mirror of
https://github.com/go-gitea/gitea.git
synced 2026-04-20 03:49:11 +02:00
42d294941c
Removes the CSRF cookie in favor of [`CrossOriginProtection`](https://pkg.go.dev/net/http#CrossOriginProtection) which relies purely on HTTP headers. Fixes: https://github.com/go-gitea/gitea/issues/11188 Fixes: https://github.com/go-gitea/gitea/issues/30333 Helps: https://github.com/go-gitea/gitea/issues/35107 TODOs: - [x] Fix tests - [ ] Ideally add tests to validates the protection --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
58 lines
2.7 KiB
Handlebars
58 lines
2.7 KiB
Handlebars
<h4 class="ui top attached header">
|
|
{{ctx.Locale.Tr "settings.edit_oauth2_application"}}
|
|
</h4>
|
|
<div class="ui attached segment">
|
|
<p>{{ctx.Locale.Tr "settings.oauth2_application_create_description"}}</p>
|
|
</div>
|
|
<div class="ui attached segment form ignore-dirty">
|
|
<div class="field">
|
|
<label for="client-id">{{ctx.Locale.Tr "settings.oauth2_client_id"}}</label>
|
|
<input id="client-id" readonly value="{{.App.ClientID}}">
|
|
</div>
|
|
{{if .ClientSecret}}
|
|
<div class="field">
|
|
<label for="client-secret">{{ctx.Locale.Tr "settings.oauth2_client_secret"}}</label>
|
|
<input id="client-secret" type="text" readonly value="{{.ClientSecret}}">
|
|
</div>
|
|
{{else}}
|
|
<div class="field">
|
|
<label for="client-secret">{{ctx.Locale.Tr "settings.oauth2_client_secret"}}</label>
|
|
<input id="client-secret" type="password" readonly value="averysecuresecret">
|
|
</div>
|
|
{{end}}
|
|
<div class="item">
|
|
<!-- TODO add regenerate secret functionality */ -->
|
|
<form class="ui form ignore-dirty" action="{{.FormActionPath}}/regenerate_secret" method="post">
|
|
{{ctx.Locale.Tr "settings.oauth2_regenerate_secret_hint"}}
|
|
<button class="ui mini button tw-ml-2" type="submit">{{ctx.Locale.Tr "settings.oauth2_regenerate_secret"}}</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
<div class="ui bottom attached segment">
|
|
<form class="ui form ignore-dirty" action="{{.FormActionPath}}" method="post">
|
|
<div class="field {{if .Err_AppName}}error{{end}}">
|
|
<label for="application-name">{{ctx.Locale.Tr "settings.oauth2_application_name"}}</label>
|
|
<input id="application-name" value="{{.App.Name}}" name="application_name" required maxlength="255">
|
|
</div>
|
|
<div class="field {{if .Err_RedirectURI}}error{{end}}">
|
|
<label for="redirect-uris">{{ctx.Locale.Tr "settings.oauth2_redirect_uris"}}</label>
|
|
<textarea name="redirect_uris" id="redirect-uris" required>{{StringUtils.Join .App.RedirectURIs "\n"}}</textarea>
|
|
</div>
|
|
<div class="field {{if .Err_ConfidentialClient}}error{{end}}">
|
|
<div class="ui checkbox">
|
|
<label>{{ctx.Locale.Tr "settings.oauth2_confidential_client"}}</label>
|
|
<input class="disable-setting" type="checkbox" name="confidential_client" data-target="#skip-secondary-authorization" {{if .App.ConfidentialClient}}checked{{end}}>
|
|
</div>
|
|
</div>
|
|
<div class="field {{if .Err_SkipSecondaryAuthorization}}error{{end}} {{if .App.ConfidentialClient}}disabled{{end}}" id="skip-secondary-authorization">
|
|
<div class="ui checkbox">
|
|
<label>{{ctx.Locale.Tr "settings.oauth2_skip_secondary_authorization"}}</label>
|
|
<input type="checkbox" name="skip_secondary_authorization" {{if .App.SkipSecondaryAuthorization}}checked{{end}}>
|
|
</div>
|
|
</div>
|
|
<button class="ui primary button">
|
|
{{ctx.Locale.Tr "settings.save_application"}}
|
|
</button>
|
|
</form>
|
|
</div>
|