There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
This is an extensive PR attempting to fix these issues.
1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future.
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
This PR changes the compare page to make the "..." in the between branches a clickable
link. This changes the comparison type from "..." to "..". Similarly it makes the
initial compare icon clickable to switch the head and base branches.
Signed-off-by: Andrew Thornton <[email protected]>
Co-authored-by: Lauris BH <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
The CompareAndPullRequestPost handler for POST to /compare
incorrectly handles returning errors to the user. For a start
it does not set the necessary markers to switch SimpleMDE
but it also does not immediately return to the form.
This PR fixes this by setting the appropriate values, fixing
the templates and preventing the suggestion of a too long
title.
Fix#16507
Signed-off-by: Andrew Thornton <[email protected]>
* Add selecting tags on the compare page
* Remove unused condition and change indentation
* Fix tag tab in dropdown to be black
* Add compare tag integration test
Co-authored-by: Jonathan Tran <[email protected]>
* Enforce tab indendation in templates
This adds editorconfig-checker [1] to lint the template files so they
conform the editorconfig files. I fixed all current identation issues
using the fix mode of eclint [2] and some manual corrections.
We can extend this linting to other files later, for now I'd like this
PR to focus on HTML template files only.
[1] https://github.com/editorconfig-checker/editorconfig-checker
[2] https://github.com/jedmao/eclint
* fix indendation
Co-authored-by: zeripath <[email protected]>
Co-authored-by: techknowlogick <[email protected]>
Prevent 404 on new pull request button on forked fork owned by the owner
of the root repository. Also ensure that the names make sense.
Signed-off-by: Andrew Thornton <[email protected]>
* Make auto check manual merge as a chooseable mod and add manual merge way on ui
as title, Before this pr, we use same way with GH to check manually merge.
It good, but in some special cases, misjudgments can occur. and it's hard
to fix this bug. So I add option to allow repo manager block "auto check manual merge"
function, Then it will have same style like gitlab(allow empty pr). and to compensate for
not being able to detect THE PR merge automatically, I added a manual approach.
Signed-off-by: a1012112796 <[email protected]>
* make swager
* api support
* ping ci
* fix TestPullCreate_EmptyChangesWithCommits
* Apply suggestions from code review
Co-authored-by: zeripath <[email protected]>
* Apply review suggestions and add test
* Apply suggestions from code review
Co-authored-by: zeripath <[email protected]>
* fix build
* test error message
* make fmt
* Fix indentation issues identified by @silverwind
Co-authored-by: silverwind <[email protected]>
* Fix tests and make manually merged disabled error on API the same
Signed-off-by: Andrew Thornton <[email protected]>
* a small nit
* fix wrong commit id error
* fix bug
* simple test
* fix test
Co-authored-by: zeripath <[email protected]>
Co-authored-by: silverwind <[email protected]>
Co-authored-by: techknowlogick <[email protected]>
* Add class to page content to unify top margin
Previously pages would individually set this margin but some didn't so
content would stick to the header without any space. Resolve this by
adding a new class that is added on all pages. The only place where we
remove this margin again is on the pages with menu or wrapper in the
header.
* fix admin notices
* fix team pages
* fix loading segment on gitgraph for arc-green
* fix last missing case
Co-authored-by: techknowlogick <[email protected]>
* Allow compare page to look up base, head, own-fork, forkbase-of-head
Signed-off-by: Andrew Thornton <[email protected]>
* as per @guillep2k
Signed-off-by: Andrew Thornton <[email protected]>
* Update routers/repo/compare.go
* as per @guillep2k
Signed-off-by: Andrew Thornton <[email protected]>
* Rationalise the names a little
Signed-off-by: Andrew Thornton <[email protected]>
* Rationalise the names a little (2)
Signed-off-by: Andrew Thornton <[email protected]>
* Fix 500 with fork of fork
Signed-off-by: Andrew Thornton <[email protected]>
* Prevent 500 on compare different trees
Signed-off-by: Andrew Thornton <[email protected]>
* dotdotdot is perfectly valid in both usernames and repo names
Signed-off-by: Andrew Thornton <[email protected]>
* ensure we can set the head and base repos too
Signed-off-by: Andrew Thornton <[email protected]>
* ensure we can set the head and base repos too (2)
Signed-off-by: Andrew Thornton <[email protected]>
* fix lint
Signed-off-by: Andrew Thornton <[email protected]>
* only set headRepo == baseRepo if isSameRepo
Signed-off-by: Andrew Thornton <[email protected]>
* routers: make /compare route available to unauthenticated users
Remove some bits of the compare interface if the user isn't signed in.
