated with MariaDB v10.2 and removed with v10.3.1. They have been reintroduced with v10.4.3 but remain deprecated and unused:
- https://mariadb.com/kb/en/innodb-system-variables/#innodb_file_format
- https://mariadb.com/kb/en/innodb-system-variables/#innodb_large_prefix
Setting those variables on MariaDB >=10.3.1 leads to the following error:
"ERROR 1238 (HY000) at line 7: Variable 'innodb_file_format' is a read only variable"
Since semantic versioning patch versions cannot be compared via numeric operators, only the major + minor versions are compared against 10.3. Since v10.2.2 the defaults match the desired values, so there is only the single patch version 10.3.0 where, when explicitly set differently via MariaDB configs, this commit could lead to an unwanted database format. In favour of a simple SQL change, this case is ignored.
This commit additionally removes trailing spaces and the doubled trailing empty line.
Signed-off-by: MichaIng <micha@dietpi.com>
As Golang supports getting usernames via the standard library, this function
is now used to get the username if the environment variables are empty.
Using the standard library as a fallback is intended to keep compability
to existing implementations that rely on the environment variables dictating
the current username.
* Add new methods
* Use Users.Create to replace previous hack
* Reduce side effect
* Do not clear tables when test failed
* test_users_Authenticate
* Rename constant
* test_users_Create
* test_users_GetByEmail
* test_users_GetByID
* test_users_GetByUsername
This means that when using the API to create a new team, the output
contains the existing team ID, not just the name.
While there may be the thought that this reveals sensitive
information, it is never the case that a user can create or update
a team without permission to view the teams in the first place.
* Add unit test for `authenticate` middleware
* Add more cases
* Add tests for verifyOID and internalServerError
* Add tests for verifyHeader
* Add tests for authroize
Not all routes need session, register session and CSRF middleware as global is a waste of resource, and creating a lot one-time off yet never used session records.
This PR groups the contents api endpoint with both `""` and `/*` as
valid URL patterns.
When `""` is the URL pattern, this means that no repo path has'nt been
provided, in which case the path would be the default repo path.
When `"/*"` is the URL pattern, then this would return the contents at
the specified path if it's valid.
Github API v3 is conformant to this behavior and have verified it
locally.
* conf: add tests for utils.go
* conf: add tests for static.go
* mock os/exec
* Run tests on Windows
* appveyor: fix gcc not found
* computed: add unit tests
* log: add unit tests
* log: fix tests on Windows
* conf: add some tests
* Finish adding tests
* Cover more cases
* Add tests for testutil
* Add more tests
* add basic git repository tree api (#5934)
This PR adds the tree api endpoint to gogs api:
`GET/repos/:owner/:repo/git/trees/:tree_sha`
This new api endpoint that is being added is in conformance to
the GitHub REST API v3 specification. Documentation can be found
here: developer.github.com/v3/git/trees/#get-a-tree
For a given user, repo and sha value, this api (currently) returns
a single tree using the SHA1 value for that tree.
- Recursive implementation is yet to be implemented.
- Creating a Tree using POST is yet to be implemented.
Example curl:
```
l curl -H "Authorization: token REDACTED" http://localhost:3000/api/v1/repos/root/testrepo/git/trees/c59441ded1549b149def0d4c54594d31a7f3718f -X GET | jq .
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 940 100 940 0 0 12034 0 --:--:-- --:--:-- --:--:-- 12051
[
{
"sha": "c59441ded1549b149def0d4c54594d31a7f3718f",
"tree": [
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "472ac2361b65136b393d652de25341e2ea44f299",
"size": 1077,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/472ac2361b65136b393d652de25341e2ea44f299"
},
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "70fcb456d436f08462602f26df6fb7e167e7a916",
"size": 12,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/70fcb456d436f08462602f26df6fb7e167e7a916"
},
{
"mode": "120000",
"path": "/home/bharatnc/gogs-repositories/root/testrepo.git",
"sha": "092c58d4b63df5779a4d020b1fdbb762421bbb4f",
"size": 380,
"type": "blob",
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/092c58d4b63df5779a4d020b1fdbb762421bbb4f"
}
],
"url": "http://localhost:3000/api/v1/repos/root/testrepo/git/trees/c59441ded1549b149def0d4c54594d31a7f3718f"
}
]
```
* remove vertical space
* make go.mod to be same as in master
* rename structs to sound better
* simplify expressions and fix error msg
* Update tree.go
* Update tree.go
* display file name instead of repo path
* Update tree.go
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
* fixed private repositories are hidden in the organization's view
* use go-bindata integrate public and templates files to gogs binary
* optimize Dockerfile don't COPY public and templates files
* use kevinburke's go-bindata to generate assets code
* reset develepment as default run mode in configure file
* optimize generated assets code relayout and help function
* fixed code format
* Update conf/app.ini
* assets: add LICENSE headers
* Some housekeeping
* assets/public: simplify code logic
* assets/templates: simplify code logic
* cmd/web: more concise variable names
* Minor changes
* Add custom public and templates support back
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
* able fill pull request title by template from md file
* fix: unusedresult: result of fmt.Sprintf call not used (from govet)
* fix: remove import fmt -> not used
* after review / PullRequestTitleTemplateCandidates moved to after line 39
* Update pull.go
* Update pull.go
Co-authored-by: ᴜɴᴋɴᴡᴏɴ <u@gogs.io>
When running gogs after the first time, if the image has changed (update
rebuild), the /app/gogs directory will have changed owner back to
root:root, but /data will likely not be since the data directories are
likely to be persistent.
Checking /app/gogs separately fixes this.
* updated the highlight.js plugin
* added some explicit mappings for syntax highlighting
* public: makes CodeMirror mode by filename extension lookup case-insensitive
* Protect local repo copy deletion with repoWorkingPool, and delete the local
copy on owner name change.
* Update internal/db/user.go
Co-Authored-By: Unknwon <u@gogs.io>
* Error format on local repo and wiki deletion
* api/v1: don't allow multiple tokens with same name
Fail with 422 Unprocessable Entity if the token name
already exist
ref: https://github.com/gogs/gogs/issues/5587
* Move new token error type to models/errors/token
* Remove "useless" ListAccessTokensByName function
* Add an i18n entry for token_name_exists
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
* admin can remove observers from the repository (#5782)
Added wait for SQL as it may take more time to start up on a router: make sure you configure this before using.
Proper Start/Stop/Reset is now implemented.
* Add rsync to docker.
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* Add rsync to docker
Add rsync to docker.
Rsync is nearly a necessity to optimize backup inside Openshift container.
Using TAR (default without Rsync), the process of external backup constantly stops at the middle.
* pkg/context: Render live notice banner from file
- Contexter checks if there is a file called 'notice' under the
GOGS_CUSTOM directory and loads it.
- The first line is treated as a header/title and everything else as the
message body.
- Message body is rendered as HTML (tags allowed).
- File size is limited to 1024 bytes.
- File mime type must be text.
- Notice is rendered in head.tmpl for all pages.
* pkg/context: Rename maxlen to maxSize
Rename maxlen to maxSize for the maximum size (in bytes) of the notice
file to render.
Define the variable when needed to avoid instantiating it when the file
doesn't exist.
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Package name after license header
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Don't print 'Found notice file'
Becomes too verbose as it prints on every page load when the file
exists.
* pkg/context: Match project conventions
Import order and grouping
Variable names:
fileloc -> fpath
fp -> f
finfo -> fi
* pkg/context: Remove empty line
Co-Authored-By: ᴊ. ᴄʜᴇɴ <u@gogs.io>
* pkg/context: Render notice as markdown
Server notice file should be named 'notice.md'. The contents of the
file are treated as markdown and rendered as a warning message at the
top of every page.
* Update notice.go
Co-authored-by: ᴊ. ᴄʜᴇɴ <u@gogs.io>
The chown command in the setup file of Gogs is supposed to be executed just once. As soon as the app.ini file exists, this step should be skipped. However, the test was checking if a directory with the name app.ini exists instead of a file. Therefore, the chown command was executed on each boot.
* Added option to use plain text alt to HTML emails. Should make the messages friendlier for spam filters.
* Check that plaintext conversion worked before adding the HTML alt
* Add description of ADD_PLAIN_TEXT_ALT to app.ini
* Added comment clarifying html AddAlternative
At some point after #4970 was merged, isomorphic-git started sending a custom User-Agent in its HTTP requests to deal with some services (\*cough\* gists \*cough\*) which filtered git traffic by User-Agent. Sadly, this broke cloning from Gogs using isomorphic-git in the browser (https://github.com/isomorphic-git/isomorphic-git/issues/555). This PR fixes it by telling browsers it is OK for CORS requests to send a custom User-Agent header.
* Add default Authentication Switch.
* adjust the code accroding to reviews
* #1. Remove redudant logic.
#2, Fix a bug in "Edit" panel.
* Remove unused logic
* Fix local authentication files are not flushed.
* refactor according to review.
* add new Dockerfile.docker-ce for docker-ce(>=v17.06) to build docker image
* change default Dockerfile to support docker-ce(>=v17.06) multi-stage build
Spring cloud config server dependency spring cloud config monitor looks for X-Github-Event condition PropertyPathEndpoint.class -> GithubPropertyPathNotificationExtractor.class if ("push".equals(headers.getFirst("X-Github-Event"))) {...}
* pull request merges now allow for custom commit messages
* allow i18n on commit_message label
* place label above textarea for commit message
* rename commit message for pull requests into commit description and pass to git separately
* First code for repository avatars
* Last code for repository avatars
- add new option for repo avatars location on filesystem
- add route catch in web
- add new fields to repo model
- add migration
- update settings handlers
- update repo header template
* Update locale messages
* Add repo avatars to home page
* Add repo avatars to organization right panel
* Show repo avatars in repo list
* Remove AvatarEamil field, remove Gravatar support, use generic locale messages
* Fix migration
* Fix seed and not used tool
* Revert public css changes, add them to less files
* Latest lessc (2.6.0) don't put result into file but output to stdout
So redirect output to file
* Simplify things:
- migration don't needed, and table changes too
- just upload file to repo avatar storage
- or generate random image
* Fix repo image seed - name not unique
* Get rid of not needed model fields
* Class value is enough, remove height attribute
* Don't generate random avatar for repository
- use html and semantic ui icons if no avatar found
* Update styles and templates for repo
- use repo icon as default avatar
- use globe icon for public repos
- add micro style for repo avatars at dashboard
* Remvoe redundant empty line
* Fix nl2br filter - must return string
* Fix css style for micro-repo-avatar in dashboard list
* Remove `|len`, works fine w/o it.
* Update after review 2:
- use static route for repository avatar
- format images settings block in settings
* Update after review 2:
- no random avatar for repo
* Update after review 2:
- no random avatar for repo 2
- update imports
- update UploadAvatar* functions
* Update after review 2:
- update templates
* Fix trace call
* Remove unused immport since we use static route for repo avatars.
* Update repository description field to contain more than 256 symbols
- update repository model - description field now is `TEXT` and limited by 4000 symbols
- new migration
- add description to html forms - repo creation and repo settings
- add translation for description
* Update for description field, new features
- add autosize (height) for description textarea, new plugin
- set max description length to 512 symbols
- update locales
* Fix migration - typo in var
* Update repo description behaviour
- add textarea autosize for /repo/create
- add symbols counter under description testarea (create/edit)
* Fix function definition - it a var
* Revert ru-RU locale
* Update by review
- Use type `varchar(512)` in migration
- Remove unused files from autosize plugin
* Fix migration - new project paths
* Fixes after review 2
- copyright year
- format includes
- use switch instead of multi-if
* Remove unused `default:` option.
* Added deletion of an empty line at the end of file (#5261)
Signed-off-by: Alexey Terentyev <axifnx@gmail.com>
* Fix after feedback
Signed-off-by: Alexey Terentyev <axifnx@gmail.com>
* fixed make build failure when enviroment of GOPATH have Multiple items
gogs source in /other/path/to/go/src/github.com/gogs/gogs and then
>cd /other/path/go/go/src/github.com/gogs/gogs
>GOPATH=/path/to/go:/other/path/to/go make
will also build success in this fixed code
* in makefile rename gogits to gogs
* Add markdown renderer function to templates, use it for description in repo template
* Fix function call
* Define function Md2html in template namespace
* Change filter from Md2html to nl2br
* Change filter name to NewLine2br as suggested
* Update description output:
- just replace `\n` by `<br>`
- sanitize html after replace
If the user provides a string that does not contain "%s", fmt.Sprintf
silently appends "%!(EXTRA type=value)" instead of failing loudly.
