Merge branch 'main' into main

modules/actions/jobparser/jobparser.go

@@ -83,12 +83,6 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 	return ret, nil
 }
 
-func WithJobResults(results map[string]string) ParseOption {
-	return func(c *parseContext) {
-		c.jobResults = results
-	}
-}
-
 func WithGitContext(context *model.GithubContext) ParseOption {
 	return func(c *parseContext) {
 		c.gitContext = context

modules/dump/dumper.go

@@ -4,6 +4,7 @@
 package dump
 
 import (
+	"archive/zip"
 	"context"
 	"errors"
 	"fmt"
@@ -85,7 +86,7 @@ func NewDumper(ctx context.Context, format string, output io.Writer) (*Dumper, e
 	var comp archives.ArchiverAsync
 	switch format {
 	case "zip":
-		comp = archives.Zip{}
+		comp = archives.Zip{Compression: zip.Deflate}
 	case "tar":
 		comp = archives.Tar{}
 	case "tar.sz":

modules/eventsource/event.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"strings"
 	"time"
 
 	"code.gitea.io/gitea/modules/json"
@@ -110,9 +109,3 @@ func (e *Event) WriteTo(w io.Writer) (int64, error) {
 
 	return sum, err
 }
-
-func (e *Event) String() string {
-	buf := new(strings.Builder)
-	_, _ = e.WriteTo(buf)
-	return buf.String()
-}

modules/git/git.go

@@ -192,13 +192,13 @@ func RunGitTests(m interface{ Run() int }) {
 func runGitTests(m interface{ Run() int }) int {
 	gitHomePath, cleanup, err := tempdir.OsTempDir("gitea-test").MkdirTempRandom("git-home")
 	if err != nil {
-		testlogger.Panicf("unable to create temp dir: %s", err.Error())
+		return testlogger.MainErrorf("unable to create temp dir: %v", err)
 	}
 	defer cleanup()
 
 	setting.Git.HomePath = gitHomePath
 	if err = InitFull(); err != nil {
-		testlogger.Panicf("failed to call Init: %s", err.Error())
+		return testlogger.MainErrorf("failed to call Init: %v", err)
 	}
 	return m.Run()
 }

modules/git/gitcmd/command_test.go

@@ -24,7 +24,7 @@ func testMain(m *testing.M) int {
 	// "setting.Git.HomePath" is initialized in "git" package but really used in "gitcmd" package
 	gitHomePath, cleanup, err := tempdir.OsTempDir("gitea-test").MkdirTempRandom("git-home")
 	if err != nil {
-		testlogger.Panicf("failed to create temp dir: %v", err)
+		return testlogger.MainErrorf("failed to create temp dir: %v", err)
 	}
 	defer cleanup()
 

modules/git/gitcmd/error.go

@@ -56,6 +56,14 @@ func StderrHasPrefix(err error, prefix string) bool {
 	return strings.HasPrefix(stderr, prefix)
 }
 
+func StderrContains(err error, sub string) bool {
+	stderr, ok := ErrorAsStderr(err)
+	if !ok {
+		return false
+	}
+	return strings.Contains(stderr, sub)
+}
+
 func IsErrorExitCode(err error, code int) bool {
 	var exitError *exec.ExitError
 	if errors.As(err, &exitError) {

modules/gitrepo/commit.go

@@ -44,23 +44,6 @@ func CommitsCount(ctx context.Context, repo Repository, opts CommitsCountOptions
 	return strconv.ParseInt(strings.TrimSpace(stdout), 10, 64)
 }
 
-// CommitsCountBetween return numbers of commits between two commits
-func CommitsCountBetween(ctx context.Context, repo Repository, start, end string) (int64, error) {
-	count, err := CommitsCount(ctx, repo, CommitsCountOptions{
-		Revision: []string{start + ".." + end},
-	})
-
-	if err != nil && strings.Contains(err.Error(), "no merge base") {
-		// future versions of git >= 2.28 are likely to return an error if before and last have become unrelated.
-		// previously it would return the results of git rev-list before last so let's try that...
-		return CommitsCount(ctx, repo, CommitsCountOptions{
-			Revision: []string{start, end},
-		})
-	}
-
-	return count, err
-}
-
 // FileCommitsCount return the number of files at a revision
 func FileCommitsCount(ctx context.Context, repo Repository, revision, file string) (int64, error) {
 	return CommitsCount(ctx, repo,

modules/gitrepo/config.go

@@ -5,21 +5,11 @@ package gitrepo
 
 import (
 	"context"
-	"strings"
 
 	"code.gitea.io/gitea/modules/git/gitcmd"
 	"code.gitea.io/gitea/modules/globallock"
 )
 
-func GitConfigGet(ctx context.Context, repo Repository, key string) (string, error) {
-	result, _, err := RunCmdString(ctx, repo, gitcmd.NewCommand("config", "--get").
-		AddDynamicArguments(key))
-	if err != nil {
-		return "", err
-	}
-	return strings.TrimSpace(result), nil
-}
-
 func getRepoConfigLockKey(repoStoragePath string) string {
 	return "repo-config:" + repoStoragePath
 }

modules/hostmatcher/hostmatcher.go

@@ -78,11 +78,6 @@ func (hl *HostMatchList) AppendBuiltin(builtin string) {
 	hl.builtins = append(hl.builtins, builtin)
 }
 
-// AppendPattern appends more pattern to match
-func (hl *HostMatchList) AppendPattern(pattern string) {
-	hl.patterns = append(hl.patterns, pattern)
-}
-
 // IsEmpty checks if the checklist is empty
 func (hl *HostMatchList) IsEmpty() bool {
 	return hl == nil || (len(hl.builtins) == 0 && len(hl.patterns) == 0 && len(hl.ipNets) == 0)

modules/markup/html_test.go

@@ -317,7 +317,7 @@ func TestRender_email(t *testing.T) {
 
 func TestRender_emoji(t *testing.T) {
 	setting.AppURL = markup.TestAppURL
-	setting.StaticURLPrefix = markup.TestAppURL
+	setting.StaticURLPrefix = strings.TrimSuffix(markup.TestAppURL, "/")
 
 	test := func(input, expected string) {
 		expected = strings.ReplaceAll(expected, "&", "&")
@@ -500,7 +500,7 @@ func Test_ParseClusterFuzz(t *testing.T) {
 }
 
 func TestPostProcess(t *testing.T) {
-	setting.StaticURLPrefix = markup.TestAppURL // can't run standalone
+	setting.StaticURLPrefix = strings.TrimSuffix(markup.TestAppURL, "/") // can't run standalone
 	defer testModule.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 
 	test := func(input, expected string) {

modules/markup/markdown/markdown.go

@@ -74,10 +74,6 @@ func (r *GlodmarkRender) Convert(source []byte, writer io.Writer, opts ...parser
 	return r.goldmarkMarkdown.Convert(source, writer, opts...)
 }
 
