ci: Also release for other versions than 1 majors (#39475) (#39476)

cmd/web_acme.go

@@ -21,19 +21,8 @@ import (
 	"gitea.dev/modules/util"
 
 	"github.com/caddyserver/certmagic"
-	"github.com/mholt/acmez/v3/acme"
 )
 
-func acmeExternalAccountBinding() (acme.EAB, bool, error) {
-	if setting.AcmeEABKID == "" && setting.AcmeEABHMAC == "" {
-		return acme.EAB{}, false, nil
-	}
-	if setting.AcmeEABKID == "" || setting.AcmeEABHMAC == "" {
-		return acme.EAB{}, false, errors.New("both ACME_EAB_KID and ACME_EAB_HMAC must be set")
-	}
-	return acme.EAB{KeyID: setting.AcmeEABKID, MACKey: setting.AcmeEABHMAC}, true, nil
-}
-
 func getCARoot(path string) (*x509.CertPool, error) {
 	r, err := os.ReadFile(path)
 	if err != nil {
@@ -77,14 +66,6 @@ func runACME(listenAddr string, m http.Handler) error {
 			log.Warn("Failed to parse CA Root certificate, using default CA trust: %v", err)
 		}
 	}
-	externalAccountBinding, hasExternalAccount, err := acmeExternalAccountBinding()
-	if err != nil {
-		return err
-	}
-	var externalAccount *acme.EAB
-	if hasExternalAccount {
-		externalAccount = &externalAccountBinding
-	}
 	// FIXME: this path is not right, it uses "AppWorkPath" incorrectly, and writes the data into "AppWorkPath/https"
 	// Ideally it should migrate to AppDataPath write to "AppDataPath/https"
 	// And one more thing, no idea why we should set the global default variables here
@@ -103,7 +84,6 @@ func runACME(listenAddr string, m http.Handler) error {
 		Email:                   setting.AcmeEmail,
 		Agreed:                  setting.AcmeTOS,
 		Profile:                 setting.AcmeProfile,
-		ExternalAccount:         externalAccount,
 		DisableHTTPChallenge:    !enableHTTPChallenge,
 		DisableTLSALPNChallenge: !enableTLSALPNChallenge,
 		ListenHost:              setting.HTTPAddr,
@@ -120,7 +100,7 @@ func runACME(listenAddr string, m http.Handler) error {
 	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
 	// Prefer keeping the existing cert and retrying renewals asynchronously.
 	ctx := graceful.GetManager().ShutdownContext()
-	err = magic.ManageSync(ctx, []string{setting.AppDomain})
+	err := magic.ManageSync(ctx, []string{setting.AppDomain})
 	if err != nil {
 		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.AppDomain)
 		if cacheErr != nil || cert.Expired() {

cmd/web_acme_test.go

@@ -1,34 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"testing"
-
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
-
-	"github.com/mholt/acmez/v3/acme"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAcmeExternalAccountBinding(t *testing.T) {
-	t.Cleanup(test.MockVariableValue(&setting.AcmeEABKID, ""))
-	t.Cleanup(test.MockVariableValue(&setting.AcmeEABHMAC, ""))
-
-	binding, configured, err := acmeExternalAccountBinding()
-	assert.NoError(t, err)
-	assert.False(t, configured)
-	assert.Empty(t, binding)
-
-	setting.AcmeEABKID = "kid"
-	_, _, err = acmeExternalAccountBinding()
-	assert.ErrorContains(t, err, "both ACME_EAB_KID and ACME_EAB_HMAC must be set")
-
-	setting.AcmeEABHMAC = "hmac"
-	binding, configured, err = acmeExternalAccountBinding()
-	assert.NoError(t, err)
-	assert.True(t, configured)
-	assert.Equal(t, acme.EAB{KeyID: "kid", MACKey: "hmac"}, binding)
-}

custom/conf/app.example.ini

@@ -155,7 +155,7 @@
 ;; Username to use for the builtin SSH server. If blank, then it is the value of RUN_USER.
 ;BUILTIN_SSH_SERVER_USER =
 ;;
-;; Domain name to be exposed in clone URL, defaults to the domain part of ROOT_URL
+;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL
 ;SSH_DOMAIN =
 ;;
 ;; Port number to be exposed in clone URL.
@@ -198,7 +198,7 @@
 ;; For the built-in SSH server, choose the keypair to offer as the host key
 ;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub
 ;; relative paths are made absolute relative to the APP_DATA_PATH
-;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gitea.ed25519, ssh/gitea.ecdsa, ssh/gogs.rsa
+;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gogs.rsa
 ;;
 ;; Enable SSH Authorized Key Backup when rewriting all keys, default is false
 ;SSH_AUTHORIZED_KEYS_BACKUP = false
@@ -237,7 +237,7 @@
 ;SSH_PER_WRITE_PER_KB_TIMEOUT = 30s
 ;;
 ;; Indicate whether to check minimum key size with corresponding type
-;MINIMUM_KEY_SIZE_CHECK = true
+;MINIMUM_KEY_SIZE_CHECK = false
 ;;
 ;; TLS Settings: Either ACME or manual
 ;; (Other common TLS configuration are found before)
@@ -264,11 +264,6 @@
 ;; ACME profile to request from the CA (e.g. "shortlived" for raw-IP certificates)
 ;ACME_PROFILE =
 ;;
-;; External account binding credentials; set both to enable EAB
-;; ACME_EAB_HMAC should be a base64url-encoded MAC key
-;ACME_EAB_KID =
-;ACME_EAB_HMAC =
-;;
 ;; ACME live directory (not to be confused with ACME directory URL: ACME_URL)
 ;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic)
 ;ACME_DIRECTORY = https
@@ -841,7 +836,7 @@ LEVEL = Info
 ;EMAIL_DOMAIN_BLOCKLIST =
 ;;
 ;; Disallow registration, only allow admins to create accounts.
-;DISABLE_REGISTRATION = true
+;DISABLE_REGISTRATION = false
 ;;
 ;; Allow registration only using gitea itself, it works only when DISABLE_REGISTRATION is false
 ;ALLOW_ONLY_INTERNAL_REGISTRATION = false
@@ -973,11 +968,12 @@ LEVEL = Info
 ;; Value for the domain part of the user's email address in the git log if user
 ;; has set KeepEmailPrivate to true. The user's email will be replaced with a
 ;; concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default
-;; value is "noreply." + the domain part of ROOT_URL
-;NO_REPLY_ADDRESS =
+;; value is "noreply." + DOMAIN, where DOMAIN resolves to the value from server.DOMAIN
+;; Note: do not use the <DOMAIN> notation below
+;NO_REPLY_ADDRESS = ; noreply.<DOMAIN>
 ;;
-;; Show Registration button, defaults to true only if both DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are false
-;SHOW_REGISTRATION_BUTTON = false
+;; Show Registration button
+;SHOW_REGISTRATION_BUTTON = true
 ;;
 ;; Show milestones dashboard page - a view of all the user's milestones
 ;SHOW_MILESTONES_DASHBOARD_PAGE = true
@@ -1674,13 +1670,13 @@ LEVEL = Info
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; General queue type, currently support: level, channel, redis, dummy
-;; default to level
-;TYPE = level
+;; General queue queue type, currently support: persistable-channel, channel, level, redis, dummy
+;; default to persistable-channel
+;TYPE = persistable-channel
 ;;
-;; data-dir for storing level queues, individual queues will default to `queues/common` meaning the queue is shared.
+;; data-dir for storing persistable queues and level queues, individual queues will default to `queues/common` meaning the queue is shared.
 ;; Relative paths will be made absolute against "APP_DATA_PATH"
-;DATADIR = queues/common
+;DATADIR = queues/
 ;;
 ;; Default queue length before a channel queue will block
 ;LENGTH = 100000
@@ -1688,7 +1684,7 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
-;; When `TYPE` is `level`, this provides a directory for the underlying leveldb
+;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
 ;; When `TYPE` is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
 ;CONN_STR =
@@ -1756,6 +1752,7 @@ LEVEL = Info
 ;ENABLE_OPENID_SIGNIN = false
 ;;
 ;; Whether to allow registering via OpenID
+;; Do not include to rely on rhw DISABLE_REGISTRATION setting
 ;;ENABLE_OPENID_SIGNUP = false
 ;;
 ;; Allowed URI patterns (POSIX regexp).
@@ -2018,8 +2015,8 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
-;; Default is "file". "db" will reuse the configuration in [database]
-;PROVIDER = file
+;; Default is "memory". "db" will reuse the configuration in [database]
+;PROVIDER = memory
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet

go.mod

@@ -68,7 +68,6 @@ require (
 	github.com/mattn/go-isatty v0.0.24
 	github.com/mattn/go-sqlite3 v1.14.52
 	github.com/meilisearch/meilisearch-go v0.36.3
-	github.com/mholt/acmez/v3 v3.1.6
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.11.2
@@ -200,6 +199,7 @@ require (
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/mholt/acmez/v3 v3.1.6 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect

models/actions/run.go

@@ -295,8 +295,9 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) (runs []*ActionRun, err error) {
-	err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
+	var runs []*ActionRun
+	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
 	return runs, err
 }
 

models/user/search.go

@@ -40,8 +40,8 @@ type SearchUserOptions struct {
 	Keyword       string
 	Types         []UserType
 	UID           int64
-	LoginName     string                 // this option should be used only for admin user
-	SourceID      optional.Option[int64] // this option should be used only for admin user, Some(0) means local users
+	LoginName     string // this option should be used only for admin user
+	SourceID      int64  // this option should be used only for admin user
 	OrderBy       db.SearchOrderBy
 	Visible       []structs.VisibleType
 	Actor         *User // The user doing the search
@@ -106,8 +106,8 @@ func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) db.Session
 		cond = cond.And(builder.Eq{"id": opts.UID})
 	}
 
-	if opts.SourceID.Has() {
-		cond = cond.And(builder.Eq{"login_source": opts.SourceID.Value()})
+	if opts.SourceID > 0 {
+		cond = cond.And(builder.Eq{"login_source": opts.SourceID})
 	}
 	if opts.LoginName != "" {
 		cond = cond.And(builder.Eq{"login_name": opts.LoginName})

modules/charset/escape_stream.go

@@ -8,13 +8,11 @@ import (
 	"fmt"
 	"html"
 	"io"
-	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/translation"
-	"gitea.dev/modules/util"
 )
 
 type htmlChunkReader struct {
@@ -32,10 +30,6 @@ type escapeStreamer struct {
 	ambiguousTables []*AmbiguousTable
 	allowed         map[rune]bool
 
-	tagPartial []byte // partial tag content, used to detect if we are in some tags
-
-	inTagMath bool // MathML operators like U+2212 are intended and wrapping them breaks the math layout
-
 	out io.Writer
 }
 
@@ -68,7 +62,6 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 		for i, part := range parts {
 			if partInTag[i] {
 				lastIsTag = true
-				es.trackHtmlTag(part)
 				if _, err := out.Write(part); err != nil {
 					return nil, err
 				}
@@ -82,11 +75,7 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 						return nil, err
 					}
 				}
-				if es.inTagMath {
-					if _, err := out.Write(part); err != nil {
-						return nil, err
-					}
-				} else if err = es.detectAndWriteRunes(part); err != nil {
+				if err = es.detectAndWriteRunes(part); err != nil {
 					return nil, err
 				}
 			}
@@ -94,34 +83,6 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 	}
 }
 
-// trackHtmlTag receives tag parts, a tag might be split into multiple parts
-func (e *escapeStreamer) trackHtmlTag(part []byte) {
-	const maxHeadLen = 100 // only read the first N bytes of the tag for detection purpose
-	if part[0] == '<' {
-		// start a new tag
-		e.tagPartial = e.tagPartial[:0]
-	}
-	if len(e.tagPartial) >= maxHeadLen {
-		return
-	}
-	e.tagPartial = append(e.tagPartial, part[:min(len(part), maxHeadLen-len(e.tagPartial))]...)
-
-	isTag := func(prefix string) bool {
-		if len(e.tagPartial) < len(prefix)+1 {
-			return false
-		}
-		if !util.AsciiEqualFold(e.tagPartial[:len(prefix)], []byte(prefix)) {
-			return false
-		}
-		return strings.IndexByte(" \t\n\r\f>", e.tagPartial[len(prefix)]) != -1
-	}
-	if isTag("<math") {
-		e.inTagMath = true
-	} else if isTag("</math") {
-		e.inTagMath = false
-	}
-}
-
 func (e *escapeStreamer) trimAndWriteBom(part []byte) ([]byte, error) {
 	remaining, ok := bytes.CutPrefix(part, globalVars().utf8Bom)
 	if ok {

modules/charset/escape_test.go

@@ -141,12 +141,6 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 		result: `O<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:𝐾 [U+1D43E],K [U+004B]"><span class="char">𝐾</span></span>`,
 		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
 	},
-	{
-		name:   "ambiguous in math",
-		text:   "<math><mo>−</mo><mi>b</mi></math> −",
-		result: `<math><mo>−</mo><mi>b</mi></math> <span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:− [U+2212],- [U+002D]"><span class="char">−</span></span>`,
-		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
-	},
 }
 
 func TestEscapeControlReader(t *testing.T) {
@@ -162,24 +156,6 @@ func TestEscapeControlReader(t *testing.T) {
 	}
 }
 
-func TestTrackHtmlTag(t *testing.T) {
-	e := &escapeStreamer{}
-	for _, tt := range []struct {
-		parts  []string
-		inMath bool
-	}{
-		{[]string{"<ma", `TH display="block">`}, true},
-		{[]string{"<mo>"}, true},
-		{[]string{"</MA", "th>"}, false},
-		{[]string{"<mathx>"}, false},
-	} {
-		for _, part := range tt.parts {
-			e.trackHtmlTag([]byte(part))
-		}
-		assert.Equal(t, tt.inMath, e.inTagMath, "%v", tt.parts)
-	}
-}
-
 func TestSettingAmbiguousUnicodeDetection(t *testing.T) {
 	defer test.MockVariableValue(&setting.UI.AmbiguousUnicodeDetection, true)()
 	_, out := EscapeControlHTML("a test", &translation.MockLocale{})

modules/markup/html.go

@@ -349,8 +349,8 @@ func visitNode(ctx *RenderContext, procs []processor, node *html.Node) *html.Nod
 		// TextNode emoji will be converted to `<span class="emoji">`, then the next iteration will visit the "span"
 		// if we don't stop it, it will go into the TextNode again and create an infinite recursion
 		return node.NextSibling
-	} else if node.Data == "code" || node.Data == "pre" || node.Data == "math" {
-		return node.NextSibling // ignore code, pre and math nodes
+	} else if node.Data == "code" || node.Data == "pre" {
+		return node.NextSibling // ignore code and pre nodes
 	} else if node.Data == "img" {
 		return visitNodeImg(ctx, node)
 	} else if node.Data == "video" {

modules/markup/html_test.go

@@ -543,9 +543,6 @@ func TestPostProcess(t *testing.T) {
 		`Some text with <span class="emoji" data-alias="smile">😄</span> in the middle`)
 	test("http://localhost:3000/person/repo/issues/4#issuecomment-1234",
 		`<a href="http://localhost:3000/person/repo/issues/4#issuecomment-1234" class="ref-issue">person/repo#4 (comment)</a>`)
-	test(
-		"<math><mtext>:gitea: go-gitea/gitea#12345</mtext></math>",
-		"<math><mtext>:gitea: go-gitea/gitea#12345</mtext></math>")
 