This fixes#4375.
It's a fun feature but `ENABLE_FEDERATED_AVATAR` being true by default
leads to confusion and huge slowdowns (see #2838, #980, #914) --- it's
unexpected that Gogs requires DNS configured (?) for avatars.
Avatar lookup is a niche feature that I don't believe should be enabled
by default given how prone it is to causing problems.
Sets BaseRepo value for each resulting fork in GetForks().
Finds correct permissions for parent repository in APIFormat().
The output JSON is a little redundant, perhaps we should offer a
different view of the api.Repository without the Parent attribute?
Signed-off-by: Dennis Chen <barracks510@gmail.com>
* Enable Automated builds for aarch64
* Native aarch64 build
* Move to the new organization
* Try to build it with latest go binary
* Rebuild using Go 1.10
* Disallow web ui to delete protected branch
* Fix for branches not yet protected
Had to change how error was handled. If a branch had not yet been protected the error would be generated.
Reworked to start as false and then use the protected if it was found.
* add issue labels
* remove hyperlink from issue label
* wrap labels in right aligned span
* put issues with div
put the issue labels within a div so they don't interfere with the number of comments
- The `commits_table.tmpl` pagination uses a `$.FileName` variable in
order to generate the next/previous URLs, but it seems like that
variable was no longer being populated in `renderCommits`.
If a branch was deleted from server, sometimes it is not reflected
on local copy. Therefore, we need to remove the branch with same
name if it is out of sync and then checkout to correct version.
For DVCS, either merge or rebase works for getting new code in a pull
request in the main branch.
The rebase workflow produces a linear history which is cleaner, and
more bisect-able.
This commit adds a repo-level option to enable the rebase workflow. Once
enabled, "Merge Pull Request" will be replaced by
"Rebase and Merge Pull Request" which does exactly what the user wants.
It's unlikely a project wants a mixed-use of both rebase and merge
workflows, therefore the feature is not implemented as a drop-down
button like what GitHub does
(https://github.com/blog/2243-rebase-and-merge-pull-requests).
* Add API endpoint /api/v1/user/orgs
The difference between this endpoint and
/api/v1/admin/users/<username>/orgs,
is that here you're creating a repo with the `user`
that corresponds to the API token you're using.
* Extract duplicate API org creation
* Enable Automated builds for rpi
* Rename the file to fit only for Docker Hub
* Update the binary to v2.9.0+resin1
* Restore default status
* Commit as new file
In order to avoid breaking native builds
Ensure that the IN clause contains one value at least. The idea is avoid a
syntax error in the SQL sentence and rollbacks in the transactions.
For example:
ERROR: syntax error at or near ")"
LINE 1: ...RE ... and team.id IN ();
We will always add the -1 value in the IN list.
* don't load key when key size should not be checked
This makes it possible for users with incompatible ssh-keygen versions
to just disable the check completely without running into errors.
* add proper ed25519 constant
The x/crypto/ssh library has support for ed25519 now, so it is possible
to support it.
App would panic if user has validation error on installation and
the sanitizer is not yet built. Therefore we need a minimal valid
object for sanitizer at start.
Special characters such as '@', ';', '#' and ':' could occur in
password portion of credentials, which breaks the interpretation
and saves 'config' file in with extra characters that are not
recognized by Git (due to INI library).
When Git client has cached credentials for a site, missing response
header 'WWW-Authenticate: Basic realm="."' will result in Git client
does not prompt user to input credentials again but plain error
message and halts push/pull process.
Only expose public APIs for 'Sanitize' and 'SanitizeBytes' to
eliminate unintentional modifications to sanitizer policy. Also
use 'sync.Once' to make sure multiple calls of 'NewSanitizer' is
safe (although should never happen, but this is a better way).
To further support more markup languages (e.g. Org-mode, AsciiDoc,
reStructuredText), the name 'markdown' is inappropriate.
This is the first step towards more markup language support.
If user creates a protect branch for the first time (which has ID=0),
it generates invalid whitelist records with 'protect_branch_id=0'.
This prevents future updates of protect branch whitelist.
Migration: remove existing invalid protect branch whitelist records.
* models/repo.go SearchRepositoryByName()
Updated function to return public and private repositories that the logged in user has been given rights to view
issue #3088
* models/repo.go SearchRepositoryName
changed repository table alias to 'repo'
removed debug line
* models/repo.go SearchRepositoryByName
modified UserID search query to use the "access" table instead of team_repo, team_user etc
* models/repo.go SearchRepositoryByName
1) uppercased SQL keywords
2) removed alias for ACCESS table
Move 'Commits' and 'Releases' tabs down to body.
This patch also reduces page load time for pages that do not need
to use commits count anywhere. Get commits count can hurt
performance badly for huge repositories that has tens of thousands
commits like Linux Kernel.
Previously, we load all releases of a repository which could hurt
performance when the repository has a lot of releases.
Now we're able to only load releases in current page view we need
to show by matching with 'tag_name'.
Previously, if the user base directory somehow doesn't exist, the
application throws 500 for failure of rename.
Now it detects if the application should rename or just create a
new directory.
Sometimes user could simply request wrong URL, but if that wrong URL
has nothing related Git HTTP operations, HTTP Basic Authentication
should not prompted. Instead, clean 404 page should be presented.
The patch also supports Git HTTP operations without '.git' suffix
to the repository name, which addresses #4226 and #4189.
This also addresses #4231. It is now ignoring nonexistent
organizations returned from 'org_user' table.
This was a bug caused in older version that didn't cleanup
'org_user' table when delete an organization.
Was only possible to correctly redirect to pull request page within
same repository. And didn't take care of case when upstream has
disabled pull request.
Also add a new method 'PullRequestURL' to unify the code.
- Add Ukrainian translation into templates/home.tmpl
- Fix Ukrainian language name in conf/app.ini
because on Ukrainian 'language' is female.
- Add me as translator into conf/locale/TRANSLATORS
1. Fix sample content didn't show up when hook doesn't exist.
2. Fix CSS 'word-break' to use 'break-word' not 'break-all'.
3. Fix single quote in 'locale_en-US.ini' file.
Usage: <url>?page={page}&pageSize={pageSize}
Also avoid/removed getting total commits count for pagination,
users are only allowed navigation by 'newer' and 'older'.
We used to handle SSH and HTTP push separately which produces
duplicated code, but now with post-receive hook, the process
is unified to one single place and much cleaner.
Thus, UpdateTask struct is removed.
Narrow down the range of Git HTTP routes to reduce condufsing
HTTP Basic Authentication window popup on browser.
By detecting <old-commit, new-commit, ref-name> inside post-receive
hook, Git HTTP doesn't need to read the whole content body anymore,
which completely solve the RAM problem reported in #636.
Code only fetched issues corresponding to the pull requests, and left
out necessary base/head repository objects, which is required later
to generate API format.
Due to recent code refactor, ctx.PullRequest is not initialized for
route repo.CompareAndPullRequest, which leads the UI thinks the
compare is not happening inside the same repository.
The current fix is to allow compare URL to include redundant head
user name so everything works fine again, but code logic isn't
as clean as before.
Made comments about possible future fix.
* Check deploy keys when Gogs is run with require_sign_in_view
Check if the deploy key can access to a repository. A deploy key
doesn't represent an gogs user, so in a site with Service.RequireSignInView
activated we should give read access only in the repositories where
this deploy key is in use. In other case, a deploy service or system
using an active deploy key can get read access to all the repositories
in a Gogs service.
* Refactoring: Comments starts in a new line
* Minor change in a comment
* Code cleaning. Replace spaces with tabs
* Implement organizations listing in setting and allow user to create new organization.
* Implement organizations listing in setting and allow user to create new organization.
* Add space remove by mistake
* Remove unused part of the template
* Update display and behavior according to @Unknown remarks
Site admin now has to enable manually by config option
[repository] ENABLE_LOCAL_PATH_MIGRATION = true.
Site admin always grants this permission, but regulars users have
to be allowed by site admins in admin user panel.
* Fix assigned/created issues in dashboard.
* Use GetUserIssueStats for getting all Dashboard stats.
* Use gofmt to format the file properly.
* Replace &Issue{} with new(Issue).
* Check if user has access to given repository.
* Remove unnecessary filtering of issues.
* Return 404 error if invalid repository is given.
* Use correct number of issues in paginater.
* Use temporary file to avoid out-of-memory when receiving big chunk.
Not perfect but I think it's a reasonable solution.
For small request bodies, I suppose performance wouldn't be an issue.
For large ones, this seems to be a necessary evil.
* Must close the open file to avoid fd leaks
Closes#3696, #3611
Previously, ProdMode can only be true for web server,
which always prints dev mode log message to incoming SSH
connections and leaks unexpected information.
* #3480 Fix new ssh key adding issues
Added regular exp match (108) and remove training new line (111) that cause system to think its an ssh2 key.
* #3480 Fix new ssh key adding issues
-Sanitizate new lines (windows format) in posted key
-Edit sanitization implementation to use string replace for code readability and maintenability.
* UpdateIssueUsersByMentions was calling database write operations while
a transaction session was in progress. MailParticipants was failing
silently because of the SQLITE_LOCKED error. Make sure failures in
MailParticipants enter the log, and pass on the transaction context.
issue: let caller pass in database context, and use it
issue_comment: obtain database context to pass to UpdateIssueMentions
issue_comment: log any error from call to MailParticipants
issue_mail: pass on database context to UpdateIssueMentions
* issue: forgot debug statement
* Remove unused custom-alphabet feature of random string generator
* Fix modulo-biased random string generator
* Random string generator should return error if it fails to read random data via crypto/rand
* Can use a predefined set of labels
* Change UI
* Fix HTML file indentation
* Avoid reading file from other directory (security issue)
* Apply a better fix
* Remove not used variable
* Merge upstream/develop
* Do modifications
* Raname
* remove binding + rename variable
* Implement wiki mirroring, add Update mirrors operation to admin dashboard
* bindata.go update after merge
* Implement checking Git repo endpoint existence, support for BB included
* Remove admin dashboard operation
Fix bindata.go
* Apply gofmt to repo model file
* Try to remove bindata from PR
* Revert accepted wiki names change in favor of better system
* Remove unused imports
This is an attempt to fix#3089 following the strategy introduced
in d625e41c6c, although that strategy
by itself does not seem to be sufficient.
What needs be done is honouring the redirect_url query parameter
from the auth router.
* Do not show the "Sign up for free" button in issue tracker
The "Sign in to comment" link is good enough and will correctly
show or not show the "Sign Up" button link for those not having
an account already.
Fixes#3407 (link to nowhere when registration is disabled)
* Move html from translation to template
* Remove extra space in `{{ .SignInLink }}`.
* add git-daemon-export-ok "support"
* Slight fix to git-daemon-export-ok
* Add error-checking for git-demon-export-ok
* Remove old comments and fixed logging-issues
* Check if git-daemon-export-ok exists or not
* Add support for federated avatars
Fixes#3105
Removes avatar fetching duplication code
Adds an "Enable Federated Avatar" checkbox in user settings
(defaults to unchecked)
Moves avatar settings all in the same form, making
local and remote avatars mutually exclusive
Renames UploadAvatarForm to AvatarForm
as it's not anymore only for uploading
* Run gofmt on all modified files
* Move Avatar form in its own page
* Add go-libravatar dependency to vendor/ dir
Hopefully helps with accepting the contribution.
See also #3214
* Revert "Add go-libravatar dependency to vendor/ dir"
This reverts commit a8cb93ae640bbb90f7d25012fc257bda9fae9b82.
* Make federated avatar setting a global configuration
Removes the per-user setting
* Move avatar handling back to base tool, disable federated avatar in offline mode
* Format, handle error
* Properly set fallback host
* Use unsupported github.com mirror for importing go-libravatar
* Remove comment showing life exists outside of github.com
... pity, but contribution would not be accepted otherwise
* Use Combo for Get and Post methods over /avatar
* FEDERATED_AVATAR -> ENABLE_FEDERATED_AVATAR
* Fix persistance of federated avatar lookup checkbox at install time
* Federated Avatars -> Enable Federated Avatars
* Use len(string) == 0 instead of string == ""
* Move import line where it belong
See
https://github.com/Unknwon/go-code-convention/blob/master/en-US/import_packages.md
Pity the import url is still the unofficial one, but oh well...