-func (r *GlodmarkRender) Renderer() renderer.Renderer {
-	return r.goldmarkMarkdown.Renderer()
-}
-
 func (r *GlodmarkRender) highlightingRenderer(w util.BufWriter, c highlighting.CodeBlockContext, entering bool) {
 	if entering {
 		languageBytes, _ := c.Language()

modules/public/vitedev.go

@@ -87,6 +87,7 @@ func getViteDevProxy() *httputil.ReverseProxy {
 // the Vite dev server port from the port file written by the viteDevServerPortPlugin.
 // It is needed because there are container-based development, only Gitea web server's port is exposed.
 func ViteDevMiddleware(next http.Handler) http.Handler {
+	markLongPolling := routing.MarkLongPolling()
 	return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
 		if !isViteDevRequest(req) {
 			next.ServeHTTP(resp, req)
@@ -97,8 +98,7 @@ func ViteDevMiddleware(next http.Handler) http.Handler {
 			next.ServeHTTP(resp, req)
 			return
 		}
-		routing.MarkLongPolling(resp, req)
-		proxy.ServeHTTP(resp, req)
+		markLongPolling(proxy).ServeHTTP(resp, req)
 	})
 }
 

modules/queue/manager_test.go

@@ -13,11 +13,7 @@ import (
 )
 
 func TestManager(t *testing.T) {
-	oldAppDataPath := setting.AppDataPath
 	setting.AppDataPath = t.TempDir()
-	defer func() {
-		setting.AppDataPath = oldAppDataPath
-	}()
 
 	newQueueFromConfig := func(name, cfg string) (*WorkerPoolQueue[int], error) {
 		cfgProvider, err := setting.NewConfigProviderFromData(cfg)

modules/setting/actions.go

@@ -12,6 +12,8 @@ import (
 	"code.gitea.io/gitea/modules/log"
 )
 
+const defaultMaxRerunAttempts = 50
+
 // Actions settings
 var (
 	Actions = struct {
@@ -27,11 +29,13 @@ var (
 		AbandonedJobTimeout   time.Duration     `ini:"ABANDONED_JOB_TIMEOUT"`
 		SkipWorkflowStrings   []string          `ini:"SKIP_WORKFLOW_STRINGS"`
 		WorkflowDirs          []string          `ini:"WORKFLOW_DIRS"`
+		MaxRerunAttempts      int64             `ini:"MAX_RERUN_ATTEMPTS"`
 	}{
 		Enabled:             true,
 		DefaultActionsURL:   defaultActionsURLGitHub,
 		SkipWorkflowStrings: []string{"[skip ci]", "[ci skip]", "[no ci]", "[skip actions]", "[actions skip]"},
 		WorkflowDirs:        []string{".gitea/workflows", ".github/workflows"},
+		MaxRerunAttempts:    defaultMaxRerunAttempts,
 	}
 )
 
@@ -118,6 +122,10 @@ func loadActionsFrom(rootCfg ConfigProvider) error {
 	Actions.EndlessTaskTimeout = sec.Key("ENDLESS_TASK_TIMEOUT").MustDuration(3 * time.Hour)
 	Actions.AbandonedJobTimeout = sec.Key("ABANDONED_JOB_TIMEOUT").MustDuration(24 * time.Hour)
 
+	if Actions.MaxRerunAttempts <= 0 {
+		Actions.MaxRerunAttempts = defaultMaxRerunAttempts
+	}
+
 	if !Actions.LogCompression.IsValid() {
 		return fmt.Errorf("invalid [actions] LOG_COMPRESSION: %q", Actions.LogCompression)
 	}

modules/setting/oauth2.go

@@ -99,6 +99,7 @@ var OAuth2 = struct {
 	JWTClaimIssuer             string `ini:"JWT_CLAIM_ISSUER"`
 	MaxTokenLength             int
 	DefaultApplications        []string
+	CustomSchemes              []string
 }{
 	Enabled:                    true,
 	AccessTokenExpirationTime:  3600,

modules/setting/path.go

@@ -198,6 +198,12 @@ func InitWorkPathAndCfgProvider(getEnvFn func(name string) string, args ArgWorkP
 	CustomConf = tmpCustomConf.Value
 }
 
+func MockBuiltinPaths(workPath, customPath, customConf string) func() {
+	oldApp, oldCustom, oldConf := appWorkPathBuiltin, customPathBuiltin, customConfBuiltin
+	appWorkPathBuiltin, customPathBuiltin, customConfBuiltin = workPath, customPath, customConf
+	return func() { appWorkPathBuiltin, customPathBuiltin, customConfBuiltin = oldApp, oldCustom, oldConf }
+}
+
 // AppDataTempDir returns a managed temporary directory for the application data.
 // Using empty sub will get the managed base temp directory, and it's safe to delete it.
 // Gitea only creates subdirectories under it, but not the APP_TEMP_PATH directory itself.

modules/setting/security.go

@@ -16,9 +16,11 @@ import (
 // Security settings
 var Security = struct {
 	// TODO: move more settings to this struct in future
-	XFrameOptions string
+	XFrameOptions       string
+	XContentTypeOptions string
 }{
-	XFrameOptions: "SAMEORIGIN",
+	XFrameOptions:       "SAMEORIGIN",
+	XContentTypeOptions: "nosniff",
 }
 
 var (
@@ -154,6 +156,8 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
 		Security.XFrameOptions = rootCfg.Section("cors").Key("X_FRAME_OPTIONS").MustString(Security.XFrameOptions)
 	}
 
+	Security.XContentTypeOptions = sec.Key("X_CONTENT_TYPE_OPTIONS").MustString(Security.XContentTypeOptions)
+
 	twoFactorAuth := sec.Key("TWO_FACTOR_AUTH").String()
 	switch twoFactorAuth {
 	case "":

modules/setting/server.go

@@ -4,7 +4,6 @@
 package setting
 
 import (
-	"encoding/base64"
 	"net"
 	"net/url"
 	"os"
@@ -13,7 +12,6 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
 )
 
@@ -112,72 +110,9 @@ var (
 	StartupTimeout             time.Duration
 	PerWriteTimeout            = 30 * time.Second
 	PerWritePerKbTimeout       = 10 * time.Second
-	StaticURLPrefix            string
-	AbsoluteAssetURL           string
-
-	ManifestData string
+	StaticURLPrefix            string // no trailing slash, defaults to AppSubURL, the URL can be relative or absolute
 )
 
-// MakeManifestData generates web app manifest JSON
-func MakeManifestData(appName, appURL, absoluteAssetURL string) []byte {
-	type manifestIcon struct {
-		Src   string `json:"src"`
-		Type  string `json:"type"`
-		Sizes string `json:"sizes"`
-	}
-
-	type manifestJSON struct {
-		Name      string         `json:"name"`
-		ShortName string         `json:"short_name"`
-		StartURL  string         `json:"start_url"`
-		Icons     []manifestIcon `json:"icons"`
-	}
-
-	bytes, err := json.Marshal(&manifestJSON{
-		Name:      appName,
-		ShortName: appName,
-		StartURL:  appURL,
-		Icons: []manifestIcon{
-			{
-				Src:   absoluteAssetURL + "/assets/img/logo.png",
-				Type:  "image/png",
-				Sizes: "512x512",
-			},
-			{
-				Src:   absoluteAssetURL + "/assets/img/logo.svg",
-				Type:  "image/svg+xml",
-				Sizes: "512x512",
-			},
-		},
-	})
-	if err != nil {
-		log.Error("unable to marshal manifest JSON. Error: %v", err)
-		return make([]byte, 0)
-	}
-
-	return bytes
-}
-
-// MakeAbsoluteAssetURL returns the absolute asset url prefix without a trailing slash
-func MakeAbsoluteAssetURL(appURL *url.URL, staticURLPrefix string) string {
-	parsedPrefix, err := url.Parse(strings.TrimSuffix(staticURLPrefix, "/"))
-	if err != nil {
-		log.Fatal("Unable to parse STATIC_URL_PREFIX: %v", err)
-	}
-
-	if err == nil && parsedPrefix.Hostname() == "" {
-		if staticURLPrefix == "" {
-			return strings.TrimSuffix(appURL.String(), "/")
-		}
-
-		// StaticURLPrefix is just a path
-		appHostURL := &url.URL{Scheme: appURL.Scheme, Host: appURL.Host}
-		return appHostURL.String() + "/" + strings.Trim(staticURLPrefix, "/")
-	}
-
-	return strings.TrimSuffix(staticURLPrefix, "/")
-}
-
 func loadServerFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("server")
 	AppName = rootCfg.Section("").Key("APP_NAME").MustString("Gitea: Git with a cup of tea")
@@ -313,10 +248,6 @@ func loadServerFrom(rootCfg ConfigProvider) {
 		Domain = urlHostname
 	}
 
