feat(acme): support EAB credentials

Co-authored-by: techknowlogick <164197+techknowlogick@users.noreply.github.com>

cmd/web_acme.go

@@ -21,8 +21,19 @@ import (
 	"gitea.dev/modules/util"
 
 	"github.com/caddyserver/certmagic"
+	"github.com/mholt/acmez/v3/acme"
 )
 
+func acmeExternalAccountBinding() (*acme.EAB, error) {
+	if setting.AcmeEABKID == "" && setting.AcmeEABHMAC == "" {
+		return nil, nil
+	}
+	if setting.AcmeEABKID == "" || setting.AcmeEABHMAC == "" {
+		return nil, errors.New("both ACME_EAB_KID and ACME_EAB_HMAC must be set")
+	}
+	return &acme.EAB{KeyID: setting.AcmeEABKID, MACKey: setting.AcmeEABHMAC}, nil
+}
+
 func getCARoot(path string) (*x509.CertPool, error) {
 	r, err := os.ReadFile(path)
 	if err != nil {
@@ -66,6 +77,10 @@ func runACME(listenAddr string, m http.Handler) error {
 			log.Warn("Failed to parse CA Root certificate, using default CA trust: %v", err)
 		}
 	}
+	externalAccount, err := acmeExternalAccountBinding()
+	if err != nil {
+		return err
+	}
 	// FIXME: this path is not right, it uses "AppWorkPath" incorrectly, and writes the data into "AppWorkPath/https"
 	// Ideally it should migrate to AppDataPath write to "AppDataPath/https"
 	// And one more thing, no idea why we should set the global default variables here
@@ -84,6 +99,7 @@ func runACME(listenAddr string, m http.Handler) error {
 		Email:                   setting.AcmeEmail,
 		Agreed:                  setting.AcmeTOS,
 		Profile:                 setting.AcmeProfile,
+		ExternalAccount:         externalAccount,
 		DisableHTTPChallenge:    !enableHTTPChallenge,
 		DisableTLSALPNChallenge: !enableTLSALPNChallenge,
 		ListenHost:              setting.HTTPAddr,
@@ -100,7 +116,7 @@ func runACME(listenAddr string, m http.Handler) error {
 	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
 	// Prefer keeping the existing cert and retrying renewals asynchronously.
 	ctx := graceful.GetManager().ShutdownContext()
-	err := magic.ManageSync(ctx, []string{setting.AppDomain})
+	err = magic.ManageSync(ctx, []string{setting.AppDomain})
 	if err != nil {
 		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.AppDomain)
 		if cacheErr != nil || cert.Expired() {

cmd/web_acme_test.go

@@ -0,0 +1,32 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"testing"
+
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+
+	"github.com/mholt/acmez/v3/acme"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAcmeExternalAccountBinding(t *testing.T) {
+	t.Cleanup(test.MockVariableValue(&setting.AcmeEABKID, ""))
+	t.Cleanup(test.MockVariableValue(&setting.AcmeEABHMAC, ""))
+
+	binding, err := acmeExternalAccountBinding()
+	assert.NoError(t, err)
+	assert.Nil(t, binding)
+
+	setting.AcmeEABKID = "kid"
+	_, err = acmeExternalAccountBinding()
+	assert.ErrorContains(t, err, "both ACME_EAB_KID and ACME_EAB_HMAC must be set")
+
+	setting.AcmeEABHMAC = "hmac"
+	binding, err = acmeExternalAccountBinding()
+	assert.NoError(t, err)
+	assert.Equal(t, &acme.EAB{KeyID: "kid", MACKey: "hmac"}, binding)
+}