* Save a line (and waste much more expensive time)
* Remove redundant parens
* Remove an empty line
* Remove empty lines
* Reorder lines to make diff smaller
* Remove another newline
Unknwon review got me start a fight against newlines
* Move DISABLE_GRAVATAR and ENABLE_FEDERATED_AVATAR after OFFLINE_MODE
On re-reading the diff I figured what Unknwon meant here:
https://github.com/gogits/gogs/pull/3320/files#r73741106
* Remove newlines that weren't there before my intervention
- Try to reduce memory allocations
- Add possibility to disable diff highlight (can improve performance for large diffs)
- Tweaking with cost for prettier (cleaner) diffs
- Do not calculate diff when the number of removed lines in a block is not equal to the number of added lines (this usually resulted in ugly diffs)
* Fix#3315: Release dont use tag creation date
* Simplify code and apply gofmt
* remove useless block (ctx.Repo.GitRepo.GetTag) on EditReleasePost
* apply gofmt on modified files
* Add API support for labels.
* Error handling for adding/replacing multiple issue labels
* Revisions to function names and error handling. Use issue.ClearLabels in replace/clear functions
* Additional code cleanup
* Add support for .diff and .patch
Add the ability to get text-diff and format-patch by adding .diff or
.patch in the end of a commit url. Issue #2641
* models: git_diff: various fixes
* Renames commitId to commitID.
* Writes stderr to a bytes.Buffer and displays proper error message on
command failure.
* Various style changes.
Signed-off-by: Dennis Chen <barracks510@gmail.com>
If anonymous (not signed in user) requests page
"/:owner/:repo/pulls" he gets an error:
template: repo/issue/list:11:105: executing "repo/issue/list" at <.PullRequestCtx.Base...>: nil pointer evaluating *models.Repository.Link
This commit fixes that.
Signed-off-by: Dmitry Yu Okunev <dyokunev@ut.mephi.ru>
Since the release struct is initialized with the current `HEAD` of the
current `release.Target` the commit id has to be updated if the tag
commit already exists. Otherwise the linked commit on the release page
will target the current `HEAD` at release time.
When calculating the current behind commit count the calculation should
use the current release target to get the total commit count. Should the
release target not exist anymore the calculation will return zero for
the newest release on that target. Older releases on that target will then
use that calculated commit count as reference.
The only use case that is now somehow invalid is when the release target
was merged / deleted after a tag on that release target:
master 1 - - - - - - - 6
\ /
branch 2 - 3 - 4 - 5
When `4` is the last tag on branch `branch` and the branch `branch` is not
yet deleted the calculated numbers would be:
1 commits to branch since this release
Now if the branch `branch` gets deleted the calculation function will not
find the branch and use the commit count of the newest release (`4`) as
reference resulting in:
0 commit to branch since this release
This fixes#3326
Allows the deletion of a webhook from a repository at the
/:user/:repo/hooks/:id endpoint.
Solves drone/drone issue #1603.
Signed-off-by: Dennis Chen <barracks510@gmail.com>
Executed go fmt
getEngine() not handles DB parameters (#2972) (#2974)
Uses .AllCols() for Update in updateMirror()
Spanish traslation removed
Fixed a wrong way to ommit the --prune option in process.ExecDir() for MirrorUpdate function
Re: issues gogits/gogs#2863 and gogits/gogs#3231
As a result of modifications to the contents of the conf folder, `make bindata`
was run, causing an update to bindata.go.
Meta
-----
This commit will be rebased onto the 'develop' branch.
Also changes the avatar from a jpeg to a png, to allow for
transparent background. The indexed png is also smaller in size.
Note that at the moment the default avatar is only used when
the user requested a custom avatar and the custom avatar file
is not found (should never happen).
In the future the default avatar could be used as a default
return when by-mail avatar lookups fail too (both gravatar
and libravatar support passing a default)
Always send user to settings screen to change avatar.
Drops "change_custom_avatar" localized message, keeps "change_avatar"
for the generic one.
NOTE: only changes the en-US locale, as per
https://github.com/gogits/gogs/wiki/Contributing-Code#those-we-do-not-accept
NOTE: requires rebuild of bindata.go to fully see effects
From https://godoc.org/crypto/tls#Config
ServerName is used to verify the hostname on the returned
certificates unless InsecureSkipVerify is given. It is also included
in the client's handshake to support virtual hosting unless it is
an IP address.
This is needed for certificate validation without InsecureSkipVerify.
* Do not write HTML in text/plain mail part
Fixes#2928
* Pass text/plain first, text/html second
* Do not send plain/text email if html2text failed (untested)
Build only work with the current master of the package. Otherwise, I get this error.
```
...
# github.com/gogits/gogs/routers/api/v1/convert
routers/api/v1/convert/convert.go:200: undefined: gogs.Team
routers/api/v1/convert/convert.go:201: undefined: gogs.Team
...
```
* docker: update build script to use glide + make
- docker/build.sh will now use glide to fetch dependencies
- glide is built from source to keep compatibility with arm
(no pre-prebuilt binary for arm)
- docker/build.sh will also now use the provided Makefile
It will generate an error when trying to get git build has as we do
not ship the 88mo .git directory during the build (should not cause
any problem as the variable it sets was not set previously)
* docker: fix docker arm build
- drop gosu version back to 1.7 as gosu binary for armhf is broken
- see tianon/gosu#19
* docker: update gosu to 1.9
Signed-off-by: Jean-Philippe Roemer <jp@roemer.im>
* Add and start jQuery AreYouSure
* Update SimpleMDE to 1.10.1 for `forceSync` support
* Forgot to remove old version SimpleMDE 1.10.0
* formatting -.-
When use builtin SSH server with concurrent operations, there are probabilities
One connection could use the command from another connections.
Fix this by set SSH_ORIGINAL_COMMAND for each command, not set in global scope.
Replace spaces with "%20" in "urlPrefix", before markdon processing.
The spaces were causing blackfriday (markdown processor) to behave
strange. This fixes#2545.
This allows the user to specify build flags from the make command
line. For example to force a complete rebuild one could use:
make BUILD_FLAGS='-v -a' TAGS="sqlite"
Make user search function look in username (lower_name), full name
(full_name) and primary email (email). This will benefit searching after
user in "explore", admin panel and when adding new collaborators.
Set the description meta tag correctly when there is no repo
description. Also use the ability to trim trailing whitespaces,
to make the template cleaner.
I've noticed that a lot of issues cannot be reproduced on http://try.gogs.io,
which either hints about specific database type problems or
hints about bugs which are already solved in the newer version
(as http://try.gogs.io is usually a newer build).
This patch adds the suggestion to test the issue at http://try.gogs.io in
the Github "issue template". The user can answer: "Yes", "No", "Not relevant".
"Not relevant" is an option where testing on http://try.gogs.io makes no sense as
the bug is unrelated to the Web UI or is very specific in nature.
- Remove the known issue about `.dockerignore` being ignored during DockerHub automated build as this has been fixed
- Added a note on the fact that we currently do no support building the container on RPi1
- Upgrade of gosu to v1.7
- Change in docker/build.sh to use `--no-cache` to prevent APKINDEX creation when installing dev dependencies
- Manual upgrade of Alpine on Raspberry Pi when building to make sure the environment is the same as the standard Dockerfile
Config option [server] SSH_LISTEN_PORT to the port the builtin SSH server will be listen.
It can be different from SSH_PORT which is supposed to be exposed in the clone URL.
This should solve the problem when user runs Gogs inside Docker container
and still want to use builtin SSH server.
This is feature is workaround for #2628 (JumpCloud) and some other services
that allow LDAP search only under BindDN user account, but not allow any LDAP
search query in logged user DN context.
Such approach is an alternative to minimal permissions security pattern for
BindDN user.
According to RFC 4511 4.2.1. Processing of the Bind Request "Clients may send
multiple Bind requests to change the authentication and/or security
associations or to complete a multi-stage Bind process. Authentication from
earlier binds is subsequently ignored."
Therefore we should not use 2 connections, but single one just sending two bind
requests.
- s6 is in main in 3.3, so we no longer need to mangle the repos file
- official image is periodically updated, so it's not preferred to do
upgrades downstream (usually harmless, but inelegant)
- apk-tools in 3.3 supports --no-cache to avoid leaving the APKINDEX
files in the image
When <code> is nested inside <pre>, the next end tag token would not able to be the same
as outer-most start tag. So we only check outer-most start and end tag token to be the same.
Remove the possibility of using email as user name when user actually push
through combination of email and password with HTTP.
Also refactor update action function to replcae tons of arguments with
single PushUpdateOptions struct.
And define the user who pushes code as pusher, therefore variable names shouldn't
be confusing any more.
The old API was using []byte, but was changed to string without running
the tests again.
It also sets the variables from the configuration to make them work.
Maybe there is a better way to do this.
This commit adds the possibibility to use either the native golang
libraries or ssh-keygen to check public keys. The check is adjusted
depending on the settings, so that only supported keys are let through.
This commit also brings back the blacklist feature, which was removed in
7ef9a05588. This allows to blacklist
algorythms or keys based on the key length. This works with the native
and the ssh-keygen way.
Because of #2179 it also includes a way to adjust the path to
ssh-keygen and the working directory for ssh-keygen. With this,
sysadmins should be able to adjust the settings in a way, that SELinux
is okay with it. In the worst case, they can switch to the native
implementation and only loose support for ed25519 keys at the moment.
There are some other places which need adjustment to utilize the
parameters and the native implementation, but this sets the ground work.
- Add the crond init script for s6
- Add the RUN_CROND configuration variable to setup crond
- Crond will not be run by default (hence the `down` file in the service directory)
- `start.sh` check if RUN_CROND = "true" || "1" and remove this file to tell s6 to run the initscript
- Resolves#2597
When repository contains a Slack type hook,
it changes original payload content.
This patch fixes it by using a local object to store
newly created Slack payload instead of assigning
back to the same variable.
- Dockerfile.rpi now uses hypriot/rpi-alpine-scratch as base (build script are available w/ a better maintainer & more updates)
- Dockerfile.rpi updates alpine from v3.2 to v3.3 to be on par with Dockerfile
- Dockerfile now uses alpine:3.3 as base
- Dockerfile.rpi now uses v3.3/community repository without pinning
- Go package is no longer fetched using repository pinning
- Fixes problem while using repository pinning & virtual package at the same time
- Add nsswitch.conf to configure LibC Name Service inside the container
- Change my email in the Dockerfile
- Update build script to install software as a `build-deps` virtual package so that adding a package to it will be automatically removed at the end of the build script
According to the docs [1], the Reply method must be called for all
requests where WantReply is true. This fixes a hanging java ssh
implementation (jsch) which sets WantReply flag and waits for reply from
the server.
[1] https://godoc.org/golang.org/x/crypto/ssh#Request.Reply
Using this script:
1. Copy scripts/launchd/io.gogs.web.plist into /Library/LaunchDaemons
2. The script assumes Gogs is running under 'gogs' user and group, modify
/Library/LaunchDaemons/io.gogs.web.plist if you want to user different user.
3. The script assumes Gogs is installed in /Users/git/gogs, modify
/Library/LaunchDaemons/io.gogs.web.plist if you installed Gogs in different
location.
4. Once you are sure that running Gogs manually via `gogs web` works fine, run
it as a launchd service with:
sudo launchctl load -F /Library/LaunchDaemons/io.gogs.web.plist
From now on launchd will ensure Gogs is running, eg. when system is restarted.
If the init script is called with `status`, the rc.subr(8) routines check if
the first argument associated with the pid in the pidfile is equal to
`procname`. By default, `procname` is equal to the value of `command`. In our
case, `command` contains a space (i.e. has multiple arguments), so `procname`
can never be equal to the first argument of the command associated with the
pid.
Set `procname` to the first argument of `command` to fix the `status` command
of the init script.
Analyze and help fix the GitHub Security Advisory (GHSA) at: $ARGUMENTS
Steps:
1. Fetch the GHSA page using `gh api repos/gogs/gogs/security-advisories` and understand the vulnerability details (description, severity, affected versions, CWE).
2. Verify the reported vulnerability actually exists, and why.
3. Identify the affected code in this repository.
4. Propose a fix with a clear explanation of the root cause and how the fix addresses it. Check for prior art in the codebase to stay consistent with existing patterns.
5. Implement the fix. Only add tests when there is something meaningful to test at our layer.
6. Run all the usual build and test commands.
7. If a changelog entry is warranted (user will specify), add it to CHANGELOG.md with a placeholder for the PR link.
8. Create a branch named after the GHSA ID, commit, and push.
9. Create a pull request with a proper title and description, do not reveal too much detail and link the GHSA.
10. If a changelog entry was added, update it with the PR link, then commit and push again.
Thank you for investing your time in contributing to our projects!
Read our [Code of Conduct](https://go.dev/conduct) to keep our community approachable and respectable.