-	AbsoluteAssetURL = MakeAbsoluteAssetURL(appURL, StaticURLPrefix)
-	manifestBytes := MakeManifestData(AppName, AppURL, AbsoluteAssetURL)
-	ManifestData = `application/json;base64,` + base64.StdEncoding.EncodeToString(manifestBytes)
-
 	var defaultLocalURL string
 	switch Protocol {
 	case HTTPUnix:

modules/setting/setting_test.go

@@ -1,41 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package setting
-
-import (
-	"net/url"
-	"testing"
-
-	"code.gitea.io/gitea/modules/json"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestMakeAbsoluteAssetURL(t *testing.T) {
-	appURL1, _ := url.Parse("https://localhost:1234")
-	appURL2, _ := url.Parse("https://localhost:1234/")
-	appURLSub1, _ := url.Parse("https://localhost:1234/foo")
-	appURLSub2, _ := url.Parse("https://localhost:1234/foo/")
-
-	// static URL is an absolute URL, so should be used
-	assert.Equal(t, "https://localhost:2345", MakeAbsoluteAssetURL(appURL1, "https://localhost:2345"))
-	assert.Equal(t, "https://localhost:2345", MakeAbsoluteAssetURL(appURL1, "https://localhost:2345/"))
-
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURL1, "/foo"))
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURL2, "/foo"))
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURL1, "/foo/"))
-
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURLSub1, "/foo"))
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURLSub2, "/foo"))
-	assert.Equal(t, "https://localhost:1234/foo", MakeAbsoluteAssetURL(appURLSub1, "/foo/"))
-
-	assert.Equal(t, "https://localhost:1234/bar", MakeAbsoluteAssetURL(appURLSub1, "/bar"))
-	assert.Equal(t, "https://localhost:1234/bar", MakeAbsoluteAssetURL(appURLSub2, "/bar"))
-	assert.Equal(t, "https://localhost:1234/bar", MakeAbsoluteAssetURL(appURLSub1, "/bar/"))
-}
-
-func TestMakeManifestData(t *testing.T) {
-	jsonBytes := MakeManifestData(`Example App '\"`, "https://example.com", "https://example.com/foo/bar")
-	assert.True(t, json.Valid(jsonBytes))
-}

modules/setting/testenv.go

@@ -10,10 +10,12 @@ import (
 	"runtime"
 	"strings"
 
+	"code.gitea.io/gitea/modules/auth/password/hash"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/util"
 )
 
-var giteaTestSourceRoot *string
+var giteaTestSourceRoot *string // intentionally use a pointer to make sure the uninitialized access panics
 
 func GetGiteaTestSourceRoot() string {
 	return *giteaTestSourceRoot
@@ -25,48 +27,93 @@ func SetupGiteaTestEnv() {
 	}
 
 	IsInTesting = true
-	giteaRoot := os.Getenv("GITEA_TEST_ROOT")
-	if giteaRoot == "" {
-		_, filename, _, _ := runtime.Caller(0)
-		giteaRoot = filepath.Dir(filepath.Dir(filepath.Dir(filename)))
-		fixturesDir := filepath.Join(giteaRoot, "models", "fixtures")
-		if _, err := os.Stat(fixturesDir); err != nil {
-			panic("in gitea source code directory, fixtures directory not found: " + fixturesDir)
+
+	log.OsExiter = func(code int) {
+		if code != 0 {
+			// Non-zero exit code (log.Fatal) shouldn't occur during testing, if it happens:
+			// * Show a full stacktrace for more details.
+			// * If the "log.Fatal" is abused in tests, should fix.
+			panic(fmt.Errorf("non-zero exit code during testing: %d", code))
+		}
+		os.Exit(0)
+	}
+
+	initGiteaRoot := func() string {
+		giteaRoot := os.Getenv("GITEA_TEST_ROOT")
+		if giteaRoot == "" {
+			_, filename, _, _ := runtime.Caller(0)
+			giteaRoot = filepath.Dir(filepath.Dir(filepath.Dir(filename)))
+			fixturesDir := filepath.Join(giteaRoot, "models", "fixtures")
+			if _, err := os.Stat(fixturesDir); err != nil {
+				panic("in gitea source code directory, fixtures directory not found: " + fixturesDir)
+			}
+		}
+		giteaTestSourceRoot = &giteaRoot
+		return giteaRoot
+	}
+	giteaRoot := initGiteaRoot()
+
+	initGiteaPaths := func() {
+		// need to load assets (options, public) from the source code directory for testing
+		StaticRootPath = giteaRoot
+		// during testing, the AppPath must point to the pre-built Gitea binary in the source root
+		// it needs to be called by git hooks
+		AppPath = filepath.Join(giteaRoot, "gitea") + util.Iif(IsWindows, ".exe", "")
+	}
+
+	initGiteaConf := func() string {
+		// giteaConf (GITEA_CONF) must be relative because it is used in the git hooks as "$GITEA_ROOT/$GITEA_CONF"
+		giteaConf := os.Getenv("GITEA_TEST_CONF")
+		if giteaConf == "" {
+			// if no GITEA_TEST_CONF, then it is in unit test, use a temp (non-existing / empty) config file
+			// do not really use such config file, the test can run concurrently, using the same config file will cause data-race between tests
+			giteaConf = "custom/conf/app-test-tmp.ini"
+			customConfBuiltin = filepath.Join(AppWorkPath, giteaConf)
+			CustomConf = customConfBuiltin
+			_ = os.Remove(CustomConf)
+		} else {
+			// CustomConf must be absolute path to make tests pass.
+			// At the moment, GITEA_TEST_CONF is always in Gitea's source root
+			CustomConf = filepath.Join(giteaRoot, giteaConf)
+		}
+		return giteaConf
+	}
+
+	cleanUpEnv := func() {
+		// also unset unnecessary env vars for testing (only keep "GITEA_TEST_*" ones)
+		UnsetUnnecessaryEnvVars()
+		for _, env := range os.Environ() {
+			if strings.HasPrefix(env, "GIT_") || (strings.HasPrefix(env, "GITEA_") && !strings.HasPrefix(env, "GITEA_TEST_")) {
+				k, _, _ := strings.Cut(env, "=")
+				_ = os.Unsetenv(k)
+			}
 		}
 	}
 