 	// special tags, GitHub's behavior, and for unclosed tags, output as text content as much as possible
 	test("<script>a", `&lt;script&gt;a`)

modules/setting/server.go

@@ -102,8 +102,6 @@ var (
 	AcmeEmail                  string
 	AcmeURL                    string
 	AcmeProfile                string
-	AcmeEABKID                 string
-	AcmeEABHMAC                string
 	AcmeCARoot                 string
 	SSLMinimumVersion          string
 	SSLMaximumVersion          string
@@ -146,11 +144,6 @@ func loadServerDomainAndURL(sec ConfigSection, protocol string) {
 	AppDomain = appURL.Hostname()
 }
 
-func loadAcmeEABFrom(sec ConfigSection) {
-	AcmeEABKID = sec.Key("ACME_EAB_KID").MustString("")
-	AcmeEABHMAC = sec.Key("ACME_EAB_HMAC").MustString("")
-}
-
 func loadServerFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("server")
 	AppName = rootCfg.Section("").Key("APP_NAME").MustString("Gitea: Git with a cup of tea")
@@ -180,7 +173,6 @@ func loadServerFrom(rootCfg ConfigProvider) {
 		if EnableAcme {
 			AcmeURL = sec.Key("ACME_URL").MustString("")
 			AcmeProfile = sec.Key("ACME_PROFILE").MustString("")
-			loadAcmeEABFrom(sec)
 			AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("")
 
 			if sec.HasKey("ACME_ACCEPTTOS") {
@@ -216,7 +208,6 @@ func loadServerFrom(rootCfg ConfigProvider) {
 				KeyFile = filepath.Join(CustomPath, KeyFile)
 			}
 		}
-
 		SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").MustString("")
 		SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").MustString("")
 		SSLCurvePreferences = sec.Key("SSL_CURVE_PREFERENCES").Strings(",")

modules/setting/server_test.go

@@ -1,29 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package setting
-
-import (
-	"testing"
-
-	"gitea.dev/modules/test"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLoadAcmeEABFrom(t *testing.T) {
-	t.Cleanup(test.MockVariableValue(&AcmeEABKID, ""))
-	t.Cleanup(test.MockVariableValue(&AcmeEABHMAC, ""))
-
-	cfg, err := NewConfigProviderFromData(`
-[server]
-ACME_EAB_KID = kid
-ACME_EAB_HMAC = hmac
-`)
-	assert.NoError(t, err)
-
-	loadAcmeEABFrom(cfg.Section("server"))
-
-	assert.Equal(t, "kid", AcmeEABKID)
-	assert.Equal(t, "hmac", AcmeEABHMAC)
-}

modules/util/string.go

@@ -121,7 +121,7 @@ func asciiLower(b byte) byte {
 
 // AsciiEqualFold is from Golang https://cs.opensource.google/go/go/+/refs/tags/go1.24.4:src/net/http/internal/ascii/print.go
 // ASCII only. In most cases for protocols, we should only use this but not [strings.EqualFold]
-func AsciiEqualFold[T string | []byte](s, t T) bool {
+func AsciiEqualFold(s, t string) bool {
 	if len(s) != len(t) {
 		return false
 	}

modules/web/router_path.go

@@ -5,7 +5,6 @@ package web
 
 import (
 	"net/http"
-	"net/url"
 	"regexp"
 	"slices"
 	"strings"
@@ -20,17 +19,13 @@ type RouterPathGroup struct {
 	r         *Router
 	pathParam string
 	matchers  []*routerPathMatcher
-	unescape  bool
 }
 
 func (g *RouterPathGroup) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
 	chiCtx := chi.RouteContext(req.Context())
 	path := chiCtx.URLParam(g.pathParam)
-	if g.unescape {
-		path, _ = url.PathUnescape(path)
-	}
 	for _, m := range g.matchers {
-		if m.matchPath(chiCtx, path, g.unescape) {
+		if m.matchPath(chiCtx, path) {
 			chiCtx.RoutePatterns = append(chiCtx.RoutePatterns, m.pattern)
 			executeMiddlewaresHandler(resp, req, m.middlewares, m.handlerFunc)
 			return
@@ -58,10 +53,6 @@ func (g *RouterPathGroup) MatchPattern(methods string, pattern *RouterPathGroupP
 	g.matchers = append(g.matchers, newRouterPathMatcher(methods, pattern, h...))
 }
 
-func (g *RouterPathGroup) UseUnescapedPath() {
-	g.unescape = true
-}
-
 type routerPathParam struct {
 	name         string
 	pathSepEnd   bool
@@ -77,7 +68,7 @@ type routerPathMatcher struct {
 	handlerFunc http.HandlerFunc
 }
 
-func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string, unescaped bool) bool {
+func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string) bool {
 	if !p.methods.Contains(chiCtx.RouteMethod) {
 		return false
 	}
@@ -111,9 +102,6 @@ func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string, unescape
 		if p.params[i].pathSepEnd {
 			val = strings.TrimSuffix(val, "/")
 		}
-		if unescaped {
-			val = url.PathEscape(val)
-		}
 		chiCtx.URLParams.Add(p.params[i].name, val)
 	}
 	return true

modules/web/router_test.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"strings"
 	"testing"
 
@@ -98,16 +97,12 @@ func (r *testRecorder) test(t *testing.T, rt *Router, methodPath string, expecte
 }
 
 func TestPathProcessor(t *testing.T) {
-	unescape := false
 	testProcess := func(pattern, uri string, expectedPathParams map[string]string) {
 		chiCtx := chi.NewRouteContext()
 		chiCtx.RouteMethod = "GET"
 		p := newRouterPathMatcher("GET", patternRegexp(pattern), http.NotFound)
 		shouldProcess := expectedPathParams != nil
-		if unescape {
-			uri, _ = url.PathUnescape(uri)
-		}
-		assert.Equal(t, shouldProcess, p.matchPath(chiCtx, uri, unescape), "use pattern %s to process uri %s", pattern, uri)
+		assert.Equal(t, shouldProcess, p.matchPath(chiCtx, uri), "use pattern %s to process uri %s", pattern, uri)
 		assert.Equal(t, expectedPathParams, chiURLParamsToMap(chiCtx), "use pattern %s to process uri %s", pattern, uri)
 	}
 
@@ -124,9 +119,6 @@ func TestPathProcessor(t *testing.T) {
 	testProcess("/<p1:*>/part/<p2>", "/part/c", map[string]string{"p1": "", "p2": "c"})
 	testProcess("/<p1:*>/part/<p2>", "/a/other-part/c", nil)
 	testProcess("/<p1:*>-part/<p2>", "/a-other-part/c", map[string]string{"p1": "a-other", "p2": "c"})
-
-	unescape = true
-	testProcess("/<p1:@/x>", "/%40%2fx", map[string]string{"p1": "@%2Fx"})
 }
 
 func TestRouter(t *testing.T) {

routers/api/packages/api.go

@@ -405,24 +405,37 @@ func CommonRoutes() *web.Router {
 			}, reqPackageAccess(perm.AccessModeRead))
 		})
 		r.Group("/npm", func() {
-			r.Get("/-/v1/search", npm.PackageSearch)
-			r.PathGroup("/*", func(g *web.RouterPathGroup) {
-				// HINT: NPM-ROUTE-PATH-PATTERN: search this keyword to see more details
-				packageId := `/<id:(@` + npm_module.RegexpNamePart + `/)?` + npm_module.RegexpNamePart + ">"
-				g.UseUnescapedPath()
-				g.MatchPath("DELETE", packageId+"/-/<version>/<filename>/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageVersion)
-				g.MatchPath("GET", packageId+"/-/<version>/<filename>", npm.DownloadPackageFile)
-				g.MatchPath("GET", packageId+"/-/<filename>", npm.DownloadPackageFileByName)
-				g.MatchPath("DELETE", packageId+"/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackage)
-				g.MatchPath("PUT", packageId+"/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePreview)
-				g.MatchPath("GET", packageId+"/<version>", npm.PackageVersionMetadata)
-				g.MatchPath("GET", packageId, npm.PackageMetadata)
-				g.MatchPath("PUT", packageId, reqPackageAccess(perm.AccessModeWrite), npm.UploadPackage)
+			// HINT: NPM-ROUTE-PATH-PATTERN: search this keyword to see more details
+			scopeRegexp := `^@` + npm_module.RegexpNamePart + `$`
+			idRegexp := `^(@` + npm_module.RegexpNamePart + `%2[fF])?` + npm_module.RegexpNamePart + `$`
+			addPackageHandlers := func() {
+				r.Get("", npm.PackageMetadata)
+				r.Put("", reqPackageAccess(perm.AccessModeWrite), npm.UploadPackage)
+				r.Get("/{version}", npm.PackageVersionMetadata)
+				r.Group("/-/{version}/{filename}", func() {
+					r.Get("", npm.DownloadPackageFile)
+					r.Delete("/-rev/{revision}", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageVersion)
+				})
+				r.Get("/-/{filename}", npm.DownloadPackageFileByName)
+				r.Group("/-rev/{revision}", func() {
+					r.Delete("", npm.DeletePackage)
+					r.Put("", npm.DeletePreview)
+				}, reqPackageAccess(perm.AccessModeWrite))
+			}
+			r.Group("/{scope:"+scopeRegexp+"}/{id:"+idRegexp+"}", addPackageHandlers)
+			r.Group("/{id:"+idRegexp+"}", addPackageHandlers)
 
