Allow read/write to user root and only read to group git on documentation (#15041)

Co-authored-by: Lasse Brandt Thomsen <lasse@bitmand.dk>

CHANGELOG.md

@@ -4,12 +4,13 @@ This changelog goes through all the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.io).
 
-## [1.14.0-RC1](https://github.com/go-gitea/gitea/releases/tag/v1.14.0-rc1) - 2021-03-20
+## [1.14.0-RC1](https://github.com/go-gitea/gitea/releases/tag/v1.14.0) - 2021-03-19
 
 * SECURITY
   * Respect approved email domain list for externally validated user registration (#15014)
   * Add reverse proxy configuration support for remote IP address detection (#14959)
   * Ensure validation occurs on clone addresses too (#14994)
+  * Fix several render issues highlighted during fuzzing (#14986)
 * BREAKING
   * Restore Access.log following migration to Chi framework (Stops access logging of /api/internal routes) (#14475)
   * Migrate from Macaron to Chi framework (#14293)

docs/content/doc/installation/from-binary.en-us.md

@@ -79,7 +79,7 @@ chmod 770 /etc/gitea
 chmod 750 /etc/gitea
 chmod 640 /etc/gitea/app.ini
 ```
-If you don't want the web installer to be able to write the config file at all, it is also possible to make the config file read-only for the gitea user (owner/group `root:root`, mode `0660`), and set `INSTALL_LOCK = true`. In that case all database configuration details must be set beforehand in the config file, as well as the `SECRET_KEY` and `INTERNAL_TOKEN` values. See the [command line documentation]({{< relref "doc/usage/command-line.en-us.md" >}}) for information on using `gitea generate secret INTERNAL_TOKEN`.
+If you don't want the web installer to be able to write the config file at all, it is also possible to make the config file read-only for the gitea user (owner/group `root:git`, mode `0640`), and set `INSTALL_LOCK = true`. In that case all database configuration details must be set beforehand in the config file, as well as the `SECRET_KEY` and `INTERNAL_TOKEN` values. See the [command line documentation]({{< relref "doc/usage/command-line.en-us.md" >}}) for information on using `gitea generate secret INTERNAL_TOKEN`.
 
 ### Configure Gitea's working directory
 

go.mod

@@ -128,7 +128,7 @@ require (
 	github.com/xanzy/go-gitlab v0.44.0
 	github.com/xanzy/ssh-agent v0.3.0 // indirect
 	github.com/yohcop/openid-go v1.0.0
-	github.com/yuin/goldmark v1.3.3
+	github.com/yuin/goldmark v1.3.2
 	github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691
 	github.com/yuin/goldmark-meta v1.0.0
 	go.jolheiser.com/hcaptcha v0.0.4

go.sum

@@ -1145,8 +1145,8 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.3 h1:37BdQwPx8VOSic8eDSWee6QL9mRpZRm9VJp/QugNrW0=
+github.com/yuin/goldmark v1.3.2 h1:YjHC5TgyMmHpicTgEqDN0Q96Xo8K6tLXPnmNOHXCgs0=
-github.com/yuin/goldmark v1.3.3/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.3.2/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691 h1:VWSxtAiQNh3zgHJpdpkpVYjTPqRE3P6UZCOPa1nRDio=
 github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691/go.mod h1:YLF3kDffRfUH/bTxOxHhV6lxwIB3Vfj91rEwNMS9MXo=
 github.com/yuin/goldmark-meta v1.0.0 h1:ScsatUIT2gFS6azqzLGUjgOnELsBOxMXerM3ogdJhAM=

vendor/github.com/yuin/goldmark/extension/table.go

@@ -18,9 +18,8 @@ import (
 var escapedPipeCellListKey = parser.NewContextKey()
 
 type escapedPipeCell struct {
-	Cell        *ast.TableCell
+	Cell *ast.TableCell
-	Pos         []int
+	Pos  []int
-	Transformed bool
 }
 
 // TableCellAlignMethod indicates how are table cells aligned in HTML format.indicates how are table cells aligned in HTML format.
@@ -217,7 +216,7 @@ func (b *tableParagraphTransformer) parseRow(segment text.Segment, alignments []
 					break
 				} else if hasBacktick {
 					if escapedCell == nil {
-						escapedCell = &escapedPipeCell{node, []int{}, false}
+						escapedCell = &escapedPipeCell{node, []int{}}
 						escapedList := pc.ComputeIfAbsent(escapedPipeCellListKey,
 							func() interface{} {
 								return []*escapedPipeCell{}
@@ -289,34 +288,22 @@ func (a *tableASTTransformer) Transform(node *gast.Document, reader text.Reader,
 	}
 	pc.Set(escapedPipeCellListKey, nil)
 	for _, v := range lst.([]*escapedPipeCell) {
-		if v.Transformed {
-			continue
-		}
 		_ = gast.Walk(v.Cell, func(n gast.Node, entering bool) (gast.WalkStatus, error) {
-			if !entering || n.Kind() != gast.KindCodeSpan {
+			if n.Kind() != gast.KindCodeSpan {
 				return gast.WalkContinue, nil
 			}
-
+			c := n.FirstChild()
-			for c := n.FirstChild(); c != nil; {
+			for c != nil {
 				next := c.NextSibling()
-				if c.Kind() != gast.KindText {
+				if c.Kind() == gast.KindText {
-					c = next
+					t := c.(*gast.Text)
-					continue
-				}
-				parent := c.Parent()
-				ts := &c.(*gast.Text).Segment
-				n := c
-				for _, v := range lst.([]*escapedPipeCell) {
 					for _, pos := range v.Pos {
-						if ts.Start <= pos && pos < ts.Stop {
+						if t.Segment.Start <= pos && t.Segment.Stop > pos {
-							segment := n.(*gast.Text).Segment
+							n1 := gast.NewRawTextSegment(t.Segment.WithStop(pos))
-							n1 := gast.NewRawTextSegment(segment.WithStop(pos))
+							n2 := gast.NewRawTextSegment(t.Segment.WithStart(pos + 1))
-							n2 := gast.NewRawTextSegment(segment.WithStart(pos + 1))
+							n.InsertAfter(n, c, n1)
-							parent.InsertAfter(parent, n, n1)
+							n.InsertAfter(n, n1, n2)
-							parent.InsertAfter(parent, n1, n2)
+							n.RemoveChild(n, c)
-							parent.RemoveChild(parent, n)
-							n = n2
-							v.Transformed = true
 						}
 					}
 				}

vendor/modules.txt

@@ -798,7 +798,7 @@ github.com/xi2/xz
 # github.com/yohcop/openid-go v1.0.0
 ## explicit
 github.com/yohcop/openid-go
-# github.com/yuin/goldmark v1.3.3
+# github.com/yuin/goldmark v1.3.2
 ## explicit
 github.com/yuin/goldmark
 github.com/yuin/goldmark/ast