-	appWorkPathBuiltin = giteaRoot
-	AppWorkPath = giteaRoot
-	AppPath = filepath.Join(giteaRoot, "gitea") + util.Iif(IsWindows, ".exe", "")
-	StaticRootPath = giteaRoot // need to load assets (options, public) from the source code directory for testing
+	initWorkPathAndConfig := func() {
+		// init paths and config system for testing
+		getTestEnv := func(key string) string { return "" }
+		InitWorkPathAndCommonConfig(getTestEnv, ArgWorkPathAndCustomConf{CustomConf: CustomConf})
 
-	// giteaConf (GITEA_CONF) must be relative because it is used in the git hooks as "$GITEA_ROOT/$GITEA_CONF"
-	giteaConf := os.Getenv("GITEA_TEST_CONF")
-	if giteaConf == "" {
-		// By default, use sqlite.ini for testing, then IDE like GoLand can start the test process with debugger.
-		// It's easier for developers to debug bugs step by step with a debugger.
-		// Notice: when doing "ssh push", Gitea executes sub processes, debugger won't work for the sub processes.
-		giteaConf = "tests/sqlite.ini"
-		_, _ = fmt.Fprintf(os.Stderr, "Environment variable GITEA_TEST_CONF not set - defaulting to %s\n", giteaConf)
-		if !EnableSQLite3 {
-			_, _ = fmt.Fprintf(os.Stderr, "sqlite3 requires: -tags sqlite,sqlite_unlock_notify\n")
-			os.Exit(1)
+		if err := PrepareAppDataPath(); err != nil {
+			log.Fatal("Can not prepare APP_DATA_PATH: %v", err)
 		}
+
+		// register the dummy hash algorithm function used in the test fixtures
+		_ = hash.Register("dummy", hash.NewDummyHasher)
+		PasswordHashAlgo, _ = hash.SetDefaultPasswordHashAlgorithm("dummy")
 	}
-	// CustomConf must be absolute path to make tests pass,
-	CustomConf = filepath.Join(AppWorkPath, giteaConf)
 
-	// also unset unnecessary env vars for testing (only keep "GITEA_TEST_*" ones)
-	UnsetUnnecessaryEnvVars()
-	for _, env := range os.Environ() {
-		if strings.HasPrefix(env, "GIT_") || (strings.HasPrefix(env, "GITEA_") && !strings.HasPrefix(env, "GITEA_TEST_")) {
-			k, _, _ := strings.Cut(env, "=")
-			_ = os.Unsetenv(k)
-		}
+	initGiteaPaths()
+	giteaConf := initGiteaConf()
+	cleanUpEnv()
+	initWorkPathAndConfig()
+
+	if RepoRootPath == "" || AppDataPath == "" {
+		panic("SetupGiteaTestEnv failed, paths are not initialized")
 	}
 
 	// TODO: some git repo hooks (test fixtures) still use these env variables, need to be refactored in the future
 	_ = os.Setenv("GITEA_ROOT", giteaRoot)
 	_ = os.Setenv("GITEA_CONF", giteaConf) // test fixture git hooks use "$GITEA_ROOT/$GITEA_CONF" in their scripts
-	giteaTestSourceRoot = &giteaRoot
 }

modules/storage/storage.go

@@ -21,25 +21,6 @@ import (
 // ErrURLNotSupported represents url is not supported
 var ErrURLNotSupported = errors.New("url method not supported")
 
-// ErrInvalidConfiguration is called when there is invalid configuration for a storage
-type ErrInvalidConfiguration struct {
-	cfg any
-	err error
-}
-
-func (err ErrInvalidConfiguration) Error() string {
-	if err.err != nil {
-		return fmt.Sprintf("Invalid Configuration Argument: %v: Error: %v", err.cfg, err.err)
-	}
-	return fmt.Sprintf("Invalid Configuration Argument: %v", err.cfg)
-}
-
-// IsErrInvalidConfiguration checks if an error is an ErrInvalidConfiguration
-func IsErrInvalidConfiguration(err error) bool {
-	_, ok := err.(ErrInvalidConfiguration)
-	return ok
-}
-
 type Type = setting.StorageType
 
 // NewStorageFunc is a function that creates a storage

modules/structs/notifications.go

@@ -68,12 +68,12 @@ const (
 type NotifySubjectType string
 
 const (
-	// NotifySubjectIssue an issue is subject of an notification
+	// NotifySubjectIssue a issue is subject of an notification
 	NotifySubjectIssue NotifySubjectType = "Issue"
-	// NotifySubjectPull an pull is subject of an notification
+	// NotifySubjectPull a pull is subject of an notification
 	NotifySubjectPull NotifySubjectType = "Pull"
-	// NotifySubjectCommit an commit is subject of an notification
+	// NotifySubjectCommit a commit is subject of an notification
 	NotifySubjectCommit NotifySubjectType = "Commit"
-	// NotifySubjectRepository an repository is subject of an notification
+	// NotifySubjectRepository a repository is subject of an notification
 	NotifySubjectRepository NotifySubjectType = "Repository"
 )

modules/structs/pull_review.go

@@ -94,6 +94,11 @@ type CreatePullReviewComment struct {
 	NewLineNum int64 `json:"new_position"`
 }
 
+// CreatePullReviewCommentReplyOptions are options to reply to a pull request review comment
+type CreatePullReviewCommentReplyOptions struct {
+	Body string `json:"body" binding:"Required"`
+}
+
 // SubmitPullReviewOptions are options to submit a pending pull request review
 type SubmitPullReviewOptions struct {
 	Event ReviewStateType `json:"event"`

modules/structs/repo_actions.go

@@ -105,12 +105,18 @@ type ActionArtifact struct {
 
 // ActionWorkflowRun represents a WorkflowRun
 type ActionWorkflowRun struct {
-	ID             int64       `json:"id"`
-	URL            string      `json:"url"`
-	HTMLURL        string      `json:"html_url"`
-	DisplayTitle   string      `json:"display_title"`
-	Path           string      `json:"path"`
-	Event          string      `json:"event"`
+	ID  int64  `json:"id"`
+	URL string `json:"url"`
+	// PreviousAttemptURL is the API URL of the previous attempt of this run, e.g. ".../actions/runs/{run_id}/attempts/{attempt-1}".
+	// It is set only when the current attempt is > 1 (i.e. a rerun). For the first attempt, or for legacy runs that pre-date ActionRunAttempt, it is null.
+	PreviousAttemptURL *string `json:"previous_attempt_url"`
+	HTMLURL            string  `json:"html_url"`
+	DisplayTitle       string  `json:"display_title"`
+	Path               string  `json:"path"`
+	Event              string  `json:"event"`
+	// RunAttempt is 1-based for runs created after ActionRunAttempt was introduced.
+	// A value of 0 is a legacy-only sentinel for runs created before attempts existed
+	// and indicates no corresponding /attempts/{n} resource is available.
 	RunAttempt     int64       `json:"run_attempt"`
 	RunNumber      int64       `json:"run_number"`
 	RepositoryID   int64       `json:"repository_id,omitempty"`

modules/templates/helper_test.go

@@ -5,6 +5,7 @@ package templates
 
 import (
 	"html/template"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -169,9 +170,21 @@ func TestQueryBuild(t *testing.T) {
 	})
 }
 