-				packageDistTags := "/-/package" + packageId + "/dist-tags"
-				g.MatchPath("GET", packageDistTags, npm.ListPackageTags)
-				g.MatchPath("PUT", packageDistTags+"/<tag>", reqPackageAccess(perm.AccessModeWrite), npm.AddPackageTag)
-				g.MatchPath("DELETE", packageDistTags+"/<tag>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageTag)
+			addPackageDistTagsHandlers := func() {
+				r.Get("", npm.ListPackageTags)
+				r.Group("/{tag}", func() {
+					r.Put("", npm.AddPackageTag)
+					r.Delete("", npm.DeletePackageTag)
+				}, reqPackageAccess(perm.AccessModeWrite))
+			}
+			r.Group("/-/package/{scope:"+scopeRegexp+"}/{id:"+idRegexp+"}/dist-tags", addPackageDistTagsHandlers)
+			r.Group("/-/package/{id:"+idRegexp+"}/dist-tags", addPackageDistTagsHandlers)
+			r.Group("/-/v1/search", func() {
+				r.Get("", npm.PackageSearch)
 			})
 		}, reqPackageAccess(perm.AccessModeRead))
 		r.Group("/pub", func() {

routers/api/packages/npm/npm.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	std_ctx "context"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -43,12 +44,21 @@ func apiError(ctx *context.Context, status int, obj any) {
 
 // packageNameFromParams gets the package name from the url parameters
 func packageNameFromParams(ctx *context.Context) string {
-	// HINT: NPM-ROUTE-PATH-PATTERN: real examples: these cases all should work:
+	// Real examples: these 2 both should work:
 	// * "https://registry.npmjs.org/@angular/core"
 	// * "https://registry.npmjs.org/@angular%2Fcore"
-	// * "https://registry.npmjs.org/%40angular%2Fcore"
 	//
-	return ctx.PathParam("id") // id is the full package name, e.g.: "@angular/core" or "lodash"
+	// HINT: NPM-ROUTE-PATH-PATTERN: The cases for the path parameters:
+	// * ".../TheName/...": id="TheName"
+	// * ".../@TheScope/TheName/...": scope="@TheScope", id="TheName"
+	// * ".../@TheScope%2FTheName/...": id="@TheScope/TheName"
+	scope := ctx.PathParam("scope")
+	fullOrSub := ctx.PathParam("id") // may be a full name or a subpath of the full package name
+	if scope != "" {
+		// now id is the subpath of the full package name, e.g. "core" in "@angular/core"
+		return fmt.Sprintf("%s/%s", scope, fullOrSub)
+	}
+	return fullOrSub // id is the full package name, e.g.: "@angular/core" or "lodash"
 }
 
 func buildNpmRegistryURL(ctx std_ctx.Context, owner *user_model.User) string {

routers/api/v1/admin/user.go

@@ -400,7 +400,7 @@ func SearchUsers(ctx *context.APIContext) {
 	// parameters:
 	// - name: source_id
 	//   in: query
-	//   description: ID of the user's login source to search for, 0 means the local users
+	//   description: ID of the user's login source to search for
 	//   type: integer
 	//   format: int64
 	// - name: login_name
@@ -483,7 +483,7 @@ func SearchUsers(ctx *context.APIContext) {
 		Actor:         ctx.Doer,
 		Types:         []user_model.UserType{user_model.UserTypeIndividual},
 		LoginName:     ctx.FormTrim("login_name"),
-		SourceID:      ctx.FormOptionalInt64("source_id"),
+		SourceID:      ctx.FormInt64("source_id"),
 		Keyword:       ctx.FormTrim("q"),
 		Visible:       visible,
 		OrderBy:       orderBy,

routers/api/v1/repo/file.go

@@ -162,7 +162,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 
 	// if it's not a pointer, just serve the data directly
 	if !pointer.IsValid() {
-		httplib.ServeUserContentByReader(ctx.Req, ctx.Resp, int64(len(lfsPointerBuf)), bytes.NewReader(lfsPointerBuf), httplib.ServeHeaderOptions{Filename: blob.Name()})
+		_, _ = ctx.Resp.Write(lfsPointerBuf)
 		return
 	}
 
@@ -171,7 +171,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 
 	// If there isn't one, just serve the data directly
 	if errors.Is(err, git_model.ErrLFSObjectNotExist) {
-		httplib.ServeUserContentByReader(ctx.Req, ctx.Resp, int64(len(lfsPointerBuf)), bytes.NewReader(lfsPointerBuf), httplib.ServeHeaderOptions{Filename: blob.Name()})
+		_, _ = ctx.Resp.Write(lfsPointerBuf)
 		return
 	} else if err != nil {
 		ctx.APIErrorInternal(err)
@@ -198,7 +198,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 		return
 	}
 	defer lfsDataFile.Close()
-	httplib.ServeUserContentByFile(ctx.Base.Req, ctx.Base.Resp, lfsDataFile, httplib.ServeHeaderOptions{Filename: blob.Name()})
+	httplib.ServeUserContentByFile(ctx.Base.Req, ctx.Base.Resp, lfsDataFile, httplib.ServeHeaderOptions{Filename: ctx.Repo.TreePath})
 }
 
 func getBlobForEntry(ctx *context.APIContext) (blob *git.Blob, entry *git.TreeEntry, lastModified *time.Time) {

routers/api/v1/repo/issue_attachment.go

@@ -386,8 +386,8 @@ func attachmentBelongsToRepoOrIssue(ctx *context.APIContext, attachment *repo_mo
 		ctx.APIErrorNotFound("no such attachment in repo")
 		return false
 	}
-	if attachment.IssueID == 0 || attachment.CommentID != 0 {
-		log.Debug("Requested attachment[%d] is not an issue attachment.", attachment.ID)
+	if attachment.IssueID == 0 {
+		log.Debug("Requested attachment[%d] is not in an issue.", attachment.ID)
 		ctx.APIErrorNotFound("no such attachment in issue")
 		return false
 	} else if issue != nil && attachment.IssueID != issue.ID {

routers/api/v1/repo/mirror.go

@@ -291,11 +291,6 @@ func AddPushMirror(ctx *context.APIContext) {
 		return
 	}
 
-	if setting.Mirror.DisableNewPush {
-		ctx.APIError(http.StatusForbidden, "the site administrator has disabled the creation of new push mirrors")
-		return
-	}
-
 	pushMirror := web.GetForm[*api.CreatePushMirrorOption](ctx)
 	CreatePushMirror(ctx, pushMirror)
 }
@@ -361,7 +356,7 @@ func CreatePushMirror(ctx *context.APIContext, mirrorOption *api.CreatePushMirro
 
 	address, err := git.ParseRemoteAddr(mirrorOption.RemoteAddress, mirrorOption.RemoteUsername, mirrorOption.RemotePassword)
 	if err == nil {
-		err = migrations.IsMigrateURLAllowed(address, ctx.Doer)
+		err = migrations.IsMigrateURLAllowed(address, ctx.ContextUser)
 	}
 	if err != nil {
 		HandleRemoteAddressError(ctx, err)

routers/api/v1/repo/mirror_test.go

@@ -10,36 +10,13 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
-	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
-	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/test"
 	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
 
