Compare commits

...

10 Commits

Author SHA1 Message Date
Thomas Boerger
e2c8d6fcb2 [1.0] Added 1.0.2 to changelog (#1000)
* Added 1.0.2 to changelog

* Raised version to 1.0.2
2017-02-21 22:39:30 +08:00
Bo-Yi Wu
1a5df9e822 Security: fix XSS attack on alert (#981) 2017-02-19 22:20:15 +08:00
Lunny Xiao
21dc5996a5 Security: fix XSS attack on milestone (#977) 2017-02-19 19:09:32 +08:00
Lunny Xiao
023a6604e2 Handle SetModel error, fixes one errcheck report (#257) (#957) 2017-02-19 10:11:59 +08:00
Lunny Xiao
9a5009a2cc fix docker link on install page (#964) (#972) 2017-02-19 10:11:40 +08:00
Lunny Xiao
3121a7a037 Remove the default console logger when it is not set in the configuration (#602) (#960)
* Remove the default console logger when it is not set in the configuration

* Added comment to new function (lint failure)

* update based on PR comments (code style)

* code style fix (thanks bkcsoft)

* check if logger exists based on the l.outputs (like in l.DelLogger) instead of adapter, otherwise panic when reinstalling gitea (since the output adapter still exist, without outputs)
2017-02-18 22:25:28 +08:00
Lunny Xiao
61cdc32496 fixed bugs on Wiki and resolved #667 (#674) (#958) 2017-02-16 19:32:39 +08:00
Lunny Xiao
5fcf218ed9 Add data directory excluding sessions to dump (#587) (#959) 2017-02-16 17:30:28 +08:00
Lunny Xiao
91836614cd Security: prevent XSS attach on wiki page (#955)
Reported by Miguel Ángel Jimeno.
2017-02-16 17:02:15 +08:00
Lunny Xiao
ab4eb0daf9 bug fixed for issue count (#882) 2017-02-09 18:36:01 +08:00
16 changed files with 141 additions and 45 deletions

View File

@@ -1,5 +1,18 @@
# Changelog
## [1.0.2](https://github.com/go-gitea/gitea/releases/tag/v1.0.2) - 2017-02-21
* BUGFIXES
* Fixed issue counter [#882](https://github.com/go-gitea/gitea/pull/882)
* Fixed XSS vulnerability on wiki page [#955](https://github.com/go-gitea/gitea/pull/955)
* Add data dir without session to dump [#587](https://github.com/go-gitea/gitea/pull/587)
* Fixed wiki page renaming [#958](https://github.com/go-gitea/gitea/pull/958)
* Drop default console logger if not required [#960](https://github.com/go-gitea/gitea/pull/960)
* Fixed docker docs link on install page [#972](https://github.com/go-gitea/gitea/pull/972)
* Handle SetModel errors [#957](https://github.com/go-gitea/gitea/pull/957)
* Fixed XSS vulnerability on milestones [#977](https://github.com/go-gitea/gitea/pull/977)
* Fixed XSS vulnerability on alerts [#981](https://github.com/go-gitea/gitea/pull/981)
## [1.0.1](https://github.com/go-gitea/gitea/releases/tag/v1.0.1) - 2017-01-05
* BUGFIXES

View File

@@ -74,7 +74,9 @@ func runCreateUser(c *cli.Context) error {
setting.NewContext()
models.LoadConfigs()
models.SetEngine()
if err := models.SetEngine(); err != nil {
return fmt.Errorf("models.SetEngine: %v", err)
}
if err := models.CreateUser(&models.User{
Name: c.String("name"),