+const queryNonASCII = " !\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~" // all non-letter & non-number chars
+
 func TestQueryEscape(t *testing.T) {
 	// this test is a reference for "urlQueryEscape" in JS
-	in := "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~" // all non-letter & non-number chars
-	expected := "%21%22%23%24%25%26%27%28%29%2A%2B%2C-.%2F%3A%3B%3C%3D%3E%3F%40%5B%5C%5D%5E_%60%7B%7C%7D~"
-	assert.Equal(t, expected, string(queryEscape(in)))
+	// Special case for space encoding:
+	// * RFC 3986: Uniform Resource Identifier (URI): %20
+	// * WHATWG HTML: application/x-www-form-urlencoded: +
+	// * JavaScript: encodeURIComponent() uses "%20". URLSearchParams uses "+"
+	// * Golang: QueryEscape uses "+"
+	expected := "+%21%22%23%24%25%26%27%28%29%2A%2B%2C-.%2F%3A%3B%3C%3D%3E%3F%40%5B%5C%5D%5E_%60%7B%7C%7D~"
+	assert.Equal(t, expected, url.QueryEscape(queryNonASCII))
+}
+
+func TestPathEscape(t *testing.T) {
+	// this test is a reference for "pathEscape" in JS
+	expected := "%20%21%22%23$%25&%27%28%29%2A+%2C-.%2F:%3B%3C=%3E%3F@%5B%5C%5D%5E_%60%7B%7C%7D~"
+	assert.Equal(t, expected, url.PathEscape(queryNonASCII))
 }

modules/test/utils.go

@@ -47,7 +47,7 @@ func ParseJSONError(buf []byte) (ret struct {
 }
 
 func ParseJSONRedirect(buf []byte) (ret struct {
-	Redirect string `json:"redirect"`
+	Redirect *string `json:"redirect"`
 },
 ) {
 	_ = json.Unmarshal(buf, &ret)

modules/testlogger/testlogger.go

@@ -118,7 +118,7 @@ func PrintCurrentTest(t testing.TB, skip ...int) func() {
 	deferHasRun := false
 	t.Cleanup(func() {
 		if !deferHasRun {
-			stdoutPrintf("!!! %s defer function hasn't been run but Cleanup is called, usually caused by panic\n", t.Name())
+			stdoutPrintf("!!! %s: defer function hasn't been run but Cleanup is called, usually caused by panic\n", t.Name())
 		}
 	})
 	stdoutPrintf("=== %s (%s:%d)\n", log.NewColoredValue(t.Name()), strings.TrimPrefix(filename, prefix), line)
@@ -173,7 +173,8 @@ func Init() {
 	log.RegisterEventWriter("test", newTestLoggerWriter)
 }
 
-func Panicf(format string, args ...any) {
-	// don't call os.Exit, otherwise the "defer" functions won't be executed
-	panic(fmt.Sprintf(format, args...))
+// MainErrorf is used to report an error from TestMain and return a non-zero value to indicate the failure
+func MainErrorf(msg string, a ...any) int {
+	_, _ = fmt.Fprintf(os.Stderr, msg+"\n", a...)
+	return 1
 }

modules/util/util.go

@@ -281,11 +281,13 @@ func EnumValue[T comparable](val EnumConst[T]) (ret T, valid bool) {
 	return enums[0], false
 }
 
-func ReserveLineBreakForTextarea(input string) string {
+func NormalizeStringEOL(input string) string {
 	// Since the content is from a form which is a textarea, the line endings are \r\n.
 	// It's a standard behavior of HTML.
-	// But we want to store them as \n like what GitHub does.
-	// And users are unlikely to really need to keep the \r.
+	// But in most cases, we only want "\n" for EOL
+	// * Text files: use "\n" by default because "\r\n" sometimes doesn't work in POSIX
+	// * Actions values: store them as "\n" like what GitHub does.
+	// And users are unlikely to really need the "\r".
 	// Other than this, we should respect the original content, even leading or trailing spaces.
-	return strings.ReplaceAll(input, "\r\n", "\n")
+	return UnsafeBytesToString(NormalizeEOL(UnsafeStringToBytes(input)))
 }

modules/util/util_test.go

@@ -167,9 +167,9 @@ func TestToTitleCase(t *testing.T) {
 	assert.Equal(t, `Foo Bar Baz`, ToTitleCase(`FOO BAR BAZ`))
 }
 
-func TestReserveLineBreakForTextarea(t *testing.T) {
-	assert.Equal(t, "test\ndata", ReserveLineBreakForTextarea("test\r\ndata"))
-	assert.Equal(t, "test\ndata\n", ReserveLineBreakForTextarea("test\r\ndata\r\n"))
+func TestNormalizeStringEOL(t *testing.T) {
+	assert.Equal(t, "test\ndata", NormalizeStringEOL("test\r\ndata"))
+	assert.Equal(t, " test\ndata\n ", NormalizeStringEOL(" test\rdata\r "))
 }
 
 func TestOptionalArg(t *testing.T) {
@@ -184,3 +184,10 @@ func TestOptionalArg(t *testing.T) {
 	assert.Equal(t, 42, bar(nil))
 	assert.Equal(t, 100, bar(nil, 100))
 }
+
+func TestPathEscapeSegments(t *testing.T) {
+	assert.Equal(t, "a", PathEscapeSegments("a"))
+	assert.Equal(t, "a/b", PathEscapeSegments("a/b"))
+	assert.Equal(t, "a/b%20c", PathEscapeSegments("a/b c"))
+	assert.Equal(t, "a/b+c", PathEscapeSegments("a/b+c"))
+}

modules/validation/binding.go

@@ -13,7 +13,6 @@ import (
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/glob"
 	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
 
 	"gitea.com/go-chi/binding"
 )
@@ -51,7 +50,6 @@ func (j jsonProvider) NewEncoder(writer io.Writer) binding.JSONEncoder {
 func AddBindingRules() {
 	binding.JSONProvider = jsonProvider{}
 	addGitRefNameBindingRule()
-	addValidURLListBindingRule()
 	addValidURLBindingRule()
 	addValidSiteURLBindingRule()
 	addGlobPatternRule()
@@ -80,33 +78,6 @@ func addGitRefNameBindingRule() {
 	})
 }
 
-func addValidURLListBindingRule() {
-	// URL validation rule
-	binding.AddRule(&binding.Rule{
-		IsMatch: func(rule string) bool {
-			return rule == "ValidUrlList"
-		},
-		IsValid: func(errs binding.Errors, name string, val any) (bool, binding.Errors) {
-			str := fmt.Sprintf("%v", val)
-			if len(str) == 0 {
-				errs.Add([]string{name}, binding.ERR_URL, "Url")
-				return false, errs
-			}
-
-			ok := true
-			urls := util.SplitTrimSpace(str, "\n")
-			for _, u := range urls {
-				if !IsValidURL(u) {
-					ok = false
-					errs.Add([]string{name}, binding.ERR_URL, u)
-				}
-			}
-
-			return ok, errs
-		},
-	})
-}
-
 func addValidURLBindingRule() {
 	// URL validation rule
 	binding.AddRule(&binding.Rule{

modules/validation/binding_test.go

@@ -27,7 +27,6 @@ type (
 	TestForm struct {
 		BranchName   string `form:"BranchName" binding:"GitRefName"`
 		URL          string `form:"ValidUrl" binding:"ValidUrl"`
-		URLs         string `form:"ValidUrls" binding:"ValidUrlList"`
 		GlobPattern  string `form:"GlobPattern" binding:"GlobPattern"`
 		RegexPattern string `form:"RegexPattern" binding:"RegexPattern"`
 	}

modules/validation/helpers.go

@@ -4,7 +4,6 @@
 package validation
 
 import (
-	"net"
 	"net/url"
 	"regexp"
 	"slices"
@@ -33,10 +32,6 @@ var globalVars = sync.OnceValue(func() *globalVarsStruct {
 	}
 })
 