In this guide you will get an overview of the contribution workflow from opening an issue, creating a PR, reviewing, and merging the PR.
Use the table of contents icon <img src="https://github.com/github/docs/raw/50561895328b8f369694973252127b7d93899d83/assets/images/table-of-contents.png" width="25" height="25" /> on the top left corner of this document to get to a specific section of this guide quickly.
## New contributor guide
To get an overview of the project, read the [README](/README.md). Here are some resources to help you get started with open source contributions:
- [Finding ways to contribute to open source on GitHub](https://docs.github.com/en/get-started/exploring-projects-on-github/finding-ways-to-contribute-to-open-source-on-github)
- [Set up Git](https://docs.github.com/en/get-started/quickstart/set-up-git)
- [Collaborating with pull requests](https://docs.github.com/en/github/collaborating-with-pull-requests)
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
- [Talk, then code](https://www.craft.do/s/kyHVs6OoE4Dj5V)
In addition to the general guides with open source contributions, you would also need to:
- Have basic knowledge about web applications development, database management systems and programming in [Go](https://go.dev/).
- Have a working local development setup with a reasonable good IDE or editor like [Visual Studio Code](https://code.visualstudio.com/docs/languages/go), [GoLand](https://www.jetbrains.com/go/) or [Vim](https://github.com/fatih/vim-go).
- [Set up your development environment](/docs/dev/local_development.md).
## Issues
### Ask for help
Before opening an issue, please make sure the problem you're encountering isn't already addressed on the [Troubleshooting](https://gogs.io/asking/troubleshooting) and [FAQs](https://gogs.io/asking/faq) pages.
### Create a new issue
- For questions, ask in [Discussions](https://github.com/gogs/gogs/discussions).
- [Check to make sure](https://docs.github.com/en/github/searching-for-information-on-github/searching-on-github/searching-issues-and-pull-requests#search-by-the-title-body-or-comments) someone hasn't already opened a similar [issue](https://github.com/gogs/gogs/issues).
- If a similar issue doesn't exist, open a new issue using a relevant [issue form](https://github.com/gogs/gogs/issues/new/choose).
- Blank issues that are not coming from maintainers will be closed without a response.
### Pick up an issue to solve
- Scan through our [existing issues](https://github.com/gogs/gogs/issues) to find one that interests you.
- The [👋 good first issue](https://github.com/gogs/gogs/issues?q=is%3Aissue+is%3Aopen+label%3A%22%F0%9F%91%8B+good+first+issue%22) is a good place to start exploring issues that are well-groomed for newcomers.
- Do not hesitate to ask for more details or clarifying questions on the issue!
- Communicate on the issue you are intended to pick up _before_ starting working on it.
- Every issue that gets picked up will have an expected timeline for the implementation, the issue may be reassigned after the expected timeline. Please be responsible and proactive on the communication 🙇♂️
## Add new features or make big changes
New features or big changes require proposals before we may be able to accept any contribution. Proposals should be posted to the [Discussions - Proposal](https://github.com/gogs/gogs/discussions/categories/proposal) category for review and discussions. GitHub Discussions provides sub-threading which is much more suitable than GitHub Issues for discussions to happen. Please read [Write a proposal for open source contributions](https://unknwon.io/posts/220210-write-a-proposal-for-open-source-contributions/) to begin with.
## Pull requests
When you're finished with the changes, create a pull request, or a series of pull requests if necessary.
Contributing to another codebase is not as simple as code changes, it is also about contributing influence to the design. Therefore, we kindly ask you that:
- Please acknowledge that no pull request is guaranteed to be merged.
- Please always do a self-review before requesting reviews from others.
- Please expect code review to be strict and may have multiple rounds.
- Please make self-contained incremental changes, pull requests with huge diff may be rejected for review.
- Please use English in code comments and docstring.
- Please do not force push unless absolutely necessary. Force pushes make review much harder in multiple rounds, and we use [Squash and merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/about-pull-request-merges#squash-and-merge-your-pull-request-commits) so you don't need to worry about messy commits and just focus on the changes.
### Things we do not accept
1. Updates to locale files (`conf/locale_xx-XX.ini`) other than the `conf/locale_en-US.ini`. Please read the [guide for localizing Gogs](https://gogs.io/advancing/localization).
1. Docker compose files.
### Coding guidelines
1. Please read the Sourcegraph's [Go style guide](https://github.com/sourcegraph/sourcegraph-public-snapshot/blob/main/doc/dev/background-information/languages/go.md).
## Your PR is merged!
Congratulations 🎉🎉 Thanks again for taking the effort to have this journey with us 🌟
_This is generated from the [minor release template](https://github.com/gogs/gogs/blob/main/.github/ISSUE_TEMPLATE/dev_release_minor_version.md)._
## Before release
On the `main` branch:
- [ ] Close stale issues with the label [status: needs feedback](https://github.com/gogs/gogs/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+needs+feedback%22).
- [ ] [Sync locales from Crowdin](https://github.com/gogs/gogs/blob/main/docs/dev/import_locale.md).
- [ ] [Update CHANGELOG](https://github.com/gogs/gogs/commit/f1102a7a7c545ec221d2906f02fa19170d96f96d) to include entries for the current minor release.
- Do not forget adding entries for GHSA patches.
- [ ] Cut a new release branch `release/<MAJOR>.<MINOR>`, e.g. `release/0.14`.
## During release
On the release branch:
- [ ] [Update the hard-coded version](https://github.com/gogs/gogs/commit/f0e3cd90f8d7695960eeef2e4e54b2e717302f6c) to the current release, e.g. `0.14.0+dev` -> `0.14.0`.
- [ ] Wait for GitHub Actions to complete and no failed jobs.
- [ ] Publish new RC releases (e.g. `v0.14.0-rc.1`, `v0.14.0-rc.2`) ⚠️ **on the release branch** ⚠️ and ensure Docker and release workflows both succeed.
- [ ] Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download one of the release archives and run through application setup to make sure nothing blows up.
- [ ] Publish a new [GitHub release](https://github.com/gogs/gogs/releases) ⚠️ **on the release branch** ⚠️ with entries from [CHANGELOG](https://github.com/gogs/gogs/blob/main/CHANGELOG.md) for the current minor release.
- [ ] [Wait for new image tags for the current release](https://github.com/gogs/gogs/actions/workflows/docker.yml?query=event%3Arelease) to be created automatically on both [Docker Hub](https://hub.docker.com/r/gogs/gogs/tags) and [GitHub Container registry](https://github.com/gogs/gogs/pkgs/container/gogs).
- Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download all release archives and [generate SHA256 checksum](https://github.com/gogs/gogs/blob/main/docs/dev/release/sha256.sh) for all binaries to the file `checksum_sha256.txt`.
- [ ] Upload all archives and `checksum_sha256.txt` to https://dl.gogs.io.
## After release
On the `main` branch:
- [ ] Update the repository mirror on [Gitee](https://gitee.com/unknwon/gogs).
- [ ] Create a new release announcement in [Discussions](https://github.com/gogs/gogs/discussions/categories/announcements).
- [ ] Send a tweet on the [official Twitter account](https://twitter.com/GogsHQ) for the minor release.
- [ ] Close the milestone for the minor release.
- [ ] [Bump the hard-coded version](https://github.com/gogs/gogs/commit/a98968436cd5841cf691bb0b80c54c81470d1676) to the new develop version, e.g. `0.14.0+dev` -> `0.15.0+dev`.
- [ ] Run `grep -rnw "\(LEGACY\|Deprecated\)" internal` to identify deprecated code that is aimed to be removed in current develop version.
- [ ]**After 14 days**, publish [GitHub security advisories](https://github.com/gogs/gogs/security) for security patches included in the release.
_This is generated from the [patch release template](https://github.com/gogs/gogs/blob/main/.github/ISSUE_TEMPLATE/dev_release_patch_version.md)._
## Before release
On the release branch:
- [ ] Make sure all commits are cherry-picked from the `main` branch by checking the patch milestone.
- Run `moon run gogs:build-prod --force` for every cherry-picked commit to make sure there is no compilation error.
- [ ] [Update CHANGELOG on the `main` branch](https://github.com/gogs/gogs/commit/f1102a7a7c545ec221d2906f02fa19170d96f96d) to include entries for the current patch release.
## During release
On the release branch:
- [ ] [Update the hard-coded version](https://github.com/gogs/gogs/commit/f0e3cd90f8d7695960eeef2e4e54b2e717302f6c) to the current release, e.g. `0.12.0` -> `0.12.1`.
- [ ] Wait for GitHub Actions to complete and no failed jobs.
- [ ] Publish new RC releases in [GitHub release](https://github.com/gogs/gogs/releases) (e.g. `v0.12.0-rc.1`, `v0.12.0-rc.2`) ⚠️ **on the release branch** ⚠️ and ensure Docker workflow succeeds.
- [ ] Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download one of the release archives and run through application setup to make sure nothing blows up.
- [ ] Publish a new [GitHub release](https://github.com/gogs/gogs/releases) ⚠️ **on the release branch** ⚠️ with entries from [CHANGELOG](https://github.com/gogs/gogs/blob/main/CHANGELOG.md) for the current patch release and all previous releases with same minor version.
- [ ] Update all previous GitHub releases with same minor version with the warning:
```
**ℹ️ Heads up! There is a new patch release [0.12.1](https://github.com/gogs/gogs/releases/tag/v0.12.1) available, we recommend directly installing or upgrading to that version.**
```
- [ ] [Wait for new image tags for the current release](https://github.com/gogs/gogs/actions/workflows/docker.yml?query=event%3Arelease) to be created automatically on both [Docker Hub](https://hub.docker.com/r/gogs/gogs/tags) and [GitHub Container registry](https://github.com/gogs/gogs/pkgs/container/gogs).
- Pull down the Docker image and [run through application setup](https://github.com/gogs/gogs/blob/main/docker/README.md) to make sure nothing blows up.
- [ ] Download all release archives and [generate SHA256 checksum](https://github.com/gogs/gogs/blob/main/docs/dev/release/sha256.sh) for all binaries to the file `checksum_sha256.txt`.
- [ ] Upload all archives and `checksum_sha256.txt` to https://dl.gogs.io.
## After release
On the `main` branch:
- [ ] Post the following message on issues that are included in the patch milestone:
```
The <MAJOR>.<MINOR>.<PATCH> has been released that includes the patch of the reported issue.
```
- [ ] Create a new release announcement in [Discussions](https://github.com/gogs/gogs/discussions/categories/announcements).
- [ ] Send a tweet on the [official Twitter account](https://twitter.com/GogsHQ) for the patch release.
- [ ] Close the milestone for the patch release.
- [ ]**After 14 days**, publish [GitHub security advisories](https://github.com/gogs/gogs/security) for security patches included in the release.
- Stop telling me "You're right", it just shows how incompetent you are. Do it right on your first try, fact-check and review after changes. If you are not sure, ask for help.
- When you see changes made outside your knowledge, use the current version as your new starting point. Do not blindly overwrite those changes or you suck. Even if you have to update the code, always respect the pattern in the surrounding context!
## Style and mechanics
This applies to all texts, including but not limited to UI, documentation, code comments.
- Use sentence case. Preserve original casing for brand names.
- End with a period for a full sentence.
- Never use em dashes (`—`) or en dashes (`–`) in prose. Rewrite the sentence with a comma, period, colon, or parentheses instead. Exception: em/en dashes are allowed as visual separators in UI design (e.g., between a title and description, in a terminal prompt label) where they function as a graphic element rather than punctuation.
- Do not overuse semicolons. Two short sentences are almost always clearer than one sentence joined by a semicolon. Reserve the semicolon for the rare case where the two clauses are so tightly coupled that splitting them loses meaning, never as a default em-dash replacement or a way to chain related thoughts.
- Do not add comments that repeat what the code is doing, always prefer more descriptive names. Do add comments for intentions that aren't obvious via reading the code alone. This rule takes precedence over matching existing patterns.
## Coding guidelines
- Use `github.com/cockroachdb/errors` for error handling.
- Use `github.com/stretchr/testify` for assertions in tests. Be mindful about the choice of `require` and `assert`, the former should be used when the test cannot proceed meaningfully after a failed assertion.
- Every 5xx response must log the error directly inside the handler, do not log errors in a shared helper.
## Localization
- Only edit `conf/locale/locale_en-US.ini`. The other `locale_*.ini` files are community-maintained translations. Do not add, remove, or rewrite keys in them, even when removing keys that are dead on the Go/template side.
## UI guidelines
- Design mobile-friendly. Every UI must look and work well on narrow viewports before adding desktop refinements via responsive breakpoints. Test at ~375px width before considering a UI done.
