diff --git a/modules/setting/security.go b/modules/setting/security.go index f3480d1056..1f38857af6 100644 --- a/modules/setting/security.go +++ b/modules/setting/security.go @@ -168,6 +168,6 @@ func loadSecurityFrom(rootCfg ConfigProvider) { // warn if the setting is set to false explicitly if sectionHasDisableQueryAuthToken && !DisableQueryAuthToken { - log.Warn("Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will default to true in gitea 1.23 and will be removed in gitea 1.24.") + log.Warn("Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will be removed in Forgejo v13.0.0.") } } diff --git a/modules/templates/context.go b/modules/templates/context.go new file mode 100644 index 0000000000..d2b896391b --- /dev/null +++ b/modules/templates/context.go @@ -0,0 +1,23 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. +// SPDX-License-Identifier: GPL-3.0-or-later + +package templates + +import ( + "context" + + "forgejo.org/modules/translation" +) + +type Context struct { + context.Context + Locale translation.Locale + AvatarUtils *AvatarUtils + Data map[string]any +} + +var _ context.Context = Context{} + +func NewContext(ctx context.Context) *Context { + return &Context{Context: ctx} +} diff --git a/modules/templates/context_test.go b/modules/templates/context_test.go new file mode 100644 index 0000000000..d854fbf0ff --- /dev/null +++ b/modules/templates/context_test.go @@ -0,0 +1,18 @@ +// Copyright 2025 The Forgejo Authors. All rights reserved. +// SPDX-License-Identifier: GPL-3.0-or-later +package templates + +import ( + "context" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestContext(t *testing.T) { + type ctxKey struct{} + + // Test that the original context is used for its context functions. + ctx := NewContext(context.WithValue(t.Context(), ctxKey{}, "there")) + assert.Equal(t, "there", ctx.Value(ctxKey{})) +} diff --git a/modules/templates/util_render.go b/modules/templates/util_render.go index badff5f193..bec8d5f5e3 100644 --- a/modules/templates/util_render.go +++ b/modules/templates/util_render.go @@ -22,7 +22,6 @@ import ( "forgejo.org/modules/markup" "forgejo.org/modules/markup/markdown" "forgejo.org/modules/setting" - "forgejo.org/modules/translation" "forgejo.org/modules/util" ) @@ -145,7 +144,7 @@ func RenderRefIssueTitle(ctx context.Context, text string) template.HTML { // RenderLabel renders a label // locale is needed due to an import cycle with our context providing the `Tr` function -func RenderLabel(ctx context.Context, locale translation.Locale, label *issues_model.Label) template.HTML { +func RenderLabel(ctx *Context, label *issues_model.Label) template.HTML { var ( archivedCSSClass string textColor = util.ContrastColor(label.Color) @@ -156,7 +155,7 @@ func RenderLabel(ctx context.Context, locale translation.Locale, label *issues_m if label.IsArchived() { archivedCSSClass = "archived-label" - description = locale.TrString("repo.issues.archived_label_description", description) + description = ctx.Locale.TrString("repo.issues.archived_label_description", description) } if labelScope == "" { @@ -246,7 +245,7 @@ func RenderMarkdownToHtml(ctx context.Context, input string) template.HTML { //n return output } -func RenderLabels(ctx context.Context, locale translation.Locale, labels []*issues_model.Label, repoLink string, isPull bool) template.HTML { +func RenderLabels(ctx *Context, labels []*issues_model.Label, repoLink string, isPull bool) template.HTML { htmlCode := `` for _, label := range labels { // Protect against nil value in labels - shouldn't happen but would cause a panic if so @@ -259,7 +258,7 @@ func RenderLabels(ctx context.Context, locale translation.Locale, labels []*issu issuesOrPull = "pulls" } htmlCode += fmt.Sprintf("%s ", - repoLink, issuesOrPull, label.ID, RenderLabel(ctx, locale, label)) + repoLink, issuesOrPull, label.ID, RenderLabel(ctx, label)) } htmlCode += "" return template.HTML(htmlCode) diff --git a/modules/templates/util_render_test.go b/modules/templates/util_render_test.go index 8d58d7d2d4..3cfd572491 100644 --- a/modules/templates/util_render_test.go +++ b/modules/templates/util_render_test.go @@ -223,23 +223,26 @@ func TestRenderLabels(t *testing.T) { labelMalicious := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 11}) labelArchived := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 12}) - rendered := RenderLabels(db.DefaultContext, tr, []*issues_model.Label{label}, "user2/repo1", false) + ctx := NewContext(t.Context()) + ctx.Locale = tr + + rendered := RenderLabels(ctx, []*issues_model.Label{label}, "user2/repo1", false) assert.Contains(t, rendered, "user2/repo1/issues?labels=1") assert.Contains(t, rendered, ">label1<") assert.Contains(t, rendered, "title='First label'") - rendered = RenderLabels(db.DefaultContext, tr, []*issues_model.Label{label}, "user2/repo1", true) + rendered = RenderLabels(ctx, []*issues_model.Label{label}, "user2/repo1", true) assert.Contains(t, rendered, "user2/repo1/pulls?labels=1") assert.Contains(t, rendered, ">label1<") - rendered = RenderLabels(db.DefaultContext, tr, []*issues_model.Label{labelScoped}, "user2/repo1", false) + rendered = RenderLabels(ctx, []*issues_model.Label{labelScoped}, "user2/repo1", false) assert.Contains(t, rendered, "user2/repo1/issues?labels=7") assert.Contains(t, rendered, ">scope<") assert.Contains(t, rendered, ">label1<") - rendered = RenderLabels(db.DefaultContext, tr, []*issues_model.Label{labelMalicious}, "user2/repo1", false) + rendered = RenderLabels(ctx, []*issues_model.Label{labelMalicious}, "user2/repo1", false) assert.Contains(t, rendered, "user2/repo1/issues?labels=11") assert.Contains(t, rendered, "> <script>malicious</script> <") assert.Contains(t, rendered, ">'?&<") assert.Contains(t, rendered, "title='Malicious label ' <script>malicious</script>'") - rendered = RenderLabels(db.DefaultContext, tr, []*issues_model.Label{labelArchived}, "user2/repo1", false) + rendered = RenderLabels(ctx, []*issues_model.Label{labelArchived}, "user2/repo1", false) assert.Contains(t, rendered, "user2/repo1/issues?labels=12") assert.Contains(t, rendered, ">archived label<><") assert.Contains(t, rendered, "title='repo.issues.archived_label_description'") diff --git a/release-notes-published/12.0.1.md b/release-notes-published/12.0.1.md new file mode 100644 index 0000000000..e3de6cae3a --- /dev/null +++ b/release-notes-published/12.0.1.md @@ -0,0 +1,24 @@ +Insecure authentication methods have been deprecated since 2023. They were [removed in v12.0.0](https://codeberg.org/forgejo/forgejo/pulls/7924) but they were [restored in v12.0.1](https://codeberg.org/forgejo/forgejo/pulls/8653). Certain OAuth2 clients and packages in the Forgejo ecosystem still rely on these methods and it was premature to remove them. + + + +## Release notes + +- User Interface bug fixes + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8575) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8576)): allow for tracked time to be removed again + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8565) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8574)): correct image source for quoted reply + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8553) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8555)): prevent render failure on faulty org settings post +- Bug fixes + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8633) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8653)): Revert "feat: remove API authentication methods that uses the URL query (#7924)" + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8644) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8646)): update i18n usage in comments + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8609) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8613)): upgrade fails or hang at migration[31]: Migrate maven package name concatenation + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8622) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8624)): rebase and fast forward merge breaks commit signatures + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8617) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8618)): make the action feed resilient to database inconsistencies + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8533) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8584)): make sure to use unaltered fields when saving a shadow copy for updated profiles or comments + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8596) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8610)): follow symlinks for local assets + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8550) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8552)): use correct ACME default +- Included for completeness but not user-facing (chores, etc.) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8638) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8641)): Revert "fix(ci): pull stylus from github:stylus/stylus#0.57.0 (#8625)" + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8625) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8627)): fix(ci): pull stylus from github:stylus/stylus#0.57.0 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/8611) ([backported](https://codeberg.org/forgejo/forgejo/pulls/8616)): chore: disable E2E test for webkit + diff --git a/routers/api/shared/middleware.go b/routers/api/shared/middleware.go index f56acbe1bf..b57fabac0e 100644 --- a/routers/api/shared/middleware.go +++ b/routers/api/shared/middleware.go @@ -130,7 +130,7 @@ func verifyAuthWithOptions(options *common.VerifyOptions) func(ctx *context.APIC // check for and warn against deprecated authentication options func checkDeprecatedAuthMethods(ctx *context.APIContext) { if ctx.FormString("token") != "" || ctx.FormString("access_token") != "" { - ctx.Resp.Header().Set("Warning", "token and access_token API authentication is deprecated and will be removed in gitea 1.23. Please use AuthorizationHeaderToken instead. Existing queries will continue to work but without authorization.") + ctx.Resp.Header().Set("Warning", "token and access_token API authentication is deprecated and will be removed in Forgejo v13.0.0. Please use AuthorizationHeaderToken instead. Existing queries will continue to work but without authorization.") } } diff --git a/routers/common/errpage.go b/routers/common/errpage.go index 907c278ab1..4dc5a58858 100644 --- a/routers/common/errpage.go +++ b/routers/common/errpage.go @@ -15,7 +15,6 @@ import ( "forgejo.org/modules/templates" "forgejo.org/modules/web/middleware" "forgejo.org/modules/web/routing" - "forgejo.org/services/context" ) const tplStatus500 base.TplName = "status/500" @@ -36,8 +35,8 @@ func RenderPanicErrorPage(w http.ResponseWriter, req *http.Request, err any) { httpcache.SetCacheControlInHeader(w.Header(), 0, "no-transform") w.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions) - tmplCtx := context.TemplateContext{} - tmplCtx["Locale"] = middleware.Locale(w, req) + tmplCtx := templates.NewContext(req.Context()) + tmplCtx.Locale = middleware.Locale(w, req) ctxData := middleware.GetContextData(req.Context()) // This recovery handler could be called without Gitea's web context, so we shouldn't touch that context too much. diff --git a/services/context/context.go b/services/context/context.go index 1a839773a8..68074964c8 100644 --- a/services/context/context.go +++ b/services/context/context.go @@ -41,7 +41,7 @@ type Render interface { type Context struct { *Base - TemplateContext TemplateContext + TemplateContext *templates.Context Render Render PageData map[string]any // data used by JavaScript modules in one page, it's `window.config.pageData` @@ -64,8 +64,6 @@ type Context struct { Package *Package } -type TemplateContext map[string]any - func init() { web.RegisterResponseStatusProvider[*Context](func(req *http.Request) web_types.ResponseStatusProvider { return req.Context().Value(WebContextKey).