-func isLoopbackIP(ip string) bool {
-	return net.ParseIP(ip).IsLoopback()
-}
-
 // IsValidURL checks if URL is valid
 func IsValidURL(uri string) bool {
 	if u, err := url.ParseRequestURI(uri); err != nil ||
@@ -85,36 +80,9 @@ func IsEmailDomainListed(globs []glob.Glob, email string) bool {
 	return false
 }
 
-// IsAPIURL checks if URL is current Gitea instance API URL
-func IsAPIURL(uri string) bool {
-	return strings.HasPrefix(strings.ToLower(uri), strings.ToLower(setting.AppURL+"api"))
-}
-
-// IsValidExternalURL checks if URL is valid external URL
-func IsValidExternalURL(uri string) bool {
-	if !IsValidURL(uri) || IsAPIURL(uri) {
-		return false
-	}
-
-	u, err := url.ParseRequestURI(uri)
-	if err != nil {
-		return false
-	}
-
-	// Currently check only if not loopback IP is provided to keep compatibility
-	if isLoopbackIP(u.Hostname()) || strings.ToLower(u.Hostname()) == "localhost" {
-		return false
-	}
-
-	// TODO: Later it should be added to allow local network IP addresses
-	//       only if allowed by special setting
-
-	return true
-}
-
 // IsValidExternalTrackerURLFormat checks if URL matches required syntax for external trackers
 func IsValidExternalTrackerURLFormat(uri string) bool {
-	if !IsValidExternalURL(uri) {
+	if !IsValidURL(uri) {
 		return false
 	}
 	vars := globalVars()

modules/validation/helpers_test.go

@@ -6,9 +6,6 @@ package validation
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-
 	"github.com/stretchr/testify/assert"
 )
 
@@ -47,51 +44,7 @@ func Test_IsValidURL(t *testing.T) {
 	}
 }
 
-func Test_IsValidExternalURL(t *testing.T) {
-	defer test.MockVariableValue(&setting.AppURL, "https://try.gitea.io/")()
-
-	cases := []struct {
-		description string
-		url         string
-		valid       bool
-	}{
-		{
-			description: "Current instance URL",
-			url:         "https://try.gitea.io/test",
-			valid:       true,
-		},
-		{
-			description: "Loopback IPv4 URL",
-			url:         "http://127.0.1.1:5678/",
-			valid:       false,
-		},
-		{
-			description: "Current instance API URL",
-			url:         "https://try.gitea.io/api/v1/user/follow",
-			valid:       false,
-		},
-		{
-			description: "Local network URL",
-			url:         "http://192.168.1.2/api/v1/user/follow",
-			valid:       true,
-		},
-		{
-			description: "Local URL",
-			url:         "http://LOCALHOST:1234/whatever",
-			valid:       false,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.description, func(t *testing.T) {
-			assert.Equal(t, testCase.valid, IsValidExternalURL(testCase.url))
-		})
-	}
-}
-
 func Test_IsValidExternalTrackerURLFormat(t *testing.T) {
-	defer test.MockVariableValue(&setting.AppURL, "https://try.gitea.io/")()
-
 	cases := []struct {
 		description string
 		url         string
@@ -105,7 +58,7 @@ func Test_IsValidExternalTrackerURLFormat(t *testing.T) {
 		{
 			description: "Local external tracker URL with all placeholders",
 			url:         "https://127.0.0.1/{user}/{repo}/issues/{index}",
-			valid:       false,
+			valid:       true,
 		},
 		{
 			description: "External tracker URL with typo placeholder",

modules/validation/validurllist_test.go

@@ -1,157 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package validation
-
-import (
-	"testing"
-
-	"gitea.com/go-chi/binding"
-)
-
-func Test_ValidURLListValidation(t *testing.T) {
-	AddBindingRules()
-
-	// This is a copy of all the URL tests cases, plus additional ones to
-	// account for multiple URLs
-	urlListValidationTestCases := []validationTestCase{
-		{
-			description: "Empty URL",
-			data: TestForm{
-				URLs: "",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "URL without port",
-			data: TestForm{
-				URLs: "http://test.lan/",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "URL with port",
-			data: TestForm{
-				URLs: "http://test.lan:3000/",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "URL with IPv6 address without port",
-			data: TestForm{
-				URLs: "http://[::1]/",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "URL with IPv6 address with port",
-			data: TestForm{
-				URLs: "http://[::1]:3000/",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "Invalid URL",
-			data: TestForm{
-				URLs: "http//test.lan/",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "http//test.lan/",
-				},
-			},
-		},
-		{
-			description: "Invalid schema",
-			data: TestForm{
-				URLs: "ftp://test.lan/",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "ftp://test.lan/",
-				},
-			},
-		},
-		{
-			description: "Invalid port",
-			data: TestForm{
-				URLs: "http://test.lan:3x4/",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "http://test.lan:3x4/",
-				},
-			},
-		},
-		{
-			description: "Invalid port with IPv6 address",
-			data: TestForm{
-				URLs: "http://[::1]:3x4/",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "http://[::1]:3x4/",
-				},
-			},
-		},
-		{
-			description: "Multi URLs",
-			data: TestForm{
-				URLs: "http://test.lan:3000/\nhttp://test.local/",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "Multi URLs with newline",
-			data: TestForm{
-				URLs: "http://test.lan:3000/\nhttp://test.local/\n",
-			},
-			expectedErrors: binding.Errors{},
-		},
-		{
-			description: "List with invalid entry",
-			data: TestForm{
-				URLs: "http://test.lan:3000/\nhttp://[::1]:3x4/",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "http://[::1]:3x4/",
-				},
-			},
-		},
-		{
-			description: "List with two invalid entries",
-			data: TestForm{
-				URLs: "ftp://test.lan:3000/\nhttp://[::1]:3x4/\n",
-			},
-			expectedErrors: binding.Errors{
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "ftp://test.lan:3000/",
-				},
-				binding.Error{
-					FieldNames:     []string{"URLs"},
-					Classification: binding.ERR_URL,
-					Message:        "http://[::1]:3x4/",
-				},
-			},
-		},
-	}
-
-	for _, testCase := range urlListValidationTestCases {
-		t.Run(testCase.description, func(t *testing.T) {
-			performValidationTest(t, testCase)
-		})
-	}
-}

modules/web/middleware/binding.go

@@ -78,82 +78,97 @@ func GetInclude(field reflect.StructField) string {
 	return getRuleBody(field, "Include(")
 }
 