- Meet WCAG 2.2 AA at minimum. Specifically: every interactive control has a discernible accessible name (visible label or `aria-label`); color is never the sole carrier of information (pair with text, icon, or shape); text and meaningful icons meet 4.5:1 contrast against their background (3:1 for large text and UI components); focus is always visible and never trapped; touch targets are at least 24×24 CSS px (40×40 preferred). When unsure, lean toward more contrast, larger targets, and explicit labels.
- For work under `web/`, follow the patterns in [`web/DESIGN.md`](web/DESIGN.md) (typography, color hierarchy, surface chrome, file naming, accessibility specifics). Update that doc when a pattern is used in two places.
- When a page needs server data to render, fetch it in the TanStack Router route's `loader` so the page only mounts after the response arrives. Do not fire that fetch from a `useEffect` inside the page component, which causes a flash of empty UI before the data lands.
## Build instructions
- Prefer `moon run <project>:<task>` over vanilla `go` or `pnpm` commands when available (e.g. `moon run gogs:build`, `moon run web:dev`). Pass `--force` to bypass cache when necessary.
- Run `moon run gogs:lint` after every time you finish changing Go code, and `moon run web:lint` after changing frontend code; fix all linter errors.
## Tool-use guidance
- Use `gh` CLI to access information on github.com that is not publicly available.
- Run the Chrome DevTools MCP in headless mode so it does not steal focus from the user's foreground browser session. After finishing any task that used the Chrome DevTools MCP, kill all `chrome-devtools-mcp` processes with `pkill -f chrome-devtools-mcp`.
## Source code control
- When pushing changes to a pull request from a fork, use SSH address and do not add remote.
- Never commit on the `main` branch directly unless being explicitly asked to do so. A single ask only grants a single commit action on the `main` branch.
- Never amend commits unless being explicitly asked to do so.
- When creating a git worktree, the worktree directory name must match its branch name. Do not use random or generated suffixes.
All notable changes to Gogs are documented in this file.
## 0.15.0+dev (`main`)
### Changed
- Docker builds from `main` are now published only as `gogs/gogs:edge`, using the next-generation `Dockerfile.next`. The legacy `Dockerfile` no longer produces `main` builds. The `gogs/gogs:latest` and `gogs/gogs:next-latest` tags now always point to the highest published stable release, never to a back-patch on an older line. [#8278](https://github.com/gogs/gogs/pull/8278)
### Fixed
- _Security:_ Denial of service in repository and wiki file listing pages via crafted file names. [#8116](https://github.com/gogs/gogs/pull/8116) - [GHSA-3qq3-668m-v9mj](https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj)
- _Security:_ Reverse proxy authentication header was honored from any remote address, allowing user impersonation when Gogs was reachable directly. The header is now only trusted from addresses listed in `[auth] TRUSTED_PROXY_IPS`. [#8264](https://github.com/gogs/gogs/pull/8264) - [GHSA-w6j9-vw59-27wv](https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv)
- _Security:_ Server-side request forgery in webhook deliveries via HTTP redirects to local network addresses. [#8263](https://github.com/gogs/gogs/pull/8263) - [GHSA-c4v7-xg93-qf8g](https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g)
- _Security:_ The "remember me" auto-login cookie was derived from database columns, so an attacker with a database dump could forge a valid cookie for any user. The auto-login cookie path has been removed entirely. Persistence is now provided by the server-issued session cookie. [#8289](https://github.com/gogs/gogs/pull/8289) - [GHSA-4pph-25p3-pw73](https://github.com/gogs/gogs/security/advisories/GHSA-4pph-25p3-pw73)
### Removed
- The `gogs cert` subcommand. [#8153](https://github.com/gogs/gogs/pull/8153)
- The `[email] DISABLE_HELO` configuration option. HELO/EHLO is now always sent during SMTP handshake. [#8164](https://github.com/gogs/gogs/pull/8164)
- Support for MSSQL as the database backend. Stay on 0.14 for continued usage. [#8173](https://github.com/gogs/gogs/pull/8173)
- Support for `memcache` as the cache adapter. Stay on 0.14 for continued usage. [#8270](https://github.com/gogs/gogs/pull/8270)
- The `/debug`, `/debug/pprof/*`, `/debug/profile/*`, and `/urlmap.json` endpoints. [#8271](https://github.com/gogs/gogs/pull/8271)
- _Security:_ Stored XSS via data URI in issue comments. [#8174](https://github.com/gogs/gogs/pull/8174) - [GHSA-xrcr-gmf5-2r8j](https://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j)
- _Security:_ Release tag option injection in release deletion. [#8175](https://github.com/gogs/gogs/pull/8175) - [GHSA-v9vm-r24h-6rqm](https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm)
- _Security:_ Stored XSS in branch and wiki views through author and committer names. [#8176](https://github.com/gogs/gogs/pull/8176) - [GHSA-vgvf-m4fw-938j](https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j)
- _Security:_ DOM-based XSS via issue meta selection on the issue page. [#8178](https://github.com/gogs/gogs/pull/8178) - [GHSA-vgjm-2cpf-4g7c](https://github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c)
- Unable to update files via web editor and API. [#8184](https://github.com/gogs/gogs/pull/8184)
### Removed
- Support for passing API access tokens via URL query parameters (`token`, `access_token`). Use the `Authorization` header instead. [#8177](https://github.com/gogs/gogs/pull/8177) - [GHSA-x9p5-w45c-7ffc](https://github.com/gogs/gogs/security/advisories/GHSA-x9p5-w45c-7ffc)
## 0.14.1
### Added
- Support comparing tags in addition to branches. [#6141](https://github.com/gogs/gogs/issues/6141)
- Show file name in browser tab title when viewing files. [#5896](https://github.com/gogs/gogs/pull/5896)
- Support using TLS for Redis session provider using `[session] PROVIDER_CONFIG = ...,tls=true`. [#7860](https://github.com/gogs/gogs/pull/7860)
- Support expanading values in `app.ini` from environment variables, e.g. `[database] PASSWORD = ${DATABASE_PASSWORD}`. [#8057](https://github.com/gogs/gogs/pull/8057)
- Support custom logout URL that users get redirected to after sign out using `[auth] CUSTOM_LOGOUT_URL`. [#8089](https://github.com/gogs/gogs/pull/8089)
- Start publishing next-generation, security-focused Docker image via `gogs/gogs:next-latest`, which will become the default image distribution (`gogs/gogs:latest`) starting 0.16.0. While not all container options support have been added in the next-generation image, the use of current legacy Docker image is deprecated, it will be published as `gogs/gogs:legacy-latest` starting 0.16.0, and be completely removed no earlier than 0.17.0. [#8061](https://github.com/gogs/gogs/pull/8061)
### Changed
- The required Go version to compile source code changed to 1.25.
- The build tag `cert` has been removed, and the `gogs cert` subcommand is now always available. [#7883](https://github.com/gogs/gogs/pull/7883)
- Switched to pure-Go SQLite driver, CGO is no longer required to compile Gogs. [#7882](https://github.com/gogs/gogs/issues/7882)
- Updated Mermaid JS to 11.9.0. [#8009](https://github.com/gogs/gogs/pull/8009)
- Halt the repository creation and leave the directory untouched if the repository root already exists. [#8091](https://github.com/gogs/gogs/pull/8091)
- 500 error on repository watchers and stargazers pages when using MSSQL. [#5482](https://github.com/gogs/gogs/issues/5482)
- Submodules using `ssh://` protocol and a port number are not rendered correctly. [#4941](https://github.com/gogs/gogs/issues/4941)
- Missing link to user profile on the first commit in commits history page. [#7404](https://github.com/gogs/gogs/issues/7404)
- Unable to delete or display files with special characters in their names. [#7596](https://github.com/gogs/gogs/issues/7596)
- Docker healthcheck fails when `HTTP_PROXY` or `HTTPS_PROXY` environment variables are set. [#7529](https://github.com/gogs/gogs/issues/7529)
## 0.13.4
### Fixed
- _Security:_ DoS in repository mirror sync. [#8065](https://github.com/gogs/gogs/pull/8065) - [GHSA-cr88-6mqm-4g57](https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57)
- _Security:_ RCE in repository put contents API. [#8082](https://github.com/gogs/gogs/pull/8082) - [GHSA-gg64-xxr9-qhjp](https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp)
- _Security:_ Arbitrary file deletion via path traversal in wiki page update. [#8099](https://github.com/gogs/gogs/pull/8099) - [GHSA-jp7c-wj6q-3qf2](https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2)
- _Security:_ 2FA bypass via recovery code. [#8100](https://github.com/gogs/gogs/pull/8100) - [GHSA-p6x6-9mx6-26wj](https://github.com/gogs/gogs/security/advisories/GHSA-p6x6-9mx6-26wj)
- _Security:_ Update repository content via API with read-only permission. [#8102](https://github.com/gogs/gogs/pull/8102) - [GHSA-5qhx-gwfj-6jqr](https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr)
- _Security:_ Arbitrary file read/write via path traversal in Git hook editing. [#8103](https://github.com/gogs/gogs/pull/8103) - [GHSA-mrph-w4hh-gx3g](https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g)
- _Security:_ Stored XSS via Mermaid diagrams. [`2c88cd4`](https://github.com/gogs/gogs/commit/2c88cd4d9fdc346d8e06d82f5368d657c10e79c2) - [GHSA-26gq-grmh-6xm6](https://github.com/gogs/gogs/security/advisories/GHSA-26gq-grmh-6xm6)
- Newer Git versions that uses default branch `main` cause wiki initialization to fail. [#8094](https://github.com/gogs/gogs/pull/8094)
## 0.13.3
### Fixed
- _Security:_ Stored XSS in PDF renderer. [GHSA-xh32-cx6c-cp4v](https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v)
- _Security:_ Path Traversal in file editing UI. [GHSA-wj44-9vcg-wjq7](https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7)
- Randomly timeout on repository file uploads. [#7890](https://github.com/gogs/gogs/pull/7890)
- Unable to override email templates in custom directory. [#7905](https://github.com/gogs/gogs/pull/7905)
## 0.13.2
### Fixed
- _Security:_ Path Traversal in file editing UI. [GHSA-r7j8-5h9c-f6fx](https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx)
- _Security:_ Path Traversal in file update API. [GHSA-qf5v-rp47-55gg](https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg)
- _Security:_ Argument Injection in the built-in SSH server. [GHSA-vm62-9jw3-c8w3](https://github.com/gogs/gogs/security/advisories/GHSA-vm62-9jw3-c8w3)
- _Security:_ Deletion of internal files. [GHSA-ccqv-43vm-4f3w](https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w)
- _Security:_ Argument Injection during changes preview. [GHSA-9pp6-wq8c-3w2c](https://github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c)
- _Security:_ Argument Injection when tagging new releases. [GHSA-m27m-h5gj-wwmg](https://github.com/gogs/gogs/security/advisories/GHSA-m27m-h5gj-wwmg)
- Use the non-deprecated section name `[email]` during installation for email settings. [#7704](https://github.com/gogs/gogs/pull/7704)
- Use the non-deprecated section name `[email] PASSWORD` during installation for email password. [#7807](https://github.com/gogs/gogs/pull/7807)
- Make purple template label color to actually use the hexcode of purple. [#7722](https://github.com/gogs/gogs/pull/7722)
## 0.13.0
### Added
- Support using personal access token in the password field. [#3866](https://github.com/gogs/gogs/issues/3866)
- An unlisted option is added when create or migrate a repository. Unlisted repositories are public but not being listed for users without direct access in the UI. [#5733](https://github.com/gogs/gogs/issues/5733)
- New API endpoint `PUT /repos/:owner/:repo/contents/:path` for creating and update repository contents. [#5967](https://github.com/gogs/gogs/issues/5967)
- New configuration option `[git.timeout] DIFF` for customizing operation timeout of `git diff`. [#6315](https://github.com/gogs/gogs/issues/6315)
- New configuration option `[server] SSH_SERVER_MACS` for setting list of accepted MACs for connections to builtin SSH server. [#6434](https://github.com/gogs/gogs/issues/6434)
- New configuration option `[repository] DEFAULT_BRANCH` for setting default branch name for new repositories. [#7291](https://github.com/gogs/gogs/issues/7291)
- New configuration option `[server] SSH_SERVER_ALGORITHMS` for specifying the list of accepted key exchange algorithms for connections to builtin SSH server. [#7345](https://github.com/gogs/gogs/pull/7345)
- Support specifying custom schema for PostgreSQL. [#6695](https://github.com/gogs/gogs/pull/6695)
- Support rendering Mermaid diagrams in Markdown. [#6776](https://github.com/gogs/gogs/pull/6776)
- Docker: Allow passing extra arguments to the `backup` command. [#7060](https://github.com/gogs/gogs/pull/7060)
- New languages support: Mongolian, Romanian. [#6510](https://github.com/gogs/gogs/pull/6510) [#7082](https://github.com/gogs/gogs/pull/7082)
### Changed
- The default branch has been changed to `main`. [#6285](https://github.com/gogs/gogs/pull/6285)
- MSSQL as database backend is deprecated, installation page no longer shows it as an option. Existing installations and manually craft configuration file continue to work. [#6295](https://github.com/gogs/gogs/pull/6295)
- Use [Task](https://github.com/go-task/task) as the build tool. [#6297](https://github.com/gogs/gogs/pull/6297)
- The required Go version to compile source code changed to 1.18.