-func TestCreatePushMirrorUsesCallerPermission(t *testing.T) {
-	defer test.MockVariableValue(&setting.ImportLocalPaths, true)()
-	ctx, resp := contexttest.MockAPIContext(t, "user2/repo1")
-	ctx.Doer = &user_model.User{}
-	ctx.ContextUser = &user_model.User{AllowImportLocal: true}
-
-	CreatePushMirror(ctx, &api.CreatePushMirrorOption{RemoteAddress: "local-mirror", Interval: "0"})
-
-	assert.Equal(t, http.StatusUnauthorized, resp.Code)
-}
-
-func TestAddPushMirrorDisabled(t *testing.T) {
-	defer test.MockVariableValue(&setting.Mirror.DisableNewPush, true)()
-	ctx, resp := contexttest.MockAPIContext(t, "user2/repo1")
-
-	AddPushMirror(ctx)
-
-	assert.Equal(t, http.StatusForbidden, resp.Code)
-	assert.Contains(t, resp.Body.String(), "the site administrator has disabled the creation of new push mirrors")
-}
-
 // TestPushMirrorSync verifies the endpoint attempts every push mirror instead
 // of aborting on the first failure, reporting all failed remotes with a 422.
 // Each remote name is not a configured git remote, so SyncPushMirror fails fast

routers/private/hook_post_receive.go

@@ -139,8 +139,7 @@ func hookPostReceiveUpdateRepoByOptions(ctx *gitea_context.PrivateContext, opts
 	// The repo is empty and being initialized by this push, so there is no
 	// dependent state (webhooks, notifications, visibility fan-out) to reconcile
 	// yet; setting the flags directly is sufficient in this push-to-create case.
-	if isPrivate.Has() && repo.IsPrivate != isPrivate.Value() &&
-		(isPrivate.Value() || !setting.Repository.ForcePrivate || ctx.Doer.IsAdmin) {
+	if isPrivate.Has() && repo.IsPrivate != isPrivate.Value() {
 		repo.IsPrivate = isPrivate.Value()
 		if err := repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_private"); err != nil {
 			log.Error("failed to update repo is_private: %v", err)

routers/web/admin/users.go

@@ -48,13 +48,6 @@ const (
 // UserSearchDefaultAdminSort is the default sort type for admin view
 const UserSearchDefaultAdminSort = "alphabetically"
 
-// authSourceFilterOption is one radio item of the authentication source filter dropdown
-type authSourceFilterOption struct {
-	Value    string
-	Label    string
-	Selected bool
-}
-
 // Users show all the users
 func Users(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("admin.users")
@@ -83,30 +76,6 @@ func Users(ctx *context.Context) {
 		"SortType":        sortType,
 	}
 
-	// inactive sources are listed too, users stay attached to a source after it is deactivated
-	sources, err := db.Find[auth.Source](ctx, auth.FindSourcesOptions{})
-	if err != nil {
-		ctx.ServerError("auth.Sources", err)
-		return
-	}
-	sourceIDFilter := ctx.FormOptionalInt64("source_id")
-	sourceNames := make(map[int64]string, len(sources))
-	authSourceFilterOptions := []*authSourceFilterOption{
-		{Value: "", Label: ctx.Locale.TrString("all"), Selected: !sourceIDFilter.Has()},
-		{Value: "0", Label: ctx.Locale.TrString("admin.users.local"), Selected: sourceIDFilter.Has() && sourceIDFilter.Value() == 0},
-	}
-	for _, source := range sources {
-		sourceNames[source.ID] = source.Name
-		authSourceFilterOptions = append(authSourceFilterOptions, &authSourceFilterOption{
-			Value:    strconv.FormatInt(source.ID, 10),
-			Label:    source.Name,
-			Selected: sourceIDFilter.Has() && sourceIDFilter.Value() == source.ID,
-		})
-	}
-	ctx.Data["HasAuthSources"] = len(sources) > 0
-	ctx.Data["SourceNames"] = sourceNames
-	ctx.Data["AuthSourceFilterOptions"] = authSourceFilterOptions
-
 	explore.RenderUserSearch(ctx, user_model.SearchUserOptions{
 		Actor: ctx.Doer,
 		Types: types,
@@ -119,7 +88,6 @@ func Users(ctx *context.Context) {
 		IsRestricted:       optional.ParseBool(statusFilterMap["is_restricted"]),
 		IsTwoFactorEnabled: optional.ParseBool(statusFilterMap["is_2fa_enabled"]),
 		IsProhibitLogin:    optional.ParseBool(statusFilterMap["is_prohibit_login"]),
-		SourceID:           sourceIDFilter,
 		OrderBy:            db.SearchOrderBy(sortType),
 	}, tplUsers)
 }

routers/web/auth/oauth2_provider.go

@@ -576,7 +576,7 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, server
 	}
 
 	token, err := oauth2_provider.ParseToken(form.RefreshToken, serverKey)
-	if err != nil || token.Kind != oauth2_provider.KindRefreshToken {
+	if err != nil {
 		handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{
 			ErrorCode:        oauth2_provider.AccessTokenErrorCodeUnauthorizedClient,
 			ErrorDescription: "unable to parse refresh token",

routers/web/feed/profile.go

@@ -9,9 +9,7 @@ import (
 	activities_model "gitea.dev/models/activities"
 	"gitea.dev/models/organization"
 	"gitea.dev/models/renderhelper"
-	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/markup/markdown"
-	"gitea.dev/modules/setting"
 	"gitea.dev/services/context"
 	feed_service "gitea.dev/services/feed"
 
@@ -30,15 +28,8 @@ func ShowUserFeedAtom(ctx *context.Context) {
 
 // showUserFeed show user activity as RSS / Atom feed
 func showUserFeed(ctx *context.Context, formatType string) {
-	isOrganisation := ctx.ContextUser.IsOrganization()
-	if !setting.Other.EnableFeed ||
-		isOrganisation && !organization.HasOrgOrUserVisible(ctx, ctx.ContextUser, ctx.Doer) ||
-		!isOrganisation && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
-		ctx.NotFound(nil)
-		return
-	}
-
 	includePrivate := ctx.IsSigned && (ctx.Doer.IsAdmin || ctx.Doer.ID == ctx.ContextUser.ID)
+	isOrganisation := ctx.ContextUser.IsOrganization()
 	if ctx.IsSigned && isOrganisation && !includePrivate {
 		// When feed is requested by a member of the organization,
 		// include the private repo's the member has access to.

routers/web/repo/actions/actions.go

@@ -642,15 +642,7 @@ func (data *actionRunListData) preparePartialRefreshRuns(ctx *context.Context) b
 		ctx.ServerError("GetRunsByRepoAndID", err)
 		return false
 	}
-	runsMap := make(map[int64]*actions_model.ActionRun, len(runs))
-	for _, run := range runs {
-		runsMap[run.ID] = run
-	}
-	for _, id := range data.refreshRunIDs {
-		if run, ok := runsMap[id]; ok {
-			data.ActionRuns = append(data.ActionRuns, run)
-		}
-	}
+	data.ActionRuns = runs
 	return true
 }
 

routers/web/repo/actions/actions_test.go

@@ -15,7 +15,6 @@ import (
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	web_context "gitea.dev/services/context"
-	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -75,17 +74,3 @@ func newWorkflowBadgeTestContext(t *testing.T) *web_context.Context {
 	}
 	return ctx
 }
-
-func TestActionRunListData(t *testing.T) {
-	unittest.PrepareTestEnv(t)
-	t.Run("preparePartialRefreshRuns", func(t *testing.T) {
-		ctx, _ := contexttest.MockContext(t, "user5/repo4/actions")
-		contexttest.LoadRepo(t, ctx, 4)
-		d := &actionRunListData{refreshRunIDs: []int64{791, 792}}
-		d.preparePartialRefreshRuns(ctx)
-		assert.Equal(t, []int64{791, 792}, []int64{d.ActionRuns[0].ID, d.ActionRuns[1].ID})
-		d = &actionRunListData{refreshRunIDs: []int64{792, 791}}
-		d.preparePartialRefreshRuns(ctx)
-		assert.Equal(t, []int64{792, 791}, []int64{d.ActionRuns[0].ID, d.ActionRuns[1].ID})
-	})
-}

routers/web/repo/release.go

@@ -660,11 +660,6 @@ func deleteReleaseOrTag(ctx *context.Context, isDelTag bool) {
 		return
 	}
 