-// Validate validate
+func ReportValidationError(errs binding.Errors, data map[string]any, fieldName, classification, errorMsg string) binding.Errors {
+	errs.Add([]string{fieldName}, classification, errorMsg)
+
+	data["HasError"] = true
+	data["ErrorMsg"] = fieldName + ": " + errorMsg
+	data["Err_"+fieldName] = true
+	// there is already a reported validation error, so no need to generate default error messages in Validate()
+	data["HasErrorFormValidation"] = true
+	return errs
+}
+
 func Validate(errs binding.Errors, data map[string]any, f Form, l translation.Locale) binding.Errors {
-	if errs.Len() == 0 {
+	// try to restore the form's values as much as possible,
+	// especially for RenderWithErrDeprecated to re-render the form with errors
+	AssignForm(f, data)
+
+	if errs.Len() == 0 || data["HasErrorFormValidation"] == true {
 		return errs
 	}
 
+	// if HasError=true, then must set default error message
+	// because still a lot of places use `ctx.Data["ErrorMsg"].(string)` even if the error fields can't be found
 	data["HasError"] = true
-	// If the field with name errs[0].FieldNames[0] is not found in form
-	// somehow, some code later on will panic on Data["ErrorMsg"].(string).
-	// So initialize it to some default.
-	data["ErrorMsg"] = l.Tr("form.unknown_error")
-	AssignForm(f, data)
+	data["ErrorMsg"] = l.TrString("form.unknown_error")
 
 	typ := reflect.TypeOf(f)
-
 	if typ.Kind() == reflect.Ptr {
 		typ = typ.Elem()
 	}
 
-	if field, ok := typ.FieldByName(errs[0].FieldNames[0]); ok {
-		fieldName := field.Tag.Get("form")
-		if fieldName != "-" {
-			data["Err_"+field.Name] = true
-
-			trName := field.Tag.Get("locale")
-			if len(trName) == 0 {
-				trName = l.TrString("form." + field.Name)
-			} else {
-				trName = l.TrString(trName)
-			}
-
-			switch errs[0].Classification {
-			case binding.ERR_REQUIRED:
-				data["ErrorMsg"] = trName + l.TrString("form.require_error")
-			case binding.ERR_ALPHA_DASH:
-				data["ErrorMsg"] = trName + l.TrString("form.alpha_dash_error")
-			case binding.ERR_ALPHA_DASH_DOT:
-				data["ErrorMsg"] = trName + l.TrString("form.alpha_dash_dot_error")
-			case validation.ErrGitRefName:
-				data["ErrorMsg"] = trName + l.TrString("form.git_ref_name_error")
-			case binding.ERR_SIZE:
-				data["ErrorMsg"] = trName + l.TrString("form.size_error", GetSize(field))
-			case binding.ERR_MIN_SIZE:
-				data["ErrorMsg"] = trName + l.TrString("form.min_size_error", GetMinSize(field))
-			case binding.ERR_MAX_SIZE:
-				data["ErrorMsg"] = trName + l.TrString("form.max_size_error", GetMaxSize(field))
-			case binding.ERR_EMAIL:
-				data["ErrorMsg"] = trName + l.TrString("form.email_error")
-			case binding.ERR_URL:
-				data["ErrorMsg"] = trName + l.TrString("form.url_error", errs[0].Message)
-			case binding.ERR_INCLUDE:
-				data["ErrorMsg"] = trName + l.TrString("form.include_error", GetInclude(field))
-			case validation.ErrGlobPattern:
-				data["ErrorMsg"] = trName + l.TrString("form.glob_pattern_error", errs[0].Message)
-			case validation.ErrRegexPattern:
-				data["ErrorMsg"] = trName + l.TrString("form.regex_pattern_error", errs[0].Message)
-			case validation.ErrUsername:
-				data["ErrorMsg"] = trName + l.TrString("form.username_error")
-			case validation.ErrInvalidGroupTeamMap:
-				data["ErrorMsg"] = trName + l.TrString("form.invalid_group_team_map_error", errs[0].Message)
-			case validation.ErrInvalidBadgeSlug:
-				data["ErrorMsg"] = trName + l.TrString("form.invalid_slug_error")
-			default:
-				msg := errs[0].Classification
-				if msg != "" && errs[0].Message != "" {
-					msg += ": "
-				}
-
-				msg += errs[0].Message
-				if msg == "" {
-					msg = l.TrString("form.unknown_error")
-				}
-				data["ErrorMsg"] = trName + ": " + msg
-			}
-			return errs
-		}
+	field, fieldExists := typ.FieldByName(errs[0].FieldNames[0])
+	if !fieldExists {
+		return errs
 	}
+
+	if field.Tag.Get("form") == "-" {
+		return errs
+	}
+
+	data["Err_"+field.Name] = true
+
+	trName := field.Tag.Get("locale")
+	if len(trName) == 0 {
+		trName = l.TrString("form." + field.Name)
+	} else {
+		trName = l.TrString(trName)
+	}
+
+	switch errs[0].Classification {
+	case binding.ERR_REQUIRED:
+		data["ErrorMsg"] = trName + l.TrString("form.require_error")
+	case binding.ERR_ALPHA_DASH:
+		data["ErrorMsg"] = trName + l.TrString("form.alpha_dash_error")
+	case binding.ERR_ALPHA_DASH_DOT:
+		data["ErrorMsg"] = trName + l.TrString("form.alpha_dash_dot_error")
+	case validation.ErrGitRefName:
+		data["ErrorMsg"] = trName + l.TrString("form.git_ref_name_error")
+	case binding.ERR_SIZE:
+		data["ErrorMsg"] = trName + l.TrString("form.size_error", GetSize(field))
+	case binding.ERR_MIN_SIZE:
+		data["ErrorMsg"] = trName + l.TrString("form.min_size_error", GetMinSize(field))
+	case binding.ERR_MAX_SIZE:
+		data["ErrorMsg"] = trName + l.TrString("form.max_size_error", GetMaxSize(field))
+	case binding.ERR_EMAIL:
+		data["ErrorMsg"] = trName + l.TrString("form.email_error")
+	case binding.ERR_URL:
+		data["ErrorMsg"] = trName + l.TrString("form.url_error", errs[0].Message)
+	case binding.ERR_INCLUDE:
+		data["ErrorMsg"] = trName + l.TrString("form.include_error", GetInclude(field))
+	case validation.ErrGlobPattern:
+		data["ErrorMsg"] = trName + l.TrString("form.glob_pattern_error", errs[0].Message)
+	case validation.ErrRegexPattern:
+		data["ErrorMsg"] = trName + l.TrString("form.regex_pattern_error", errs[0].Message)
+	case validation.ErrUsername:
+		data["ErrorMsg"] = trName + l.TrString("form.username_error")
+	case validation.ErrInvalidGroupTeamMap:
+		data["ErrorMsg"] = trName + l.TrString("form.invalid_group_team_map_error", errs[0].Message)
+	case validation.ErrInvalidBadgeSlug:
+		data["ErrorMsg"] = trName + l.TrString("form.invalid_slug_error")
+	default:
+		msg := errs[0].Classification
+		if msg != "" && errs[0].Message != "" {
+			msg += ": "
+		}
+
+		msg += errs[0].Message
+		if msg == "" {
+			msg = l.TrString("form.unknown_error")
+		}
+		data["ErrorMsg"] = trName + ": " + msg
+	}
+
 	return errs
 }

modules/web/middleware/locale.go

@@ -51,9 +51,3 @@ func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
 func SetLocaleCookie(resp http.ResponseWriter, lang string, maxAge int) {
 	SetSiteCookie(resp, "lang", lang, maxAge)
 }
-
-// DeleteLocaleCookie convenience function to delete the locale cookie consistently
-// Setting the lang cookie will trigger the middleware to reset the language to previous state.
-func DeleteLocaleCookie(resp http.ResponseWriter) {
-	SetSiteCookie(resp, "lang", "", -1)
-}

modules/web/router.go

@@ -13,18 +13,12 @@ import (
 	"code.gitea.io/gitea/modules/reqctx"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/web/middleware"
+	"code.gitea.io/gitea/modules/web/types"
 