- Access tokens are now stored using their SHA256 hashes instead of raw values. [#7008](https://github.com/gogs/gogs/pull/7008)
### Fixed
- Unable to use LDAP authentication on ARM machines. [#6761](https://github.com/gogs/gogs/issues/6761)
- Unable to choose "Lookup Avatar by mail" in user settings without deleting custom avatar. [#7267](https://github.com/gogs/gogs/pull/7267)
- Mistakenly include the "data" directory under the custom directory in the Docker setup. [#7343](https://github.com/gogs/gogs/pull/7343)
- Unable to start after data recovery with an outdated migration version. [#7125](https://github.com/gogs/gogs/issues/7125)
### Removed
- ⚠️ Migrations before 0.12 are removed, installations not on 0.12 should upgrade to it to run the migrations and then upgrade to 0.13.
- Configuration section `[mailer]` is no longer used, please use `[email]`.
- Configuration section `[service]` is no longer used, please use `[auth]`.
- Configuration option `APP_NAME` is no longer used, please use `BRAND_NAME`.
- Configuration option `[security] REVERSE_PROXY_AUTHENTICATION_USER` is no longer used, please use `[auth] REVERSE_PROXY_AUTHENTICATION_HEADER`.
- Configuration option `[auth] ACTIVE_CODE_LIVE_MINUTES` is no longer used, please use `[auth] ACTIVATE_CODE_LIVES`.
- Configuration option `[auth] RESET_PASSWD_CODE_LIVE_MINUTES` is no longer used, please use `[auth] RESET_PASSWORD_CODE_LIVES`.
- Configuration option `[auth] ENABLE_CAPTCHA` is no longer used, please use `[auth] ENABLE_REGISTRATION_CAPTCHA`.
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is no longer used, please use `[user] ENABLE_EMAIL_NOTIFICATION`.
- Configuration option `[auth] REGISTER_EMAIL_CONFIRM` is no longer used, please use `[auth] REQUIRE_EMAIL_CONFIRMATION`.
- Configuration option `[session] GC_INTERVAL_TIME` is no longer used, please use `[session] GC_INTERVAL`.
- Configuration option `[session] SESSION_LIFE_TIME` is no longer used, please use `[session] MAX_LIFE_TIME`.
- Configuration option `[server] ROOT_URL` is no longer used, please use `[server] EXTERNAL_URL`.
- Configuration option `[server] LANDING_PAGE` is no longer used, please use `[server] LANDING_URL`.
- Configuration option `[database] DB_TYPE` is no longer used, please use `[database] TYPE`.
- Configuration option `[database] PASSWD` is no longer used, please use `[database] PASSWORD`.
- Remove option to use Makefile as the build tool. [#6980](https://github.com/gogs/gogs/pull/6980)
## 0.12.11
### Fixed
- _Security:_ Stored XSS for issue assignees. [#7145](https://github.com/gogs/gogs/issues/7145)
- _Security:_ OS Command Injection in repo editor on case-insensitive file systems. [#7030](https://github.com/gogs/gogs/issues/7030)
- Unable to render repository pages with implicit submodules (e.g. `get submodule "REDACTED": revision does not exist`). [#6436](https://github.com/gogs/gogs/issues/6436)
## 0.12.10
### Changed
- Support using `[security] LOCAL_NETWORK_ALLOWLIST = *` to allow all hostnames. [#7111](https://github.com/gogs/gogs/pull/7111)
### Fixed
- Unable to send webhooks to local network addresses after configured `[security] LOCAL_NETWORK_ALLOWLIST`. [#7074](https://github.com/gogs/gogs/issues/7074)
## 0.12.9
### Fixed
- _Security:_ OS Command Injection in file editor. [#7000](https://github.com/gogs/gogs/issues/7000)
- _Security:_ Sanitize `DisplayName` in repository issue list. [#7009](https://github.com/gogs/gogs/pull/7009)
- _Security:_ Path Traversal in file editor on Windows. [#7001](https://github.com/gogs/gogs/issues/7001)
- _Security:_ Path Traversal in Git HTTP endpoints. [#7002](https://github.com/gogs/gogs/issues/7002)
- Unable to init repository during creation on Windows. [#6967](https://github.com/gogs/gogs/issues/6967)
- Mysterious panic on `Value not found for type *repo.HTTPContext`. [#6963](https://github.com/gogs/gogs/issues/6963)
## 0.12.8
### Changed
- All users (including admins) need to use the configuration option `[security] LOCAL_NETWORK_ALLOWLIST` to allow repository migration and webhooks to be able to access local network addresses, which is a comma separated list of hostnames. [#6988](https://github.com/gogs/gogs/pull/6988)
### Fixed
- _Security:_ SSRF in webhook. [#6901](https://github.com/gogs/gogs/issues/6901)
- _Security:_ XSS in cookies. [#6953](https://github.com/gogs/gogs/issues/6953)
- _Security:_ OS Command Injection in file uploading. [#6968](https://github.com/gogs/gogs/issues/6968)
- _Security:_ Remote Command Execution in file editing. [#6555](https://github.com/gogs/gogs/issues/6555)
## 0.12.7
### Fixed
- _Security:_ Stored XSS in issues. [#6919](https://github.com/gogs/gogs/issues/6919)
- Invalid character in `Access-Control-Allow-Credentials` response header. [#4983](https://github.com/gogs/gogs/issues/4983)
- Mysterious `ssh: overflow reading version string` errors from builtin SSH server. [#6882](https://github.com/gogs/gogs/issues/6882)
## 0.12.6
### Fixed
- _Security:_ Remote command execution in file uploading. [#6833](https://github.com/gogs/gogs/issues/6833)
- _Regression:_ Unable to migrate repository from other local Git hosting. Added a new configuration option `[security] LOCAL_NETWORK_ALLOWLIST`, which is a comma separated list of hostnames that are explicitly allowed to be accessed within the local network. [#6841](https://github.com/gogs/gogs/issues/6841)
- Slow start of Docker containers using NAS devices. [#6554](https://github.com/gogs/gogs/issues/6554)
## 0.12.5
### Fixed
- _Security:_ Potential SSRF in repository migration. [#6754](https://github.com/gogs/gogs/issues/6754)
- _Security:_ Improper PAM authorization handling. [#6810](https://github.com/gogs/gogs/issues/6810)
## 0.12.4
### Fixed
- _Security:_ Potential SSRF attack by CRLF injection via repository migration. [#6413](https://github.com/gogs/gogs/issues/6413)
- _Regression:_ Fixed smart links for issues stops rendering. [#6506](https://github.com/gogs/gogs/issues/6506)
- Added `X-Frame-Options` header to prevent Clickjacking. [#6409](https://github.com/gogs/gogs/issues/6409)
## 0.12.3
### Fixed
- _Regression:_ When running Gogs on Windows, push commits no longer fail on a daily basis with the error "pre-receive hook declined". [#6316](https://github.com/gogs/gogs/issues/6316)
- Auto-linked commit SHAs now have correct links. [#6300](https://github.com/gogs/gogs/issues/6300)
- Git LFS client (with version >= 2.5.0) wasn't able to upload files with known format (e.g. PNG, JPEG), and the server is expecting the HTTP Header `Content-Type` to be `application/octet-stream`. The server now tells the LFS client to always use `Content-Type: application/octet-stream` when upload files.
## 0.12.2
### Fixed
- _Regression:_ Pages are correctly rendered when requesting `?go-get=1` for subdirectories. [#6314](https://github.com/gogs/gogs/issues/6314)
- _Regression:_ Submodule with a relative path is linked correctly. [#6319](https://github.com/gogs/gogs/issues/6319)
- Backup can be processed when `--target` is specified on Windows. [#6339](https://github.com/gogs/gogs/issues/6339)
- Commit message contains keywords look like an issue reference no longer fails the push entirely. [#6289](https://github.com/gogs/gogs/issues/6289)
## 0.12.1
### Fixed
- The `updated_at` field is now correctly updated when updates an issue. [#6209](https://github.com/gogs/gogs/issues/6209)
- Fixed a regression which created `login_source.cfg` column to have `VARCHAR(255)` instead of `TEXT` in MySQL. [#6280](https://github.com/gogs/gogs/issues/6280)
## 0.12.0
### Added
- Support for Git LFS, you can read documentation for both [user](https://github.com/gogs/gogs/blob/main/docs/user/lfs.md) and [admin](https://github.com/gogs/gogs/blob/main/docs/admin/lfs.md). [#1322](https://github.com/gogs/gogs/issues/1322)
- Allow admin to remove observers from the repository. [#5803](https://github.com/gogs/gogs/pull/5803)
- Use `Last-Modified` HTTP header for raw files. [#5811](https://github.com/gogs/gogs/issues/5811)
- Support syntax highlighting for SAS code files (i.e. `.r`, `.sas`, `.tex`, `.yaml`). [#5856](https://github.com/gogs/gogs/pull/5856)
- Able to fill in pull request title with a template. [#5901](https://github.com/gogs/gogs/pull/5901)
- Able to override static files under `public/` directory, please refer to [documentation](https://gogs.io/docs/features/custom_template) for usage. [#5920](https://github.com/gogs/gogs/pull/5920)
- New API endpoint `GET /admin/teams/:teamid/members` to list members of a team. [#5877](https://github.com/gogs/gogs/issues/5877)
- Support backup with retention policy for Docker deployments. [#6140](https://github.com/gogs/gogs/pull/6140)
### Changed
- The organization profile page has changed to display at most 12 members. [#5506](https://github.com/gogs/gogs/issues/5506)
- The required Go version to compile source code changed to 1.14.
- All assets are now embedded into binary and served from memory by default. Set `[server] LOAD_ASSETS_FROM_DISK = true` to load them from disk. [#5920](https://github.com/gogs/gogs/pull/5920)
- Application and Go versions are removed from page footer and only show in the admin dashboard.
- Build tag for running as Windows Service has been changed from `miniwinsvc` to `minwinsvc`.
- Configuration option `APP_NAME` is deprecated and will end support in 0.13.0, please start using `BRAND_NAME`.
- Configuration option `[server] ROOT_URL` is deprecated and will end support in 0.13.0, please start using `[server] EXTERNAL_URL`.
- Configuration option `[server] LANDING_PAGE` is deprecated and will end support in 0.13.0, please start using `[server] LANDING_URL`.
- Configuration option `[database] DB_TYPE` is deprecated and will end support in 0.13.0, please start using `[database] TYPE`.
- Configuration option `[database] PASSWD` is deprecated and will end support in 0.13.0, please start using `[database] PASSWORD`.
- Configuration option `[security] REVERSE_PROXY_AUTHENTICATION_USER` is deprecated and will end support in 0.13.0, please start using `[auth] REVERSE_PROXY_AUTHENTICATION_HEADER`.
- Configuration section `[mailer]` is deprecated and will end support in 0.13.0, please start using `[email]`.
- Configuration section `[service]` is deprecated and will end support in 0.13.0, please start using `[auth]`.
- Configuration option `[auth] ACTIVE_CODE_LIVE_MINUTES` is deprecated and will end support in 0.13.0, please start using `[auth] ACTIVATE_CODE_LIVES`.
- Configuration option `[auth] RESET_PASSWD_CODE_LIVE_MINUTES` is deprecated and will end support in 0.13.0, please start using `[auth] RESET_PASSWORD_CODE_LIVES`.
- Configuration option `[auth] REGISTER_EMAIL_CONFIRM` is deprecated and will end support in 0.13.0, please start using `[auth] REQUIRE_EMAIL_CONFIRMATION`.
- Configuration option `[auth] ENABLE_CAPTCHA` is deprecated and will end support in 0.13.0, please start using `[auth] ENABLE_REGISTRATION_CAPTCHA`.