View File

@@ -11,6 +11,7 @@ import (
"log"
"os"
"path"
"path/filepath"
"time"
"code.gitea.io/gitea/models"
@@ -49,6 +50,7 @@ func runDump(ctx *cli.Context) error {
setting.CustomConf = ctx.String("config")
}
setting.NewContext()
setting.NewServices() // cannot access session settings otherwise
models.LoadConfigs()
models.SetEngine()
@@ -97,6 +99,20 @@ func runDump(ctx *cli.Context) error {
} else {
log.Printf("Custom dir %s doesn't exist, skipped", setting.CustomPath)
}
log.Printf("Packing data directory...%s", setting.AppDataPath)
var sessionAbsPath string
if setting.SessionConfig.Provider == "file" {
if len(setting.SessionConfig.ProviderConfig) == 0 {
setting.SessionConfig.ProviderConfig = "data/sessions"
}
sessionAbsPath, _ = filepath.Abs(setting.SessionConfig.ProviderConfig)
}
if err := zipAddDirectoryExclude(z, "data", setting.AppDataPath, sessionAbsPath); err != nil {
log.Fatalf("Fail to include data directory: %v", err)
}
if err := z.AddDir("log", setting.LogRootPath); err != nil {
log.Fatalf("Fail to include log: %v", err)
}
@@ -119,3 +135,40 @@ func runDump(ctx *cli.Context) error {
return nil
}
// zipAddDirectoryExclude zips absPath to specified zipPath inside z excluding excludeAbsPath
func zipAddDirectoryExclude(zip *zip.ZipArchive, zipPath, absPath string, excludeAbsPath string) error {
absPath, err := filepath.Abs(absPath)
if err != nil {
return err
}
dir, err := os.Open(absPath)
if err != nil {
return err
}
defer dir.Close()
zip.AddEmptyDir(zipPath)
files, err := dir.Readdir(0)
if err != nil {
return err
}
for _, file := range files {
currentAbsPath := path.Join(absPath, file.Name())
currentZipPath := path.Join(zipPath, file.Name())
if file.IsDir() {
if currentAbsPath != excludeAbsPath {
if err = zipAddDirectoryExclude(zip, currentZipPath, currentAbsPath, excludeAbsPath); err != nil {
return err
}
}
} else {
if err = zip.AddFile(currentZipPath, currentAbsPath); err != nil {
return err
}
}
}
return nil
}

View File

@@ -18,7 +18,7 @@ import (
)
// Version holds the current Gitea version
var Version = "1.0.0+dev"
var Version = "1.0.2+dev"
func init() {
runtime.GOMAXPROCS(runtime.NumCPU())

View File

@@ -1279,7 +1279,7 @@ func GetUserIssueStats(repoID, uid int64, repoIDs []int64, filterMode int, isPul
func GetRepoIssueStats(repoID, uid int64, filterMode int, isPull bool) (numOpen int64, numClosed int64) {
countSession := func(isClosed, isPull bool, repoID int64) *xorm.Session {
sess := x.
Where("issue.repo_id = ?", isClosed).
Where("is_closed = ?", isClosed).
And("is_pull = ?", isPull).
And("repo_id = ?", repoID)