 	"gitea.com/go-chi/binding"
 	"github.com/go-chi/chi/v5"
 )
 
-// PreMiddlewareProvider is a special middleware provider which will be executed
-// before other middlewares on the same "routing" level (AfterRouting/Group/Methods/Any, but not BeforeRouting).
-// A route can do something (e.g.: set middleware options) at the place where it is declared,
-// and the code will be executed before other middlewares which are added before the declaration.
-// Use cases: mark a route with some meta info, set some options for middlewares, etc.
-type PreMiddlewareProvider func(next http.Handler) http.Handler
-
 // Bind binding an obj to a handler's context data
 func Bind[T any](_ T) http.HandlerFunc {
 	return func(resp http.ResponseWriter, req *http.Request) {
@@ -112,7 +106,7 @@ func isNilOrFuncNil(v any) bool {
 
 func wrapMiddlewareAppendPre(all []middlewareProvider, middlewares []any) []middlewareProvider {
 	for _, m := range middlewares {
-		if h, ok := m.(PreMiddlewareProvider); ok && h != nil {
+		if h, ok := m.(types.PreMiddlewareProvider); ok && h != nil {
 			all = append(all, toHandlerProvider(middlewareProvider(h)))
 		}
 	}
@@ -121,7 +115,7 @@ func wrapMiddlewareAppendPre(all []middlewareProvider, middlewares []any) []midd
 
 func wrapMiddlewareAppendNormal(all []middlewareProvider, middlewares []any) []middlewareProvider {
 	for _, m := range middlewares {
-		if _, ok := m.(PreMiddlewareProvider); !ok && !isNilOrFuncNil(m) {
+		if _, ok := m.(types.PreMiddlewareProvider); !ok && !isNilOrFuncNil(m) {
 			all = append(all, toHandlerProvider(m))
 		}
 	}

modules/web/router_test.go

@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/modules/web/types"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
@@ -312,12 +313,12 @@ func TestPreMiddlewareProvider(t *testing.T) {
 	root := NewRouter()
 	root.BeforeRouting(h("before-root"))
 	root.AfterRouting(h("root"))
-	root.Get("/a/1", h("mid"), PreMiddlewareProvider(p("pre-root")), h("end1"))
+	root.Get("/a/1", h("mid"), types.PreMiddlewareProvider(p("pre-root")), h("end1"))
 
 	sub := NewRouter()
 	sub.BeforeRouting(h("before-sub"))
 	sub.AfterRouting(h("sub"))
-	sub.Get("/2", h("mid"), PreMiddlewareProvider(p("pre-sub")), h("end2"))
+	sub.Get("/2", h("mid"), types.PreMiddlewareProvider(p("pre-sub")), h("end2"))
 	sub.NotFound(h("not-found"))
 
 	root.Mount("/a", sub)

modules/web/routing/context.go

@@ -10,12 +10,18 @@ import (
 	"code.gitea.io/gitea/modules/gtprof"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/reqctx"
+	"code.gitea.io/gitea/modules/web/types"
 )
 
 type contextKeyType struct{}
 
 var contextKey contextKeyType
 
+func getRequestRecord(ctx context.Context) *requestRecord {
+	record, _ := ctx.Value(contextKey).(*requestRecord)
+	return record
+}
+
 // RecordFuncInfo records a func info into context
 func RecordFuncInfo(ctx context.Context, funcInfo *FuncInfo) (end func()) {
 	end = func() {}
@@ -24,7 +30,7 @@ func RecordFuncInfo(ctx context.Context, funcInfo *FuncInfo) (end func()) {
 		traceSpan, end = gtprof.GetTracer().StartInContext(reqCtx, "http.func")
 		traceSpan.SetAttributeString("func", funcInfo.shortName)
 	}
-	if record, ok := ctx.Value(contextKey).(*requestRecord); ok {
+	if record := getRequestRecord(ctx); record != nil {
 		record.lock.Lock()
 		record.funcInfo = funcInfo
 		record.lock.Unlock()
@@ -32,22 +38,39 @@ func RecordFuncInfo(ctx context.Context, funcInfo *FuncInfo) (end func()) {
 	return end
 }
 
-// MarkLongPolling marks the request is a long-polling request, and the logger may output different message for it
-func MarkLongPolling(resp http.ResponseWriter, req *http.Request) {
-	record, ok := req.Context().Value(contextKey).(*requestRecord)
-	if !ok {
-		return
+func GetRequestRecordInfo(reqCtx context.Context) (ret struct {
+	HasRecord     bool
+	IsLongPolling bool
+},
+) {
+	record := getRequestRecord(reqCtx)
+	if record == nil {
+		return ret
 	}
+	ret.HasRecord = true
+	record.lock.RLock()
+	ret.IsLongPolling = record.isLongPolling
+	record.lock.RUnlock()
+	return ret
+}
 
-	record.lock.Lock()
-	record.isLongPolling = true
-	record.logLevel = log.TRACE
-	record.lock.Unlock()
+// MarkLongPolling marks the request is a long-polling request, and the logger may output different message for it
+func MarkLongPolling() types.PreMiddlewareProvider {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			record := getRequestRecord(req.Context()) // it must exist
+			record.lock.Lock()
+			record.isLongPolling = true
+			record.logLevel = log.TRACE
+			record.lock.Unlock()
+			next.ServeHTTP(w, req)
+		})
+	}
 }
 
 func MarkLogLevelTrace(resp http.ResponseWriter, req *http.Request) {
-	record, ok := req.Context().Value(contextKey).(*requestRecord)
-	if !ok {
+	record := getRequestRecord(req.Context())
+	if record == nil {
 		return
 	}
 
@@ -58,8 +81,8 @@ func MarkLogLevelTrace(resp http.ResponseWriter, req *http.Request) {
 
 // UpdatePanicError updates a context's error info, a panic may be recovered by other middlewares, but we still need to know that.
 func UpdatePanicError(ctx context.Context, err error) {
-	record, ok := ctx.Value(contextKey).(*requestRecord)
-	if !ok {
+	record := getRequestRecord(ctx)
+	if record == nil {
 		return
 	}
 

modules/web/types/premiddleware.go

@@ -0,0 +1,13 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package types
+
+import "net/http"
+
+// PreMiddlewareProvider is a special middleware provider which will be executed
+// before other middlewares on the same "routing" level (AfterRouting/Group/Methods/Any, but not BeforeRouting).
+// A route can do something (e.g.: set middleware options) at the place where it is declared,
+// and the code will be executed before other middlewares which are added before the declaration.
+// Use cases: mark a route with some meta info, set some options for middlewares, etc.
+type PreMiddlewareProvider func(next http.Handler) http.Handler