Notably, they don't need to see the "New Pull Request" button box nor the
hidden form that would fail to submit due to the POST request continuing to
require proper privileges.
Follow-up commits will improve the UI a bit around this, removing some
"Pull Request" verbiage in favor of "Compare."
* ui: home: show "compare" button for unauthenticated users
This change requires pulling in the BaseRepo unconditionally and
recording if the pull request is in-fact not allowed
(.PullRequestCtx.Allowed). If the user isn't allowed to create a pull
request, either because this isn't a fork or same-fork branch PRs aren't
allowed, then we'll name the button "Compare" instead of "Pull Request."
* ui: branch list: use the new Compare language when available
When viewing the branch listing as an unauthenticated user, you'll get
"Pull Request" buttons. use the new "Compare" verbiage instead, which
matches GitHub behavior when you can't issue a pull request from the
branches.
Co-authored-by: zeripath <[email protected]>
Co-authored-by: guillep2k <[email protected]>
* 'update'
* Send push tag event when release created
* send tag create event while release created in UI
* update to go v1.13
* fix gofmt error
* fix#8576 create pull request on current repository by default
* archived repo - remove
- open/close button on issue list
- assigne person on issue list
Signed-off-by: Michael Gnehr <[email protected]>
* archived repo - remove
- comment field on issue view
- lock/unlock issue conversation button from sidebar on issue view
Signed-off-by: Michael Gnehr <[email protected]>
* archived repo - add 'compare commits' button to pull request
+ remove new pull request button from compare view
as the route is still working, and there is no need to be hidden
Signed-off-by: Michael Gnehr <[email protected]>
* Supports tags when comparing commits or branches
Signed-off-by: Mario Lubenka <[email protected]>
* Hide headline when only comparing and don't load unused data
Signed-off-by: Mario Lubenka <[email protected]>
* Merges compare logics to allow comparing branches, commits and tags with eachother
Signed-off-by: Mario Lubenka <[email protected]>
* Display branch or tag instead of commit when used for comparing
Signed-off-by: Mario Lubenka <[email protected]>
* Show pull request form after click on button
Signed-off-by: Mario Lubenka <[email protected]>
* Transfers relevant pull.go changes from master to compare.go
Signed-off-by: Mario Lubenka <[email protected]>
* Fixes error when comparing forks against a commit or tag
Signed-off-by: Mario Lubenka <[email protected]>
* Removes console.log from JavaScript file
Signed-off-by: Mario Lubenka <[email protected]>
* Show icon next to commit reference when comparing branch or tag
Signed-off-by: Mario Lubenka <[email protected]>
* Updates css file
Signed-off-by: Mario Lubenka <[email protected]>
* Fixes import order
* Renames template variable
* Update routers/repo/compare.go
Co-Authored-By: zeripath <[email protected]>
* Update from master
Signed-off-by: Mario Lubenka <[email protected]>
* Allow short-shas in compare
* Renames prInfo to compareInfo
Signed-off-by: Mario Lubenka <[email protected]>
* Check PR permissions only if compare is pull request
Signed-off-by: Mario Lubenka <[email protected]>
* Adjusts comment
Signed-off-by: Mario Lubenka <[email protected]>
* Use compareInfo instead of prInfo