-	if isDelTag && !rel.IsTag {
-		ctx.HTTPError(http.StatusConflict, "a tag attached to a release cannot be deleted directly")
-		return
-	}
-
 	if err := release_service.DeleteReleaseByID(ctx, ctx.Repo.Repository, rel, ctx.Doer, isDelTag); err != nil {
 		if release_service.IsErrProtectedTagName(err) {
 			ctx.Flash.Error(ctx.Tr("repo.release.tag_name_protected"))

routers/web/repo/release_test.go

@@ -4,7 +4,6 @@
 package repo
 
 import (
-	"net/http"
 	"net/http/httptest"
 	"testing"
 
@@ -22,21 +21,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestDeleteTagRetainsReleaseAndAttachments(t *testing.T) {
-	unittest.PrepareTestEnv(t)
-	ctx, resp := contexttest.MockContext(t, "POST user2/repo1/tags/delete?id=1")
-	contexttest.LoadUser(t, ctx, 2)
-	contexttest.LoadRepo(t, ctx, 1)
-	release := unittest.AssertExistsAndLoadBean(t, &repo_model.Release{ID: 1})
-	attachment := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 9, ReleaseID: 1})
-
-	DeleteTag(ctx)
-
-	assert.Equal(t, http.StatusConflict, resp.Code)
-	assert.Equal(t, release, unittest.AssertExistsAndLoadBean(t, &repo_model.Release{ID: 1}))
-	assert.Equal(t, attachment, unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 9}))
-}
-
 func TestNewReleasePost(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 

routers/web/user/home.go

@@ -734,10 +734,18 @@ func UsernameSubRoute(ctx *context.Context) {
 			ShowGPGKeys(ctx)
 		}
 	case strings.HasSuffix(username, ".rss"):
+		if !setting.Other.EnableFeed {
+			ctx.HTTPError(http.StatusNotFound)
+			return
+		}
 		if reloadParam(".rss") {
 			feed.ShowUserFeedRSS(ctx)
 		}
 	case strings.HasSuffix(username, ".atom"):
+		if !setting.Other.EnableFeed {
+			ctx.HTTPError(http.StatusNotFound)
+			return
+		}
 		if reloadParam(".atom") {
 			feed.ShowUserFeedAtom(ctx)
 		}

routers/web/user/profile.go

@@ -322,13 +322,6 @@ func prepareUserProfileTabData(ctx *context.Context, profileDbRepo *repo_model.R
 
 // ActionUserFollow is for follow/unfollow user request
 func ActionUserFollow(ctx *context.Context) {
-	isOrg := ctx.ContextUser.IsOrganization()
-	if isOrg && !organization.HasOrgOrUserVisible(ctx, ctx.ContextUser, ctx.Doer) ||
-		!isOrg && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
-		ctx.NotFound(nil)
-		return
-	}
-
 	var err error
 	switch ctx.FormString("action") {
 	case "follow":

services/migrations/gitea_downloader.go

@@ -107,8 +107,9 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 	if err != nil {
 		log.Info("Unable to get global API settings. Ignoring these.")
 		log.Debug("giteaClient.GetGlobalAPISettings. Error: %v", err)
-	} else if apiConf != nil && apiConf.MaxResponseItems > 0 {
-		maxPerPage = min(apiConf.MaxResponseItems, 100)
+	}
+	if apiConf != nil {
+		maxPerPage = apiConf.MaxResponseItems
 	}
 
 	return &GiteaDownloader{

services/migrations/gitea_downloader_test.go

@@ -5,7 +5,6 @@ package migrations
 
 import (
 	"fmt"
-	"math"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -318,16 +317,15 @@ func TestGiteaDownloadRepo(t *testing.T) {
 
 func TestGiteaDownloadCommentsPaging(t *testing.T) {
 	for _, tc := range []struct {
-		maxResponseItems, pageSize, commentCount, requests int
-		paginated                                          bool
+		maxResponseItems, commentCount, requests int
+		paginated                                bool
 	}{
-		{maxResponseItems: 2, pageSize: 2, commentCount: 2, requests: 2},
-		{maxResponseItems: 2, pageSize: 2, commentCount: 3, requests: 1},
-		{maxResponseItems: 2, pageSize: 2, commentCount: 4, requests: 3, paginated: true},
-		{maxResponseItems: 0, pageSize: 10, commentCount: 0, requests: 1},
-		{maxResponseItems: math.MaxInt, pageSize: 100, commentCount: 0, requests: 1},
+		{maxResponseItems: 2, commentCount: 2, requests: 2},
+		{maxResponseItems: 2, commentCount: 3, requests: 1},
+		{maxResponseItems: 2, commentCount: 4, requests: 3, paginated: true},
+		{maxResponseItems: 0, commentCount: 0, requests: 1},
 	} {
-		t.Run(fmt.Sprintf("maxResponseItems=%d/comments=%d", tc.maxResponseItems, tc.commentCount), func(t *testing.T) {
+		t.Run(strconv.Itoa(tc.commentCount), func(t *testing.T) {
 			commentRequests := 0
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				switch r.URL.Path {
@@ -354,7 +352,6 @@ func TestGiteaDownloadCommentsPaging(t *testing.T) {
 
 			downloader, err := NewGiteaDownloader(t.Context(), server.URL, "o/r", "", "", "")
 			require.NoError(t, err)
-			require.Equal(t, tc.pageSize, downloader.maxPerPage)
 
 			comments, _, err := downloader.GetComments(t.Context(), &base.Issue{Number: 1})
 			require.NoError(t, err)

templates/admin/user/list.tmpl

@@ -47,20 +47,6 @@
 						</div>
 					</div>
 
-					<!-- Authentication Source Filter Menu Item -->
-					{{if .HasAuthSources}}
-						<div class="ui dropdown type jump item">
-							<span class="text">{{ctx.Locale.Tr "admin.users.auth_source"}}</span>
-							{{svg "octicon-triangle-down" 14 "dropdown icon"}}
-							<div class="menu flex-items-menu">
-								{{range $index, $option := .AuthSourceFilterOptions}}
-									{{if eq $index 1}}<div class="divider"></div>{{end}}
-									<label class="item"><input type="radio" name="source_id" value="{{$option.Value}}" {{if $option.Selected}}checked{{end}}> {{$option.Label}}</label>
-								{{end}}
-							</div>
-						</div>
-					{{end}}
-
 					<!-- Sort Menu Item -->
 					<div class="ui dropdown type jump item">
 						<span class="text">
@@ -89,7 +75,6 @@
 							{{SortArrow "alphabetically" "reversealphabetically" $.SortType true}}
 						</th>
 						<th>{{ctx.Locale.Tr "email"}}</th>
-						<th>{{ctx.Locale.Tr "admin.users.auth_source"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.activated"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.restricted"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.2fa"}}</th>
@@ -117,7 +102,6 @@
 								{{template "shared/user/user_type_label" .}}
 							</td>
 							<td class="gt-ellipsis tw-max-w-48">{{.Email}}</td>
-							<td class="gt-ellipsis tw-max-w-32">{{if .LoginSource}}{{index $.SourceNames .LoginSource}}{{else}}{{ctx.Locale.Tr "admin.users.local"}}{{end}}</td>
 							<td>{{svg (Iif .IsActive "octicon-check" "octicon-x")}}</td>
 							<td>{{svg (Iif .IsRestricted "octicon-check" "octicon-x")}}</td>
 							<td>{{svg (Iif (index $.UsersTwoFaStatus .ID) "octicon-check" "octicon-x")}}</td>
@@ -135,7 +119,7 @@
 							</td>
 						</tr>
 					{{else}}
-						<tr class="no-results-row"><td class="tw-text-center" colspan="10">{{ctx.Locale.Tr "no_results_found"}}</td></tr>
+						<tr class="no-results-row"><td class="tw-text-center" colspan="9">{{ctx.Locale.Tr "no_results_found"}}</td></tr>
 					{{end}}
 				</tbody>
 			</table>

