There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
This is an extensive PR attempting to fix these issues.
1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future.
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
When marking notifications read the results may be returned out of order
or be delayed. This PR sends a sequence number to gitea so that the
browser can ensure that only the results of the latest notification
change are shown.
Signed-off-by: Andrew Thornton <[email protected]>
Co-authored-by: 6543 <[email protected]>
* Enforce tab indendation in templates
This adds editorconfig-checker [1] to lint the template files so they
conform the editorconfig files. I fixed all current identation issues
using the fix mode of eclint [2] and some manual corrections.
We can extend this linting to other files later, for now I'd like this
PR to focus on HTML template files only.
[1] https://github.com/editorconfig-checker/editorconfig-checker
[2] https://github.com/jedmao/eclint
* fix indendation
Co-authored-by: zeripath <[email protected]>
Co-authored-by: techknowlogick <[email protected]>
* make repo as "pending transfer" if on transfer start doer has no right to create repo in new destination
* if new pending transfer ocured, create UI & Mail notifications
* Add class to page content to unify top margin
Previously pages would individually set this margin but some didn't so
content would stick to the header without any space. Resolve this by
adding a new class that is added on all pages. The only place where we
remove this margin again is on the pages with menu or wrapper in the
header.
* fix admin notices
* fix team pages
* fix loading segment on gitgraph for arc-green
* fix last missing case
Co-authored-by: techknowlogick <[email protected]>
* Use AJAX for notifications table
Signed-off-by: Andrew Thornton <[email protected]>
* move to separate js
Signed-off-by: Andrew Thornton <[email protected]>
* placate golangci-lint
Signed-off-by: Andrew Thornton <[email protected]>
* Add autoupdating notification count
Signed-off-by: Andrew Thornton <[email protected]>
* Fix wipeall
Signed-off-by: Andrew Thornton <[email protected]>
* placate tests
Signed-off-by: Andrew Thornton <[email protected]>
* Try hidden
Signed-off-by: Andrew Thornton <[email protected]>
* Try hide and hidden
Signed-off-by: Andrew Thornton <[email protected]>
* More auto-update improvements
Only run checker on pages that have a count
Change starting checker to 10s with a back-off to 60s if there is no change
Signed-off-by: Andrew Thornton <[email protected]>
* string comparison!
Signed-off-by: Andrew Thornton <[email protected]>
* as per @silverwind
Signed-off-by: Andrew Thornton <[email protected]>
* add configurability as per @6543
Signed-off-by: Andrew Thornton <[email protected]>
* Add documentation as per @6543
Signed-off-by: Andrew Thornton <[email protected]>
* Use CSRF header not query
Signed-off-by: Andrew Thornton <[email protected]>
* Further JS improvements
Fix @etzelia update notification table request
Fix @silverwind comments
Co-Authored-By: silverwind <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
* Simplify the notification count fns
Signed-off-by: Andrew Thornton <[email protected]>
Co-authored-by: silverwind <[email protected]>
* Use relative URLs
* Notifications - Mark as read/unread
* Feature of pinning a notification
* On view issue, do not mark as read a pinned notification
