The Gitea codebase was logging `Elasticsearch` and `Meilisearch`
connection strings directly to log files without sanitizing them. Since
connection strings often contain credentials in the format
`protocol://username:password@host:port`, this resulted in passwords
being exposed in plain text in log output.
Fix:
- wrapped all instances of setting.Indexer.RepoConnStr and
setting.Indexer.IssueConnStr with the `util.SanitizeCredentialURLs()`
function before logging them.
Fixes: #35530
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Refactor Git command functions to use WithXXX methods instead of
exposing RunOpts.
This change simplifies reuse across gitrepo and improves consistency,
encapsulation, and maintainability of command options.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Allows users to specify a "force" option in API /contents routes when
modifying files in a new branch. When "force" is true, and the branch
already exists, a force push will occur provided the branch does not
have a branch protection rule that disables force pushing.
This is useful as a way to manage a branch remotely through only the
API. For example in an automated release tool you can pull commits,
analyze, and update a release PR branch all remotely without needing to
clone or perform any local git operations.
Resolve#35538
---------
Co-authored-by: Rob Gonnella <rob.gonnella@papayapay.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Implements reliable auto-expand and auto-scroll behavior for the Actions
logs view.
* Expands running or unfinished steps automatically.
* Smoothly scrolls to the latest log line during execution.
* Controlled via existing “Always auto-scroll” and “Expand running
steps” options.
Fixes#35570.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Tag creation/deletion was triggering push webhooks even when branch
filters were configured, causing unintended pipeline executions.
This change modifies the branch filter logic to check the full ref
name directly instead of first determining if it's a "branch" event.
Fixes: Tag events now properly respect branch filters
- Add getPayloadRef() function to extract full ref names
- Update PrepareWebhook() to use direct ref matching
- Prevents refs/tags/* from matching refs/heads/* filters
Closes#35449
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
The merge request file viewer has a button for copying the file path,
but it is not always convenient. Often, you only want to copy the file
name, which is currently not possible. This change request adds this
capability.
---------
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: a.kiselev <a.kiselev@reglab.ru>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This pull request updates the handling of issue label events in
workflows to distinguish between label additions and deletions,
introduces corresponding test cases, and extends the `IssuePayload`
structure to support this functionality.
### Enhancements to issue label event handling:
* Updated `matchIssuesEvent` in `modules/actions/workflows.go` to
differentiate between "labeled" and "unlabeled" events based on whether
labels were added or removed.
* Added a new field, `RemovedLabels`, to the `IssuePayload` struct in
`modules/structs/hook.go` to track labels that were removed during an
issue event.
### Testing improvements:
* Added `TestMatchIssuesEvent` in `modules/actions/workflows_test.go` to
cover scenarios such as label addition, label deletion, and label
clearing, ensuring the correct event type is triggered.
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
wxiaoguangandbadhezi
Zettat123andGitHub
GiteaBot
silverwindandGitHub
dependabot[bot]andGitHub
Steven NoonanandGitHub
6543andGitHub
Fabien BenetouandGitHub