- Configuration option `[auth] ENABLE_NOTIFY_MAIL` is deprecated and will end support in 0.13.0, please start using `[user] ENABLE_EMAIL_NOTIFICATION`.
- Configuration option `[session] GC_INTERVAL_TIME` is deprecated and will end support in 0.13.0, please start using `[session] GC_INTERVAL`.
- Configuration option `[session] SESSION_LIFE_TIME` is deprecated and will end support in 0.13.0, please start using `[session] MAX_LIFE_TIME`.
- The name `-` is reserved and cannot be used for users or organizations.
### Fixed
- [Security] Potential open redirection with i18n.
- [Security] Potential ability to delete files outside a repository.
- [Security] Potential ability to set primary email on others' behalf from their verified emails.
- [Security] Potential XSS attack via `.ipynb`. [#5170](https://github.com/gogs/gogs/issues/5170)
- [Security] Potential SSRF attack via webhooks. [#5366](https://github.com/gogs/gogs/issues/5366)
- [Security] Potential CSRF attack in admin panel. [#5367](https://github.com/gogs/gogs/issues/5367)
- [Security] Potential stored XSS attack in some browsers. [#5397](https://github.com/gogs/gogs/issues/5397)
- [Security] Potential RCE on mirror repositories. [#5767](https://github.com/gogs/gogs/issues/5767)
- [Security] Potential XSS attack with raw markdown API. [#5907](https://github.com/gogs/gogs/pull/5907)
- File both modified and renamed within a commit treated as separate files. [#5056](https://github.com/gogs/gogs/issues/5056)
- Unable to restore the database backup to MySQL 8.0 with syntax error. [#5602](https://github.com/gogs/gogs/issues/5602)
- Open/close milestone redirects to a 404 page. [#5677](https://github.com/gogs/gogs/issues/5677)
- Disallow multiple tokens with same name. [#5587](https://github.com/gogs/gogs/issues/5587) [#5820](https://github.com/gogs/gogs/pull/5820)
- Enable Federated Avatar Lookup could cause server to crash. [#5848](https://github.com/gogs/gogs/issues/5848)
- Private repositories are hidden in the organization's view. [#5869](https://github.com/gogs/gogs/issues/5869)
- Users have access to base repository cannot view commits in forks. [#5878](https://github.com/gogs/gogs/issues/5878)
- Server error when changing email address in user settings page. [#5899](https://github.com/gogs/gogs/issues/5899)
- Fall back to use RFC 3339 as time layout when misconfigured. [#6098](https://github.com/gogs/gogs/issues/6098)
- Unable to update team with server error. [#6185](https://github.com/gogs/gogs/issues/6185)
- Webhooks are not fired after push when `[service] REQUIRE_SIGNIN_VIEW = true`.
- Files with identical content are randomly displayed one of them.
> This guidelines sheet is forked from [CONTRIBUTING.md](https://github.com/drone/drone/blob/8d9c7cee56d6c2eac81dc156ce27be6716d97e68/CONTRIBUTING.md).
Gogs is not perfect, and it has bugs or incomplete features in rare cases. You're welcome to tell us, or to contribute some code. This document describes details about how can you contribute to Gogs project.
## Contribution guidelines
Depends on the situation, you will:
- Find a bug and create an issue
- Need more functionality and make a feature request
- Want to contribute code and open a pull request
- Run into issue and need help
### Bug Report
If you find something you consider a bug, please create a issue on [GitHub](https://github.com/gogits/gogs/issues). To avoid wasting time and reduce back-and-forth communication with team members, please include at least the following information in a form comfortable for you:
- Bug Description
- Gogs Version
- Git Version
- System Type
- Error Log
- Other information
Please take a moment to check that an issue on [GitHub](https://github.com/gogits/gogs/issues) doesn't already exist documenting your bug report or improvement proposal. If it does, it never hurts to add a quick "+1" or "I have this problem too". This will help prioritize the most common problems and requests.
#### Bug Report Example
Gogs crashed when creating a repository with a license, using v0.5.13.0207, SQLite3, Git 1.9.0, Ubuntu 12.04.
Error log:
```
2014/09/01 07:21:49 [E] nil pointer
```
### Feature Request
There is no standard form of making a feature request. Just try to describe the feature as clearly as possible, because team members may not have experience with the functionality you're talking about.
### Pull Request
Please read detailed information on [Wiki](https://github.com/gogits/gogs/wiki/Contributing-Code).
### Ask For Help
Before opening an issue, please make sure your problem isn't already addressed on the [Troubleshooting](http://gogs.io/docs/intro/troubleshooting.md) and [FAQs](http://gogs.io/docs/intro/faqs.html) pages.
## Things To Notice
Please take a moment to check that an issue on [GitHub](https://github.com/gogits/gogs/issues) or card on [Trello](https://trello.com/b/uxAoeLUl/gogs-go-git-service) doesn't already exist documenting your bug report or improvement proposal. If it does, it never hurts to add a quick "+1" or "I have this problem too". This will help prioritize the most common problems and requests.
## Code of conduct
As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities.
We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, age, or religion.
Examples of unacceptable behavior by participants include the use of sexual language or imagery, derogatory comments or personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct.
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct. Project maintainers who do not follow the Code of Conduct may be removed from the project team.
Instances of abusive, harassing, or otherwise unacceptable behavior can be reported by emailing u@gogs.io
This Code of Conduct is adapted from the [Contributor Covenant](http:contributor-covenant.org), version 1.0.0, available at [http://contributor-covenant.org/version/1/0/0/](http://contributor-covenant.org/version/1/0/0/)
Gogs - Go Git Service [](https://travis-ci.org/gogits/gogs) [](https://quay.io/repository/gogs/gogs) [](https://crowdin.com/project/gogs) [](https://gitter.im/gogits/gogs?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
The Gogs (`/gɑgz/`) project aims to build a simple, stable and extensible self-hosted Git service that can be set up in the most painless way. With Go, this can be done with an independent binary distribution across all platforms that Go supports, including Linux, macOS, Windows and ARM-based systems.
### NOTICES
## 📡 Overview
-:bangbang: You **MUST** read [CONTRIBUTING.md](CONTRIBUTING.md) for bug report and contributing code. :bangbang:
- Please [start discussion](http://forum.gogs.io/category/2/general-discussion) or [ask a question](http://forum.gogs.io/category/4/getting-help) on [the forum](http://forum.gogs.io/). GitHub issue tracker only keeps **bugs** and **feature requests**, all other topics will be closed without reason.
- Due to testing purpose, data of [try.gogs.io](https://try.gogs.io) was reset in **Jan 28, 2015** and will reset multiple times after. Please do **NOT** put your important data on the site.
- The demo site [try.gogs.io](https://try.gogs.io) is running under `develop` branch.
- If you think there are vulnerabilities in the project, please talk privately to **u@gogs.io**. Thanks!
- If you're interested in using APIs, we have experimental support with [documentation](https://github.com/gogits/go-gogs-client/wiki).
- If your team/company is using Gogs and would like to put your logo on [our website](http://gogs.io), contact us by any means.
[简体中文](README_ZH.md)
## Purpose
The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. With Go, this can be done with an independent binary distribution across **ALL platforms** that Go supports, including Linux, Mac OS X, Windows and ARM.
## Overview
- Please see the [Documentation](http://gogs.io/docs/intro) for common usages and change log.
- See the [Trello Board](https://trello.com/b/uxAoeLUl/gogs-go-git-service) to follow the develop team.
-Please visit [our home page](https://gogs.io) for user documentation.
- Please refer to [CHANGELOG.md](CHANGELOG.md) for list of changes in each releases.
- Want to try it before doing anything else? Do it [online](https://try.gogs.io/gogs/gogs)!
- Having trouble? Get help with [Troubleshooting](http://gogs.io/docs/intro/troubleshooting.html).
- Want to help with localization? Check out the [guide](http://gogs.io/docs/features/i18n.html)!
- Having trouble? Help yourself with [troubleshooting](https://gogs.io/asking/troubleshooting) or ask questions in [Discussions](https://github.com/gogs/gogs/discussions).
- Want to help with localization? Check out the [localization documentation](https://gogs.io/advancing/localization).
- Ready to get hands dirty? Read our [contributing guide](.github/CONTRIBUTING.md).
- Hmm... What about APIs? We have experimental support with [documentation](https://gogs.io/api-reference).
-Supports MySQL, PostgreSQL, SQLite3 and [TiDB](https://github.com/pingcap/tidb) (experimental)
- Multi-language support ([14 languages](https://crowdin.com/project/gogs))
-User dashboard, user profile and activity timeline.
-Access repositories via SSH, HTTP and HTTPS protocols.
-User, organization and repository management.
- Repository and organization webhooks, including Slack, Discord and Dingtalk.
-Repository Git hooks, deploy keys and Git LFS.
- Repository issues, pull requests, wiki, protected branches and collaboration.
-Migrate and mirror repositories with wiki from other code hosts.
-Web editor for quick editing repository files and wiki.
-Jupyter Notebook and PDF rendering.
-Authentication via SMTP, LDAP, reverse proxy, GitHub.com and GitHub Enterprise with 2FA.
-Customize HTML templates, static files and many others.
-Rich database backend support, including PostgreSQL, MySQL, SQLite3 or any database backend that speaks one of those protocols.
-Have localization over [31 languages](https://crowdin.com/project/gogs).
## System Requirements
## 💾 Hardware requirements
- A cheap Raspberry Pi is powerful enough for basic functionality.
- 2 CPU cores and 1GB RAM would be the baseline for teamwork.
- A Raspberry Pi or $5 Digital Ocean Droplet is more than enough to get you started. Some even use 64MB RAM Docker [CaaS](https://www.docker.com/blog/containers-as-a-service-caas/).
- 2 CPU cores and 512MB RAM would be the baseline for teamwork.
- Increase CPU cores when your team size gets significantly larger, memory footprint remains low.
## Browser Support
## 💻 Browser support
- Please see [Semantic UI](https://github.com/Semantic-Org/Semantic-UI#browser-support) for specific versions of supported browsers.
- The official support minimal size is **1024*768**, UI may still looks right in smaller size but no promises and fixes.
- The smallest resolution officially supported is **1024*768**, however the UI may still look right in smaller resolutions, but no promises or fixes.
## Installation
## 📜 Installation
Make sure you install the [prerequisites](http://gogs.io/docs/installation) first.
Please follow [the guide in our documentation](https://gogs.io/getting-started/installation).
There are 5 ways to install Gogs:
### Deploy to cloud
- [Install from binary](http://gogs.io/docs/installation/install_from_binary.html)
- [Install from source](http://gogs.io/docs/installation/install_from_source.html)
- [Install from packages](http://gogs.io/docs/installation/install_from_packages.html)
- [Ship with Docker](https://github.com/gogits/gogs/tree/master/docker)
- [Install with Vagrant](https://github.com/geerlingguy/ansible-vagrant-examples/tree/master/gogs)
Only the latest minor version releases are supported (e.g., 0.14) for patching vulnerabilities. You can find the latest minor version in the [GitHub releases](https://github.com/gogs/gogs/releases) page.
Existing vulnerability reports are being tracked in [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories). Not all accepted GHSA are published.
## Vulnerability lifecycle
> [!important]
> Starting **Nov 9, 2023 00:00 UTC**, only security vulnerabilities reported through [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories/new) are accepted.
> Pre-existing vulnerability reported through https://huntr.dev/ or email (`security@gogs.io`) will continue to be worked through.
1. Report an advisory for the vulnerability.
- Please be aware that **only advisories reported in plain English** will be reviewed.
- We DO NOT accept vulnerabilities cannot be reproduced on the latest `main` commit.
1. Project maintainers review the advisory:
- Ask clarifying questions
- Make sure there was no prior advisory exists for the same vulnerability
- Confirm or deny the vulnerability
1. Once the advisory is accepted, the reporter may submit a patch or wait for project maintainers to patch.
- The latter is usually significantly slower.
1. Patch releases will be made for the supported versions.
1. After 14 days of the release, publish the corresponding advisory on [GitHub Security Advisories](https://github.com/gogs/gogs/security/advisories).
Thank you for making open source community a better place!