(*Context) @@ -98,10 +96,11 @@ func GetValidateContext(req *http.Request) (ctx *ValidateContext) { return ctx } -func NewTemplateContextForWeb(ctx *Context) TemplateContext { - tmplCtx := NewTemplateContext(ctx) - tmplCtx["Locale"] = ctx.Locale - tmplCtx["AvatarUtils"] = templates.NewAvatarUtils(ctx) +func NewTemplateContextForWeb(ctx *Context) *templates.Context { + tmplCtx := templates.NewContext(ctx) + tmplCtx.Locale = ctx.Locale + tmplCtx.AvatarUtils = templates.NewAvatarUtils(ctx) + tmplCtx.Data = ctx.Data return tmplCtx } diff --git a/services/context/context_template.go b/services/context/context_template.go deleted file mode 100644 index 7878d409ca..0000000000 --- a/services/context/context_template.go +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright 2023 The Gitea Authors. All rights reserved. -// SPDX-License-Identifier: MIT - -package context - -import ( - "context" - "time" -) - -var _ context.Context = TemplateContext(nil) - -func NewTemplateContext(ctx context.Context) TemplateContext { - return TemplateContext{"_ctx": ctx} -} - -func (c TemplateContext) parentContext() context.Context { - return c["_ctx"].(context.Context) -} - -func (c TemplateContext) Deadline() (deadline time.Time, ok bool) { - return c.parentContext().Deadline() -} - -func (c TemplateContext) Done() <-chan struct{} { - return c.parentContext().Done() -} - -func (c TemplateContext) Err() error { - return c.parentContext().Err() -} - -func (c TemplateContext) Value(key any) any { - return c.parentContext().Value(key) -} diff --git a/templates/repo/issue/card.tmpl b/templates/repo/issue/card.tmpl index 6d2f441793..ba6022ae3a 100644 --- a/templates/repo/issue/card.tmpl +++ b/templates/repo/issue/card.tmpl @@ -65,7 +65,7 @@
{{range .Labels}} - {{RenderLabel ctx ctx.Locale .}} + {{RenderLabel ctx .}} {{end}}
diff --git a/templates/repo/issue/filter_actions.tmpl b/templates/repo/issue/filter_actions.tmpl index 60237f225d..ea7878c47b 100644 --- a/templates/repo/issue/filter_actions.tmpl +++ b/templates/repo/issue/filter_actions.tmpl @@ -30,7 +30,7 @@ {{end}} {{$previousExclusiveScope = $exclusiveScope}}
- {{if SliceUtils.Contains $.SelLabelIDs .ID}}{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}{{end}} {{RenderLabel $.Context ctx.Locale .}} + {{if SliceUtils.Contains $.SelLabelIDs .ID}}{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}{{end}} {{RenderLabel ctx .}} {{template "repo/issue/labels/label_archived" .}}
{{end}} diff --git a/templates/repo/issue/labels/label.tmpl b/templates/repo/issue/labels/label.tmpl index 7844362911..fe4c7494bb 100644 --- a/templates/repo/issue/labels/label.tmpl +++ b/templates/repo/issue/labels/label.tmpl @@ -4,5 +4,5 @@ href="{{.root.RepoLink}}/{{if or .root.IsPull .root.Issue.IsPull}}pulls{{else}}issues{{end}}?labels={{.label.ID}}"{{/* FIXME: use .root.Issue.Link or create .root.Link */}} rel="nofollow" > - {{- RenderLabel $.Context ctx.Locale .label -}} + {{- RenderLabel ctx .label -}} diff --git a/templates/repo/issue/labels/label_list.tmpl b/templates/repo/issue/labels/label_list.tmpl index 8d7fc2c3db..0a7262bdd8 100644 --- a/templates/repo/issue/labels/label_list.tmpl +++ b/templates/repo/issue/labels/label_list.tmpl @@ -32,7 +32,7 @@ {{range .Labels}}
  • - {{RenderLabel $.Context ctx.Locale .}} + {{RenderLabel ctx .}} {{if .Description}}
    {{.Description | RenderEmoji $.Context}}{{end}}
    @@ -72,7 +72,7 @@ {{range .OrgLabels}}
  • - {{RenderLabel $.Context ctx.Locale .}} + {{RenderLabel ctx .}} {{if .Description}}
    {{.Description | RenderEmoji $.Context}}{{end}}
    diff --git a/templates/repo/issue/labels/labels_selector_field.tmpl b/templates/repo/issue/labels/labels_selector_field.tmpl index 9e54e7a649..8a931a9433 100644 --- a/templates/repo/issue/labels/labels_selector_field.tmpl +++ b/templates/repo/issue/labels/labels_selector_field.tmpl @@ -21,7 +21,7 @@
    {{end}} {{$previousExclusiveScope = $exclusiveScope}} - {{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}  {{RenderLabel $.Context ctx.Locale .}} + {{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}  {{RenderLabel ctx .}} {{if .Description}}
    {{.Description | RenderEmoji $.Context}}{{end}}

    {{template "repo/issue/labels/label_archived" .}}

     @@ -34,7 +34,7 @@
    {{end}} {{$previousExclusiveScope = $exclusiveScope}} - {{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}  {{RenderLabel $.Context ctx.Locale .}} + {{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}  {{RenderLabel ctx .}} {{if .Description}}
    {{.Description | RenderEmoji $.Context}}{{end}}