View File

@@ -89,7 +89,7 @@ func discardLocalWikiChanges(localPath string) error {
}
// updateWikiPage adds new page to repository wiki.
func (repo *Repository) updateWikiPage(doer *User, oldTitle, title, content, message string, isNew bool) (err error) {
func (repo *Repository) updateWikiPage(doer *User, oldWikiPath, wikiPath, content, message string, isNew bool) (err error) {
wikiWorkingPool.CheckIn(com.ToStr(repo.ID))
defer wikiWorkingPool.CheckOut(com.ToStr(repo.ID))
@@ -104,8 +104,8 @@ func (repo *Repository) updateWikiPage(doer *User, oldTitle, title, content, mes
return fmt.Errorf("UpdateLocalWiki: %v", err)
}
title = ToWikiPageName(title)
filename := path.Join(localPath, title+".md")
title := ToWikiPageName(wikiPath)
filename := path.Join(localPath, wikiPath+".md")
// If not a new file, show perform update not create.
if isNew {
@@ -113,7 +113,7 @@ func (repo *Repository) updateWikiPage(doer *User, oldTitle, title, content, mes
return ErrWikiAlreadyExist{filename}
}
} else {
file := path.Join(localPath, oldTitle+".md")
file := path.Join(localPath, oldWikiPath+".md")
if err := os.Remove(file); err != nil {
return fmt.Errorf("Fail to remove %s: %v", file, err)
@@ -149,19 +149,19 @@ func (repo *Repository) updateWikiPage(doer *User, oldTitle, title, content, mes
return nil
}
// AddWikiPage adds a new wiki page with a given title.
func (repo *Repository) AddWikiPage(doer *User, title, content, message string) error {
return repo.updateWikiPage(doer, "", title, content, message, true)
// AddWikiPage adds a new wiki page with a given wikiPath.
func (repo *Repository) AddWikiPage(doer *User, wikiPath, content, message string) error {
return repo.updateWikiPage(doer, "", wikiPath, content, message, true)
}
// EditWikiPage updates a wiki page identified by its title,
// optionally also changing title.
func (repo *Repository) EditWikiPage(doer *User, oldTitle, title, content, message string) error {
return repo.updateWikiPage(doer, oldTitle, title, content, message, false)
// EditWikiPage updates a wiki page identified by its wikiPath,
// optionally also changing wikiPath.
func (repo *Repository) EditWikiPage(doer *User, oldWikiPath, wikiPath, content, message string) error {
return repo.updateWikiPage(doer, oldWikiPath, wikiPath, content, message, false)
}
// DeleteWikiPage deletes a wiki page identified by its title.
func (repo *Repository) DeleteWikiPage(doer *User, title string) (err error) {
// DeleteWikiPage deletes a wiki page identified by its wikiPath.
func (repo *Repository) DeleteWikiPage(doer *User, wikiPath string) (err error) {
wikiWorkingPool.CheckIn(com.ToStr(repo.ID))
defer wikiWorkingPool.CheckOut(com.ToStr(repo.ID))
@@ -172,13 +172,13 @@ func (repo *Repository) DeleteWikiPage(doer *User, title string) (err error) {
return fmt.Errorf("UpdateLocalWiki: %v", err)
}
title = ToWikiPageName(title)
filename := path.Join(localPath, title+".md")
filename := path.Join(localPath, wikiPath+".md")
if err := os.Remove(filename); err != nil {
return fmt.Errorf("Fail to remove %s: %v", filename, err)
}
title := ToWikiPageName(wikiPath)
message := "Delete page '" + title + "'"
if err = git.AddChanges(localPath, true); err != nil {

View File

@@ -39,6 +39,17 @@ func NewLogger(bufLen int64, mode, config string) {
}
}
// DelLogger removes loggers that are for the given mode
func DelLogger(mode string) error {
for _, l := range loggers {
if _, ok := l.outputs[mode]; ok {
return l.DelLogger(mode)
}
}
Trace("Log adapter %s not found, no need to delete", mode)
return nil
}
// NewGitLogger create a logger for git
// FIXME: use same log level as other loggers.
func NewGitLogger(logPath string) {

View File

@@ -765,6 +765,16 @@ func newLogService() {
LogModes = strings.Split(Cfg.Section("log").Key("MODE").MustString("console"), ",")
LogConfigs = make([]string, len(LogModes))
useConsole := false
for _, mode := range LogModes {
if mode == "console" {
useConsole = true
}
}
if (!useConsole) {
log.DelLogger("console")
}
for i, mode := range LogModes {
mode = strings.TrimSpace(mode)

View File

@@ -15,6 +15,7 @@ import (
"strings"
"time"
"github.com/microcosm-cc/bluemonday"
"golang.org/x/net/html/charset"
"golang.org/x/text/transform"
"gopkg.in/editorconfig/editorconfig-core-go.v1"
@@ -61,6 +62,7 @@ func NewFuncMap() []template.FuncMap {
},
"AvatarLink": base.AvatarLink,
"Safe": Safe,
"Sanitize": bluemonday.UGCPolicy().Sanitize,
"Str2html": Str2html,
"TimeSince": base.TimeSince,
"RawTimeSince": base.RawTimeSince,