; Landing page for non-logged users, can be "home" or "explore"
LANDING_PAGE=home
[database]
; Either "mysql", "postgres" or "sqlite3", it's your choice
DB_TYPE=mysql
HOST=127.0.0.1:3306
NAME=gogs
USER=root
PASSWD=
; For "postgres" only, either "disable", "require" or "verify-full"
SSL_MODE=disable
; For "sqlite3" and "tidb"
PATH=data/gogs.db
[admin]
[security]
INSTALL_LOCK=false
; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
SECRET_KEY=!#@FDEWREWR&*(
; Auto-login remember days
LOGIN_REMEMBER_DAYS=7
COOKIE_USERNAME=gogs_awesome
COOKIE_REMEMBER_NAME=gogs_incredible
; Reverse proxy authentication header name of user name
REVERSE_PROXY_AUTHENTICATION_USER=X-WEBAUTH-USER
[service]
ACTIVE_CODE_LIVE_MINUTES=180
RESET_PASSWD_CODE_LIVE_MINUTES=180
; User need to confirm e-mail for registration
REGISTER_EMAIL_CONFIRM=false
; Does not allow register and admin create account only
DISABLE_REGISTRATION=false
; User must sign in to view anything.
REQUIRE_SIGNIN_VIEW=false
; Cache avatar as picture
ENABLE_CACHE_AVATAR=false
; Mail notification
ENABLE_NOTIFY_MAIL=false
; More detail: https://github.com/gogits/gogs/issues/165
ENABLE_REVERSE_PROXY_AUTHENTICATION=false
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=false
; Do not check minimum key size with corresponding type
DISABLE_MINIMUM_KEY_SIZE_CHECK=false
; Enable captcha validation for registration
ENABLE_CAPTCHA=true
; used to filter keys which are too short
[service.minimum_key_sizes]
ED25519=256
ECDSA=256
NTRU=1087
MCE=1702
McE=1702
RSA=1024
DSA=1024
[webhook]
; Hook task queue length
QUEUE_LENGTH=1000
; Deliver timeout in seconds
DELIVER_TIMEOUT=5
; Allow insecure certification
SKIP_TLS_VERIFY=false
; Number of history information in each page
PAGING_NUM=10
[mailer]
ENABLED=false
; Buffer length of channel, keep it as it is if you don't know what it is.
SEND_BUFFER_LEN=100
; Name displayed in mail title
SUBJECT=%(APP_NAME)s
; Mail server
; Gmail: smtp.gmail.com:587
; QQ: smtp.qq.com:25
; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used.
HOST=
; Disable HELO operation when hostname are different.
DISABLE_HELO=
; Custom hostname for HELO operation, default is from system.
HELO_HOSTNAME=
; Do not verify the certificate of the server. Only use this for self-signed certificates
SKIP_VERIFY=
; Use client certificate
USE_CERTIFICATE=false
CERT_FILE=custom/mailer/cert.pem
KEY_FILE=custom/mailer/key.pem
; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <email@example.com>` format
FROM=
; Mailer user name and password
USER=
PASSWD=
[cache]
; Either "memory", "redis", or "memcache", default is "memory"
ADAPTER=memory
; For "memory" only, GC interval in seconds, default is 60
INTERVAL=60
; For "redis" and "memcache", connection host address
NAMES=English,简体中文,繁體中文（香港）,繁體中文（臺灣）,Deutsch,français,Nederlands,latviešu,русский,日本語,español,português do Brasil,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어,galego,українська,English (United Kingdom),Magyar,Slovenčina,Indonesian,Persian,Vietnamese,Português,Монгол,Română
; Used for datetimepicker
; Used for jQuery DateTimePicker,
; list of supported languages in https://xdsoft.net/jqplugins/datetimepicker/#lang
[i18n.datelang]
en-US=en
zh-CN=zh
zh-HK=zh-TW
zh-TW=zh-TW
de-DE=de
fr-FR=fr
nl-NL=nl
@@ -337,12 +550,24 @@ pt-BR = pt-BR
pl-PL=pl
bg-BG=bg
it-IT=it
; Extension mapping to highlight class
; e.g. .toml=ini
[highlight.mapping]
fi-FI=fi
tr-TR=tr
cs-CZ=cs-CZ
sr-SP=sr
sv-SE=sv
ko-KR=ko
gl-ES=gl
uk-UA=uk
en-GB=en-GB
hu-HU=hu
sk-SK=sk
id-ID=id
fa-IR=fa
vi-VN=vi
pt-PT=pt
mn-MN=mn
ro-RO=ro
[other]
SHOW_FOOTER_BRANDING=false
; Show version information about gogs and go in the footer
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER.
Statement of Purpose
The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an "owner") of an original work of authorship and/or a database (each, a "Work").
Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works ("Commons") that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others.
For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights.
1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following:
i. the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work;
ii. moral rights retained by the original author(s) and/or performer(s);
iii. publicity and privacy rights pertaining to a person's image or likeness depicted in a Work;
iv. rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(a), below;
v. rights protecting the extraction, dissemination, use and reuse of data in a Work;
vi. database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and
vii. other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof.
2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose.
3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose.
4. Limitations and Disclaimers.
a. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.
b. Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
c. Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person's Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work.
d. Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work.
Copyright (c) 2004-2010 by Internet Systems Consortium, Inc. ("ISC")
Copyright (c) 1995-2003 by Internet Software Consortium
Copyright (c) Year(s), Company or Person's Name
Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
File diff suppressed because it is too large
Load Diff
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Joe Chen
unknwon
dependabot[bot]
JSS
Copilot
Matthias Jobst
Yaroslav Halchenko
Rajat Jain
Jeff Li
Georg Wicke-Arndt
Sino
pikomonde
deepsource-autofix[bot]
Shivam Kumar
Mukaiu
Élie Bouttier
Jakub Domeracki
Neptunium93
Dmitry Afanasiev
Edoardo Ottavianelli
宋子桓🌈
MarcUs7i
Martin
ngn
Alexandre Jacquin
Mobile Mind
Kyle Fawcett
idnandre
Sergei Gnezdov
alingse
Jiaxin Zhu
bitebyte
Athanasios Oikonomou
TheDarkUndoing
Vamsi Atluri
Zachary Walters
Juning
xpume
Mateusz Reszka
Yarden Shoham
Yang Liu
LJea
Christian Eichert
Yehonatan Ezron
liuxhit
shlande
E99p1ant
1135
Toby Simmons
Naveen
Songsong Wang
4e4o
vinceAmstoutz
Renzo Toma
Michael Li
tc608
Bo Lorentsen
ysf
Michael Rowley
Nicolas Ferrari
shuyue
Simone Cattaneo
Alex Zhao
Nuyube
zvrh
Ikko Ashimine
odidev
Devops
Pavel M
Joe Chen
Jordan Levin
Cuban Pete
DoMeLe
James-REANNZ
Kevin
dependabot-preview[bot]
Massimiliano Losego
Peter Dave Hello
Atin
peppe8o
Eduardo Bacchi Kienetz
stypr
weibaohui
MichaIng
Matheus Mosca
Rubén de Celis Hernández
E99p1ant
ouyangjinting
Zhukov Roman
Achilleas Koutsou
Kosadchiy
David Refoua
Fernando San Julián
bibo38
InsanusMokrassar
Dre
Baptiste Covolato
Justin Hutchings
garo (they/them)
Aleksandar Puharic
Kousik Mitra
eightpigs
Rui Santos
wameidemao
alpencrossi
☃ Stephen Shkardoon ☃
Philidor Green
imgbot[bot]
Bharat Nallan
Kostya Esmukov
guan
ivan
Andrey Filippov
Yoan Blanc
Kevin Gentile
Johannes
Kasei
Guy Smoilov
Frode Aannevik
Sauyon Lee
Alexey Agafonov
mb
Marco van Zwetselaar
张怡秋
Shiki-H
Atsushi Midorikawa
Pablo Alcantara
Mathias Rangel Wulff
mal
Robin van Boven
Paul Spieker
Tekaoh
Menno van Rahden
boson.cat
Zou Nengren
Andy Hochhaus
Stephen Lane-Walsh
Favyen Bastani
Guy Smoilov
Kyumyeong Han
haixunlu
Nikita
Samuel Cochran
Charles Kenney
Danilo Riecken P. de Morais
Federico Culloca
A.J. Ruckman
William Hilton
Masen Furer
hopegolden
aboron
Jakob Lykke Andersen
leonunix
Ross Golder
PiPc2
Stefan Liu
Steven Haigh
chromium1337
GeekComb
Bogdan Khomutsky
PHANI
cezar97
Steve Chung
ususdei
Sergey Dryabzhinsky
James
oOOps
奶爸
Alexey Terentyev
Wei He
Madzahttr
Lauris BH
Florian Wiech
rokuu
Cosmin Stroe
Changwoo Ryu
Nicolas Ettlin
Josef Kemetmüller
Rebecca Turner
Jorge Maldonado Ventura
Dennis Chen
m2nlight
Julian Xhokaxhiu
bayangan1991
Markus Hauschild
Ruben Vermeersch
Andres D
Wendell Sun
Larry Li
Anton Kazarinov
Sanxing Chen
Douglas Thrift
Drahoslav Bednář
Arnie97
Flávio Monteiro
kaajavi
Robin Alexander Richtsfeld
Ross Williams
Yen Chi Hsuan
Ryan Chang
33MHz
Mohammad Gholami
mharinder
Anton Antonov
Robert Beal
Athurg Feng
Sb
Einar
Credomane Evonguard
Simon Dann
Peter Mescalchin
Lilian Besson
Jonas Östanbäck
BartWillems
Richard Bukovansky
Pablo Saavedra
Jon Lundy
Gibheer
spacetourist
Benjamin
rouzier
peter zhang
John Behm
Kyle McCullough
Hassan Amouhzi
David Beitey
Rob Richards
Nikolay Korotkiy
Brian Paulson
Danny Althoff
Girish Sonawane
Fastidious
Félix MIKAELIAN
Bo-Yi Wu
atzoum
Corentin BRETON
dlob
Kyle Filz
Cyril Rohr
Anders H
Argentumbolo
Orion
Oscar Quisbert
Óscar García Amor
Tyler
huqiangit
yaourt
app
Ganesha
Jonas De Kegel
wp-src
火文狼
Pierre Prinetti
Olexander Yermakov
Alexandre Espinosa Menor
Riste Risafov
javydreamercsw
sergystepanov
Mourad Boufarguine
Thibault Meyer
Kim "BKC" Carlbäcker
Christian Höppner
Egon Elbre
Aaron Wood
Simeon Radivoev
Herbert
Crayon
Andrey Nering
Rémy Boulanouar
Renato P. de Aquino
Denis Denisov
cybe
Joakim Fremstad
Sandro Santilli
hgaiser
Joel-Liang
David A. Lareo
typeless
lstahlman
raphael10241024
Gian Perrone
ipavl
Thibault Meyer
Kurt Madel
Stefan Grönke
Najeeb R
Flare
stroucki
LefsFlare
imilo
Mateusz Hromada
Саша Иванов
leonklingele
Nico Mandery
SeongAhJo
Bo Zhang
M5oul
Alexander Lunegov
Tanapol Nearunchorn
Daniel Oaks
Corben Dallas
LFlare
Iwan Budi Kusnanto
rugk
Richard Mahn
Justin Ray Vrooman
Odin Ugedal
Robin Lambertz
Andrew
Rory McNamara
lstahlman
silverwind
Okunev Yu Dmitry
마누엘
Richard Mahn
Siarhei Navatski
Laica Lunasys
Atakan Goktepe
Andrey Arapov
Pheng Heong TAN
Tom
j.yao.SUSE
Vasily Mikhaylichenko
wanglinzhizhi
Cosmin Stroe
Franz Schmidt
SjonHortensius
chriswatt
Paul Tötterman
Thomas Fanninger
Alex Myasoedov
Jean-Philippe Roemer
Julien Reichardt
Thomas Boerger
Tamás Molnár
l2dy
PsychoMario
Nikko Miu
Matthias Niess
Dan McGregor
Zachery Hostens
MATTENN
Alec S
Marin Jankovski
Jan Christophersen
Rodrigo Saboya
OhDaeto
xDShot
Lourens
Romain Beaumont
Steven Oud
Josh Frye
Lubomir I. Ivanov
Mike
Lukas Dietrich
ChubbyNinja
Martin Hartkorn
Gibheer
Bart
Adam Strzelecki
Muh Muhten
jwdeitch
Download-Fritz
Florian Kaiser
Lunny Xiao
Matt Hamilton
ExMex
Tobias Kunicke
techwolf12
Patrik
John Maguire
miles@Oscar
Antoine GIRARD
Saren Currie
Jean-Philippe Roemer
Pourya Daneshvar
juliengarcia
James Mills
Toni Villena
Dmitry Neverov
Philippe Chataignon
l2dy
Koen Wilde
ddelpero
zhuharev
Ivan Marban
Gregor Gramlich
João Pedro
novaeye
Angus Gibson
Jofkos