gamzinav/forgejo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,289 Commits 3 Branches 0 Tags 279 MiB
d056bf300f
Commit Graph

9 Commits

Author SHA1 Message Date
zeripath
2a03e96bce
Allow markdown files to read from the LFS (#5787) 
This PR makes it possible for the markdown renderer to render images and media straight from the LFS.

Fix #5746

Signed-off-by: Andrew Thornton [art27@cantab.net](mailto:art27@cantab.net)
 2019-02-12 15:09:43 +00:00
zeripath
01c10a951b
Fix ssh deploy and user key constraints (#1357) (#5939) 
1. A key can either be an ssh user key or a deploy key. It cannot be both.
2. If a key is a user key - it can only be associated with one user.
3. If a key is a deploy key - it can be used in multiple repositories and the permissions it has on those repositories can be different.
4. If a repository is deleted, its deploy keys must be deleted too.

We currently don't enforce any of this and multiple repositories access with different permissions doesn't work at all. This PR enforces the following constraints:

- [x] You should not be able to add the same user key as another user
- [x] You should not be able to add a ssh user key which is being used as a deploy key
- [x] You should not be able to add a ssh deploy key which is being used as a user key
- [x] If you add an ssh deploy key to another repository you should be able to use it in different modes without losing the ability to use it in the other mode.
- [x] If you delete a repository you must delete all its deploy keys.

Fix #1357
 2019-02-03 23:56:53 +00:00
zeripath
7096085f2b Fix #5226 by adding CSRF checking to api reqToken and add CSRF to the POST header for deadline (#5250) 
* Add CSRF checking to reqToken and place CSRF in the post for deadline creation

Fixes #5226, #5249

* /api/v1/admin/users routes should have reqToken middleware
 2018-11-03 21:15:55 -04:00
B-OnTheGo
e47df0b301 Enforce token on api routes [fixed critical security issue #4357] (#4840) 2018-09-10 12:15:52 -04:00
Ethan Koenig
a2648281a0 Improvements to git integration test (#3466) 2018-02-06 11:27:24 +02:00
Antoine GIRARD
9e842c8a72 Fix SSH auth lfs locks (#3152) 
* Fix SSH auth LFS locks

* Activate SSH/lock test

* Remove debug

* Follow @lunny recommendation for AfterLoad method
 2018-01-27 18:48:15 +02:00
Antoine GIRARD
095fb9f2e3 Add integrations tests from git cli (#3377) 
* test: integration add git cli tests

Extracted form for easing review process and debug #3152

* test: integration add git cli big file commit

* fix:  Don't rewrite key if internal server
 2018-01-16 13:07:47 +02:00
Antoine GIRARD
ef78309b65 Improve LFS tests + fix lfs url refs + keep path upper/lowercase in db. (#3092) 
* Add failing test

* Fix urls

* Improve url in tests

* improve testing

* Remove debug code

* Add deps

* LFS corner-case : Search on lower but store with case

* Temporary comment of blocking action

* fix hooks

* Use temporary repo for git client test

* Use userPassword in place of hard-coded password
 2017-12-08 20:21:37 +08:00
Lunny Xiao
f70758dec9 Add git clone test on integration test (#1682) 2017-11-02 18:51:03 +01:00