templates/swagger/v1-openapi3.generated.json

@@ -11939,7 +11939,7 @@
         "operationId": "adminSearchUsers",
         "parameters": [
           {
-            "description": "ID of the user's login source to search for, 0 means the local users",
+            "description": "ID of the user's login source to search for",
             "in": "query",
             "name": "source_id",
             "schema": {

templates/swagger/v1-swagger.generated.json

@@ -825,7 +825,7 @@
           {
             "type": "integer",
             "format": "int64",
-            "description": "ID of the user's login source to search for, 0 means the local users",
+            "description": "ID of the user's login source to search for",
             "name": "source_id",
             "in": "query"
           },

tests/e2e/admin.test.ts

@@ -17,8 +17,6 @@ test('create a bot and manage its access token', async ({page, request}) => {
   await page.getByRole('row', {name: /^user /}).getByRole('radio', {name: 'Read', exact: true}).check();
   await page.getByRole('button', {name: 'Generate Token'}).click();
   const token = await page.getByRole('code').textContent();
-  await page.getByRole('button', {name: 'Copy', exact: true}).click();
-  await expect.poll(() => page.evaluate(() => navigator.clipboard.readText())).toBe(token);
   const response = await request.get('/api/v1/user', {headers: {Authorization: `token ${token}`}});
   expect(await response.json()).toMatchObject({login: botName, type: 'Bot'});
 

tests/e2e/file-view-render.test.ts

@@ -39,18 +39,6 @@ test('pdf file', async ({page, request}) => {
   await assertFlushWithParent(container, page.locator('.file-view'));
 });
 
-test('code line anchors', async ({page, request}) => {
-  const repoName = `e2e-line-anchor-${randomString(8)}`;
-  const owner = env.GITEA_TEST_E2E_USER;
-  await apiCreateRepo(request, {name: repoName});
-  await apiCreateFiles(request, owner, repoName, [{path: 'test.txt', content: 'a\n'}]);
-  const url = `/${owner}/${repoName}/src/branch/main/test.txt`;
-  await page.goto(`${url}#L0`);
-  await page.goto(`${url}#L1`);
-  await expect(page.locator('.code-view tr.active')).toHaveCount(1);
-  await assertNoJsError(page);
-});
-
 test('asciicast file', async ({page, request}) => {
   const repoName = `e2e-asciicast-render-${randomString(8)}`;
   const owner = env.GITEA_TEST_E2E_USER;

tests/integration/admin_user_test.go

@@ -16,10 +16,8 @@ import (
 	"gitea.dev/modules/setting"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/test"
-	"gitea.dev/services/auth/source/ldap"
 	"gitea.dev/tests"
 
-	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -36,49 +34,6 @@ func TestAdminViewUsers(t *testing.T) {
 	session.MakeRequest(t, req, http.StatusForbidden)
 }
 
-func TestAdminViewUsersFilterAuthSource(t *testing.T) {
-	defer tests.PrepareTestEnv(t)()
-
-	source := &auth_model.Source{Type: auth_model.LDAP, Name: "test-user-list-filter", IsActive: false, Cfg: &ldap.Source{}} // users stay attached to a deactivated source
-	require.NoError(t, auth_model.CreateSource(t.Context(), source))
-
-	user2 := &user_model.User{ID: 2, LoginType: auth_model.LDAP, LoginSource: source.ID}
-	require.NoError(t, user_model.UpdateUserCols(t.Context(), user2, "login_type", "login_source"))
-
-	session := loginUser(t, "user1")
-	listUsers := func(query string) (*HTMLDoc, []string) {
-		req := NewRequest(t, "GET", "/-/admin/users?"+query)
-		resp := session.MakeRequest(t, req, http.StatusOK)
-		doc := NewHTMLParser(t, resp.Body)
-		return doc, doc.Find("table tbody tr td:nth-child(2) a").Map(func(_ int, s *goquery.Selection) string {
-			return s.Text()
-		})
-	}
-
-	doc, users := listUsers("source_id=") // the "All" option submits an empty value
-	AssertHTMLElement(t, doc, `input[name="source_id"][value=""][checked]`, true)
-	assert.Subset(t, users, []string{"user1", "user2"})
-
-	doc, users = listUsers(fmt.Sprintf("source_id=%d", source.ID)) // the "test-user-list-filter" LDAP source
-	AssertHTMLElement(t, doc, fmt.Sprintf(`input[name="source_id"][value="%d"][checked]`, source.ID), true)
-	assert.Equal(t, []string{"user2"}, users)
-	assert.Equal(t, source.Name, doc.Find("table tbody tr td:nth-child(4)").Text())
-
-	_, users = listUsers("source_id=0") // 0 means the "Local" source
-	assert.Contains(t, users, "user1")
-	assert.NotContains(t, users, "user2")
-
-	token := getUserToken(t, "user1", auth_model.AccessTokenScopeReadAdmin)
-	req := NewRequest(t, "GET", "/api/v1/admin/users?source_id=0").AddTokenAuth(token) // the API also treats 0 as local users
-	apiUsers := DecodeJSON(t, MakeRequest(t, req, http.StatusOK), []api.User{})
-	apiUserNames := make([]string, 0, len(apiUsers))
-	for _, u := range apiUsers {
-		apiUserNames = append(apiUserNames, u.UserName)
-	}
-	assert.Contains(t, apiUserNames, "user1")
-	assert.NotContains(t, apiUserNames, "user2")
-}
-
 func TestAdminViewUser(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 

tests/integration/api_issue_attachment_test.go

@@ -38,11 +38,6 @@ func TestAPIGetIssueAttachment(t *testing.T) {
 	apiAttachment := DecodeJSON(t, resp, &api.Attachment{})
 
 	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: apiAttachment.ID, IssueID: issue.ID})
-
-	commentAttachment := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 3, RepoID: repo.ID})
-	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assets/%d", repoOwner.Name, repo.Name, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: commentAttachment.IssueID}).Index, commentAttachment.ID)).
-		AddTokenAuth(token)
-	session.MakeRequest(t, req, http.StatusNotFound)
 }
 
 func TestAPIListIssueAttachments(t *testing.T) {

tests/integration/api_packages_npm_test.go

@@ -170,9 +170,8 @@ func TestPackageNpm(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
 		rootPaths := []string{
-			"/api/packages/user2/npm/@scope/test-package",
-			"/api/packages/user2/npm/@scope%2Ftest-package",
-			"/api/packages/user2/npm/%40scope%2ftest-package",
+			fmt.Sprintf("/api/packages/%s/npm/@scope/test-package", user.Name),
+			fmt.Sprintf("/api/packages/%s/npm/@scope%%2ftest-package", user.Name),
 		}
 		for _, root := range rootPaths {
 			req := NewRequest(t, "GET", fmt.Sprintf("%s/-/%s/%s", root, packageVersion, filename)).AddTokenAuth(token)
@@ -187,7 +186,7 @@ func TestPackageNpm(t *testing.T) {
 		pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeNpm)
 		assert.NoError(t, err)
 		assert.Len(t, pvs, 1)
-		assert.EqualValues(t, 6, pvs[0].DownloadCount)
+		assert.Equal(t, int64(4), pvs[0].DownloadCount)
 	})
 
 	t.Run("PackageMetadata", func(t *testing.T) {

tests/integration/api_repo_file_get_test.go

@@ -22,10 +22,6 @@ func TestAPIGetRawFileOrLFS(t *testing.T) {
 	resp := MakeRequest(t, req, http.StatusOK)
 	assert.Equal(t, "# repo1\n\nDescription for repo1", resp.Body.String())
 