View File

@@ -89,7 +89,7 @@ func renderWikiPage(ctx *context.Context, isViewPage bool) (*git.Repository, str
ctx.Data["title"] = pageName
ctx.Data["RequireHighlightJS"] = true
blob, err := commit.GetBlobByPath(pageName + ".md")
blob, err := commit.GetBlobByPath(pageURL + ".md")
if err != nil {
if git.IsErrNotExist(err) {
ctx.Redirect(ctx.Repo.RepoLink + "/wiki/_pages")
@@ -114,7 +114,7 @@ func renderWikiPage(ctx *context.Context, isViewPage bool) (*git.Repository, str
ctx.Data["content"] = string(data)
}
return wikiRepo, pageName
return wikiRepo, pageURL
}
// Wiki render wiki page
@@ -127,13 +127,13 @@ func Wiki(ctx *context.Context) {
return
}
wikiRepo, pageName := renderWikiPage(ctx, true)
wikiRepo, pagePath := renderWikiPage(ctx, true)
if ctx.Written() {
return
}
// Get last change information.
lastCommit, err := wikiRepo.GetCommitByPath(pageName + ".md")
lastCommit, err := wikiRepo.GetCommitByPath(pagePath + ".md")
if err != nil {
ctx.Handle(500, "GetCommitByPath", err)
return
@@ -214,7 +214,9 @@ func NewWikiPost(ctx *context.Context, form auth.NewWikiForm) {
return
}
if err := ctx.Repo.Repository.AddWikiPage(ctx.User, form.Title, form.Content, form.Message); err != nil {
wikiPath := models.ToWikiPageURL(form.Title)
if err := ctx.Repo.Repository.AddWikiPage(ctx.User, wikiPath, form.Content, form.Message); err != nil {
if models.IsErrWikiAlreadyExist(err) {
ctx.Data["Err_Title"] = true
ctx.RenderWithErr(ctx.Tr("repo.wiki.page_already_exists"), tplWikiNew, &form)
@@ -224,7 +226,7 @@ func NewWikiPost(ctx *context.Context, form auth.NewWikiForm) {
return
}
ctx.Redirect(ctx.Repo.RepoLink + "/wiki/" + models.ToWikiPageURL(form.Title))
ctx.Redirect(ctx.Repo.RepoLink + "/wiki/" + wikiPath)
}
// EditWiki render wiki modify page
@@ -257,12 +259,15 @@ func EditWikiPost(ctx *context.Context, form auth.NewWikiForm) {
return
}
if err := ctx.Repo.Repository.EditWikiPage(ctx.User, form.OldTitle, form.Title, form.Content, form.Message); err != nil {
oldWikiPath := ctx.Params(":page")
newWikiPath := models.ToWikiPageURL(form.Title)
if err := ctx.Repo.Repository.EditWikiPage(ctx.User, oldWikiPath, newWikiPath, form.Content, form.Message); err != nil {
ctx.Handle(500, "EditWikiPage", err)
return
}
ctx.Redirect(ctx.Repo.RepoLink + "/wiki/" + models.ToWikiPageURL(form.Title))
ctx.Redirect(ctx.Repo.RepoLink + "/wiki/" + newWikiPath)
}
// DeleteWikiPagePost delete wiki page
@@ -272,8 +277,7 @@ func DeleteWikiPagePost(ctx *context.Context) {
pageURL = "Home"
}
pageName := models.ToWikiPageName(pageURL)
if err := ctx.Repo.Repository.DeleteWikiPage(ctx.User, pageName); err != nil {
if err := ctx.Repo.Repository.DeleteWikiPage(ctx.User, pageURL); err != nil {
ctx.Handle(500, "DeleteWikiPage", err)
return
}