    {{template "repo/issue/labels/label_archived" .}}

     diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl index 3e833cbc5a..454467a4d0 100644 --- a/templates/repo/issue/view_content/comments.tmpl +++ b/templates/repo/issue/view_content/comments.tmpl @@ -176,11 +176,11 @@ {{template "shared/user/authorlink" .Poster}} {{if and .AddedLabels (not .RemovedLabels)}} - {{ctx.Locale.TrN (len .AddedLabels) "repo.issues.add_label" "repo.issues.add_labels" (RenderLabels $.Context ctx.Locale .AddedLabels $.RepoLink .Issue.IsPull) $createdStr}} + {{ctx.Locale.TrN (len .AddedLabels) "repo.issues.add_label" "repo.issues.add_labels" (RenderLabels ctx .AddedLabels $.RepoLink .Issue.IsPull) $createdStr}} {{else if and (not .AddedLabels) .RemovedLabels}} - {{ctx.Locale.TrN (len .RemovedLabels) "repo.issues.remove_label" "repo.issues.remove_labels" (RenderLabels $.Context ctx.Locale .RemovedLabels $.RepoLink .Issue.IsPull) $createdStr}} + {{ctx.Locale.TrN (len .RemovedLabels) "repo.issues.remove_label" "repo.issues.remove_labels" (RenderLabels ctx .RemovedLabels $.RepoLink .Issue.IsPull) $createdStr}} {{else}} - {{ctx.Locale.Tr "repo.issues.add_remove_labels" (RenderLabels $.Context ctx.Locale .AddedLabels $.RepoLink .Issue.IsPull) (RenderLabels $.Context ctx.Locale .RemovedLabels $.RepoLink .Issue.IsPull) $createdStr}} + {{ctx.Locale.Tr "repo.issues.add_remove_labels" (RenderLabels ctx .AddedLabels $.RepoLink .Issue.IsPull) (RenderLabels ctx .RemovedLabels $.RepoLink .Issue.IsPull) $createdStr}} {{end}}
    @@ -742,11 +742,11 @@
  • {{svg "octicon-tag" 20}} {{if and .AddedLabels (not .RemovedLabels)}} - {{ctx.Locale.TrN (len .AddedLabels) "repo.issues.add_label" "repo.issues.add_labels" (RenderLabels $.Context ctx.Locale .AddedLabels $.RepoLink .Issue.IsPull) ""}} + {{ctx.Locale.TrN (len .AddedLabels) "repo.issues.add_label" "repo.issues.add_labels" (RenderLabels ctx .AddedLabels $.RepoLink .Issue.IsPull) ""}} {{else if and (not .AddedLabels) .RemovedLabels}} - {{ctx.Locale.TrN (len .RemovedLabels) "repo.issues.remove_label" "repo.issues.remove_labels" (RenderLabels $.Context ctx.Locale .RemovedLabels $.RepoLink .Issue.IsPull) ""}} + {{ctx.Locale.TrN (len .RemovedLabels) "repo.issues.remove_label" "repo.issues.remove_labels" (RenderLabels ctx .RemovedLabels $.RepoLink .Issue.IsPull) ""}} {{else}} - {{ctx.Locale.Tr "repo.issues.add_remove_labels" (RenderLabels $.Context ctx.Locale .AddedLabels $.RepoLink .Issue.IsPull) (RenderLabels $.Context ctx.Locale .RemovedLabels $.RepoLink .Issue.IsPull) ""}} + {{ctx.Locale.Tr "repo.issues.add_remove_labels" (RenderLabels ctx .AddedLabels $.RepoLink .Issue.IsPull) (RenderLabels ctx .RemovedLabels $.RepoLink .Issue.IsPull) ""}} {{end}}
    • {{end}} diff --git a/templates/shared/issuelist.tmpl b/templates/shared/issuelist.tmpl index 6c0950caff..256b5e3e07 100644 --- a/templates/shared/issuelist.tmpl +++ b/templates/shared/issuelist.tmpl @@ -21,7 +21,7 @@ {{end}} {{range .Labels}} - {{RenderLabel $.Context ctx.Locale .}} + {{RenderLabel ctx .}} {{end}}
    diff --git a/templates/shared/label_filter.tmpl b/templates/shared/label_filter.tmpl index 50040c208d..0c8d537cc7 100644 --- a/templates/shared/label_filter.tmpl +++ b/templates/shared/label_filter.tmpl @@ -42,7 +42,7 @@ {{svg "octicon-check"}} {{end}} {{end}} - {{RenderLabel $.Context ctx.Locale .}} + {{RenderLabel ctx .}}

    {{template "repo/issue/labels/label_archived" .}}

    {{end}} diff --git a/tests/integration/issue_test.go b/tests/integration/issue_test.go index 72fe2a4e49..f75c345e63 100644 --- a/tests/integration/issue_test.go +++ b/tests/integration/issue_test.go @@ -1524,3 +1524,15 @@ func TestIssuePostersSearch(t *testing.T) { assert.EqualValues(t, 1, data.Results[0].UserID) }) } + +func TestIssueTimelineLabels(t *testing.T) { + defer tests.PrepareTestEnv(t)() + + req := NewRequest(t, "GET", "/user2/repo1/issues/1") + resp := MakeRequest(t, req, http.StatusOK) + assert.NotContains(t, resp.Body.String(), `status-page-500`) + + htmlDoc := NewHTMLParser(t, resp.Body) + filterLinks := htmlDoc.Find(".timeline .labels-list a") + assert.Equal(t, 9, filterLinks.Length()) +}