-	req = NewRequest(t, "GET", "/api/v1/repos/user2/repo2/media/test.xml").AddTokenAuth(getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository))
-	resp = MakeRequest(t, req, http.StatusOK)
-	assert.Equal(t, "text/plain; charset=utf-8", resp.Header().Get("Content-Type"))
-
 	// Test with LFS
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		createLFSTestRepository(t, "repo-lfs-test")

tests/integration/git_push_test.go

@@ -16,8 +16,6 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/gitcmd"
-	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"
 	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
@@ -177,14 +175,6 @@ func TestGitPushVisibilityOption(t *testing.T) {
 		doGitPushTestRepository(gitPath, "origin", "branch2", "-o", "repo.private=false")(t)
 		repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repo.ID})
 		assert.True(t, repo.IsPrivate, "repo.private option must be ignored on an existing repository")
-
-		defer test.MockVariableValue(&setting.Repository.ForcePrivate, true)()
-		forcedRepo, err := repo_service.CreateRepository(t.Context(), user, user, repo_service.CreateRepoOptions{Name: "repo-visibility-forced", DefaultBranch: "master", IsPrivate: true})
-		require.NoError(t, err)
-		u.Path = forcedRepo.FullName() + ".git"
-		doGitAddRemote(gitPath, "forced", u)(t)
-		doGitPushTestRepository(gitPath, "forced", "master", "-o", "repo.private=false")(t)
-		assert.True(t, unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: forcedRepo.ID}).IsPrivate)
 	})
 }
 

tests/integration/oauth_test.go

@@ -571,15 +571,6 @@ func testRefreshTokenInvalidation(t *testing.T) {
 	assert.Equal(t, "unauthorized_client", string(parsedError.ErrorCode))
 	assert.Equal(t, "unable to parse refresh token", parsedError.ErrorDescription)
 
-	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
-		"grant_type":    "refresh_token",
-		"client_id":     "da7da3ba-9a13-4167-856f-3899de0b0138",
-		"client_secret": "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=",
-		"redirect_uri":  "https://example.com",
-		"refresh_token": parsed.AccessToken,
-	})
-	MakeRequest(t, req, http.StatusBadRequest)
-
 	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
 		"grant_type":    "refresh_token",
 		"client_id":     "da7da3ba-9a13-4167-856f-3899de0b0138",

tests/integration/user_test.go

@@ -84,7 +84,6 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	org22 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 22})
 	req := NewRequest(t, "GET", "/"+org22.Name)
 	MakeRequest(t, req, http.StatusNotFound)
-	MakeRequest(t, NewRequest(t, "GET", "/"+org22.Name).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
 
 	session := loginUser(t, "user1")
 	oldName := org22.Name
@@ -107,8 +106,6 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	org23 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 23})
 	req = NewRequest(t, "GET", "/"+org23.Name)
 	MakeRequest(t, req, http.StatusNotFound)
-	strangerSession := loginUser(t, "user4")
-	strangerSession.MakeRequest(t, NewRequest(t, "POST", "/"+org23.Name+"?action=follow"), http.StatusNotFound)
 
 	oldName = org23.Name
 	newName = "org23_renamed"
@@ -130,8 +127,6 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	user31 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 31})
 	req = NewRequest(t, "GET", "/"+user31.Name)
 	MakeRequest(t, req, http.StatusNotFound)
-	MakeRequest(t, NewRequest(t, "GET", "/"+user31.Name).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
-	strangerSession.MakeRequest(t, NewRequest(t, "POST", "/"+user31.Name+"?action=follow"), http.StatusNotFound)
 
 	oldName = user31.Name
 	newName = "user31_renamed"
@@ -335,10 +330,6 @@ func testGetUserRss(t *testing.T) {
 	session := loginUser(t, "user2")
 	req = NewRequestf(t, "GET", "/non-existent-user.rss")
 	session.MakeRequest(t, req, http.StatusNotFound)
-
-	defer test.MockVariableValue(&setting.Other.EnableFeed, false)()
-	MakeRequest(t, NewRequestf(t, "GET", "/%s.rss", user34), http.StatusNotFound)
-	MakeRequest(t, NewRequestf(t, "GET", "/%s", user34).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
 }
 
 func testUserListStopWatches(t *testing.T) {

web_src/js/features/repo-code.ts

@@ -58,7 +58,6 @@ function selectRange(range: string): Element | null {
     stopLineNum = tmp;
     range = `${stop}-${start}`;
   }
-  if (startLineNum < 1) return null;
 
   const first = elLineNums[startLineNum - 1] ?? null;
   for (let i = startLineNum - 1; i <= stopLineNum - 1 && i < elLineNums.length; i++) {

web_src/js/modules/clipboard.ts

@@ -64,7 +64,7 @@ function replaceWithFeedbackSvg(origSvg: SVGElement, success: boolean): () => vo
 
 // Enable clipboard copy from HTML attributes. These properties are supported:
 // - data-clipboard-text: Direct text to copy
-// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of other elements will be copied
+// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of <div> will be copied
 export function initGlobalCopyToClipboardListener() {
   document.addEventListener('click', async (e) => {
     const target = (e.target as HTMLElement).closest<HTMLElement>('[data-clipboard-text], [data-clipboard-target]');
@@ -78,8 +78,10 @@ export function initGlobalCopyToClipboardListener() {
       const textTarget = document.querySelector(textSelector)!;
       if (textTarget.nodeName === 'INPUT' || textTarget.nodeName === 'TEXTAREA') {
         text = (textTarget as HTMLInputElement | HTMLTextAreaElement).value;
-      } else {
+      } else if (textTarget.nodeName === 'DIV') {
         text = textTarget.textContent;
+      } else {
+        throw new Error(`Unsupported element for clipboard target: ${textSelector}`);
       }
     }
     // now, text can not be null

web_src/js/modules/errors.test.ts

@@ -17,11 +17,7 @@ test('isGiteaError', () => {
   expect(isGiteaError('', `Error\n    at chrome-extension://abc/content.js:1:1`)).toBe(false);
   expect(isGiteaError('', `Error\n    at https://other-site.com/script.js:1:1`)).toBe(false);
   expect(isGiteaError('', `Error\n    at ${origin}/assets/js/index.abc123.js:1:1`)).toBe(true);
-  expect(isGiteaError('', `Error\n    at ${origin}/web_src/js/index.ts:1:1`)).toBe(false);
   expect(isGiteaError(`${origin}/assets/js/index.js`, `Error\n    at chrome-extension://abc/content.js:1:1`)).toBe(false);
-  vi.spyOn(window.config, 'runModeIsProd', 'get').mockReturnValue(false);
-  expect(isGiteaError('', `Error\n    at ${origin}/web_src/js/index.ts:1:1`)).toBe(true);
-  vi.restoreAllMocks();
 });
 
 test('showGlobalErrorMessage', () => {

web_src/js/modules/errors.ts

@@ -58,7 +58,6 @@ export function isGiteaError(filename: string, stack: string): boolean {
   if (extensionRe.test(filename) || extensionRe.test(stack)) return false;
   const assetBaseUrl = new URL(`${windowConfig()?.assetUrlPrefix}/`, window.location.origin).href;
   if (filename && !filename.startsWith(assetBaseUrl) && !filename.startsWith(window.location.origin)) return false;
-  if (!windowConfig()?.runModeIsProd && stack.includes(`${window.location.origin}/web_src/`)) return true;
   return !stack || stack.includes(assetBaseUrl);
 }