View File

@@ -1,15 +1,15 @@
{{if .Flash.ErrorMsg}}
<div class="ui negative message">
<p>{{.Flash.ErrorMsg | Safe}}</p>
<p>{{.Flash.ErrorMsg | Str2html}}</p>
</div>
{{end}}
{{if .Flash.SuccessMsg}}
<div class="ui positive message">
<p>{{.Flash.SuccessMsg | Safe}}</p>
<p>{{.Flash.SuccessMsg | Str2html}}</p>
</div>
{{end}}
{{if .Flash.InfoMsg}}
<div class="ui info message">
<p>{{.Flash.InfoMsg | Safe}}</p>
<p>{{.Flash.InfoMsg | Str2html}}</p>
</div>
{{end}}

View File

@@ -8,7 +8,7 @@
<div class="ui attached segment">
{{template "base/alert" .}}
<p>{{.i18n.Tr "install.docker_helper" "https://github.com/go-gitea/gitea/tree/master/docker" | Safe}}</p>
<p>{{.i18n.Tr "install.docker_helper" "https://docs.gitea.io/en-us/install-with-docker/" | Safe}}</p>
<form class="ui form" action="{{AppSubUrl}}/install" method="post">
<!-- Dtabase Settings -->

View File

@@ -33,7 +33,7 @@
<div class="menu">
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}">{{.i18n.Tr "repo.issues.filter_label_no_select"}}</a>
{{range .Labels}}
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}"><span class="octicon {{if eq $.SelectLabels .ID}}octicon-check{{end}}"></span><span class="label color" style="background-color: {{.Color}}"></span> {{.Name}}</a>
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}"><span class="octicon {{if eq $.SelectLabels .ID}}octicon-check{{end}}"></span><span class="label color" style="background-color: {{.Color}}"></span> {{.Name | Sanitize}}</a>
{{end}}
</div>
</div>
@@ -47,7 +47,7 @@
<div class="menu">
<a class="item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{.SelectLabels}}&assignee={{$.AssigneeID}}">{{.i18n.Tr "repo.issues.filter_milestone_no_select"}}</a>
{{range .Milestones}}
<a class="{{if eq $.MilestoneID .ID}}active selected{{end}} item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.ID}}&assignee={{$.AssigneeID}}">{{.Name}}</a>
<a class="{{if eq $.MilestoneID .ID}}active selected{{end}} item" href="{{$.Link}}?type={{$.ViewType}}&sort={{$.SortType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.ID}}&assignee={{$.AssigneeID}}">{{.Name | Sanitize}}</a>
{{end}}
</div>
</div>
@@ -105,7 +105,7 @@
<a class="title has-emoji" href="{{$.Link}}/{{.Index}}">{{.Title}}</a>
{{range .Labels}}
<a class="ui label" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name}}</a>
<a class="ui label" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}&milestone={{$.MilestoneID}}&assignee={{$.AssigneeID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name | Sanitize}}</a>
{{end}}
{{if .NumComments}}
@@ -116,7 +116,7 @@
{{$.i18n.Tr "repo.issues.opened_by" $timeStr .Poster.HomeLink .Poster.Name | Safe}}
{{if .Milestone}}
<a class="milestone" href="{{$.Link}}?type={{$.ViewType}}&state={{$.State}}&labels={{$.SelectLabels}}&milestone={{.Milestone.ID}}&assignee={{$.AssigneeID}}">
<span class="octicon octicon-milestone"></span> {{.Milestone.Name}}
<span class="octicon octicon-milestone"></span> {{.Milestone.Name | Sanitize}}
</a>
{{end}}
{{if .Assignee}}

View File

@@ -26,7 +26,7 @@
<div class="milestone list">
{{range .Milestones}}
<li class="item">
<i class="octicon octicon-milestone"></i> <a href="{{$.RepoLink}}/issues?state={{$.State}}&milestone={{.ID}}">{{.Name}}</a>
<i class="octicon octicon-milestone"></i> <a href="{{$.RepoLink}}/issues?state={{$.State}}&milestone={{.ID}}">{{.Name | Sanitize}}</a>
<div class="ui right green progress" data-percent="{{.Completeness}}">
<div class="bar" {{if not .Completeness}}style="background-color: transparent"{{end}}>
<div class="progress"></div>

View File

@@ -263,7 +263,7 @@
<span class="no-select item {{if .HasSelectedLabel}}hide{{end}}">{{.i18n.Tr "repo.issues.new.no_label"}}</span>
{{range .Labels}}
<div class="item">
<a class="ui label {{if not .IsChecked}}hide{{end}}" id="label_{{.ID}}" href="{{$.RepoLink}}/issues?labels={{.ID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name}}</a>
<a class="ui label {{if not .IsChecked}}hide{{end}}" id="label_{{.ID}}" href="{{$.RepoLink}}/issues?labels={{.ID}}" style="color: {{.ForegroundColor}}; background-color: {{.Color}}">{{.Name | Sanitize}}</a>
</div>
{{end}}
@@ -285,7 +285,7 @@
{{.i18n.Tr "repo.issues.new.open_milestone"}}
</div>
{{range .OpenMilestones}}
<div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name}}</div>
<div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name | Sanitize}}</div>
{{end}}
{{end}}
{{if .ClosedMilestones}}
@@ -295,7 +295,7 @@
{{.i18n.Tr "repo.issues.new.closed_milestone"}}
</div>
{{range .ClosedMilestones}}
<a class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name}}</a>
<a class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name | Sanitize}}</a>
{{end}}
{{end}}
</div>
@@ -304,7 +304,7 @@
<span class="no-select item {{if .Issue.Milestone}}hide{{end}}">{{.i18n.Tr "repo.issues.new.no_milestone"}}</span>
<div class="selected">
{{if .Issue.Milestone}}
<a class="item" href="{{.RepoLink}}/issues?milestone={{.Issue.Milestone.ID}}"> {{.Issue.Milestone.Name}}</a>
<a class="item" href="{{.RepoLink}}/issues?milestone={{.Issue.Milestone.ID}}"> {{.Issue.Milestone.Name | Sanitize}}</a>
{{end}}
</div>
</div>

View File

@@ -1,6 +1,7 @@
{{template "base/head" .}}
<div class="repository wiki view">
{{template "repo/header" .}}
{{ $title := .title | Sanitize}}
<div class="ui container">
<div class="ui grid">
<div class="ui ten wide column">
@@ -9,7 +10,7 @@
<div class="ui basic small button">
<span class="text">
{{.i18n.Tr "repo.wiki.page"}}:
<strong>{{.title}}</strong>
<strong>{{$title}}</strong>
</span>
<i class="dropdown icon"></i>
</div>
@@ -20,7 +21,7 @@
</div>
<div class="scrolling menu">
{{range .Pages}}
<div class="item {{if eq $.Title .Name}}selected{{end}}" data-url="{{$.RepoLink}}/wiki/{{.URL}}">{{.Name}}</div>
<div class="item {{if eq $.Title .Name}}selected{{end}}" data-url="{{$.RepoLink}}/wiki/{{.URL}}">{{.Name | Sanitize}}</div>
{{end}}
</div>
</div>
@@ -51,7 +52,7 @@
</div>
</div>
<div class="ui dividing header">
{{.title}}
{{$title}}
{{if and .IsRepositoryWriter (not .Repository.IsMirror)}}
<div class="ui right">
<a class="ui small button" href="{{.RepoLink}}/wiki/{{EscapePound .PageURL}}/_edit">{{.i18n.Tr "repo.wiki.edit_page_button"}}</a>
@@ -76,7 +77,7 @@
{{.i18n.Tr "repo.wiki.delete_page_button"}}
</div>
<div class="content">
<p>{{.i18n.Tr "repo.wiki.delete_page_notice_1" .title | Safe}}</p>
<p>{{.i18n.Tr "repo.wiki.delete_page_notice_1" $title | Safe}}</p>
</div>
{{template "base/delete_modal_actions" .}}
</div>