custom/conf/app.example.ini

@@ -155,7 +155,7 @@
 ;; Username to use for the builtin SSH server. If blank, then it is the value of RUN_USER.
 ;BUILTIN_SSH_SERVER_USER =
 ;;
-;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL
+;; Domain name to be exposed in clone URL, defaults to the domain part of ROOT_URL
 ;SSH_DOMAIN =
 ;;
 ;; Port number to be exposed in clone URL.
@@ -198,7 +198,7 @@
 ;; For the built-in SSH server, choose the keypair to offer as the host key
 ;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub
 ;; relative paths are made absolute relative to the APP_DATA_PATH
-;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gogs.rsa
+;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gitea.ed25519, ssh/gitea.ecdsa, ssh/gogs.rsa
 ;;
 ;; Enable SSH Authorized Key Backup when rewriting all keys, default is false
 ;SSH_AUTHORIZED_KEYS_BACKUP = false
@@ -237,7 +237,7 @@
 ;SSH_PER_WRITE_PER_KB_TIMEOUT = 30s
 ;;
 ;; Indicate whether to check minimum key size with corresponding type
-;MINIMUM_KEY_SIZE_CHECK = false
+;MINIMUM_KEY_SIZE_CHECK = true
 ;;
 ;; TLS Settings: Either ACME or manual
 ;; (Other common TLS configuration are found before)
@@ -264,6 +264,11 @@
 ;; ACME profile to request from the CA (e.g. "shortlived" for raw-IP certificates)
 ;ACME_PROFILE =
 ;;
+;; External account binding credentials; set both to enable EAB
+;; ACME_EAB_HMAC should be a base64url-encoded MAC key
+;ACME_EAB_KID =
+;ACME_EAB_HMAC =
+;;
 ;; ACME live directory (not to be confused with ACME directory URL: ACME_URL)
 ;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic)
 ;ACME_DIRECTORY = https
@@ -836,7 +841,7 @@ LEVEL = Info
 ;EMAIL_DOMAIN_BLOCKLIST =
 ;;
 ;; Disallow registration, only allow admins to create accounts.
-;DISABLE_REGISTRATION = false
+;DISABLE_REGISTRATION = true
 ;;
 ;; Allow registration only using gitea itself, it works only when DISABLE_REGISTRATION is false
 ;ALLOW_ONLY_INTERNAL_REGISTRATION = false
@@ -968,12 +973,11 @@ LEVEL = Info
 ;; Value for the domain part of the user's email address in the git log if user
 ;; has set KeepEmailPrivate to true. The user's email will be replaced with a
 ;; concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default
-;; value is "noreply." + DOMAIN, where DOMAIN resolves to the value from server.DOMAIN
-;; Note: do not use the <DOMAIN> notation below
-;NO_REPLY_ADDRESS = ; noreply.<DOMAIN>
+;; value is "noreply." + the domain part of ROOT_URL
+;NO_REPLY_ADDRESS =
 ;;
-;; Show Registration button
-;SHOW_REGISTRATION_BUTTON = true
+;; Show Registration button, defaults to true only if both DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are false
+;SHOW_REGISTRATION_BUTTON = false
 ;;
 ;; Show milestones dashboard page - a view of all the user's milestones
 ;SHOW_MILESTONES_DASHBOARD_PAGE = true
@@ -1670,13 +1674,13 @@ LEVEL = Info
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; General queue queue type, currently support: persistable-channel, channel, level, redis, dummy
-;; default to persistable-channel
-;TYPE = persistable-channel
+;; General queue type, currently support: level, channel, redis, dummy
+;; default to level
+;TYPE = level
 ;;
-;; data-dir for storing persistable queues and level queues, individual queues will default to `queues/common` meaning the queue is shared.
+;; data-dir for storing level queues, individual queues will default to `queues/common` meaning the queue is shared.
 ;; Relative paths will be made absolute against "APP_DATA_PATH"
-;DATADIR = queues/
+;DATADIR = queues/common
 ;;
 ;; Default queue length before a channel queue will block
 ;LENGTH = 100000
@@ -1684,7 +1688,7 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
-;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
+;; When `TYPE` is `level`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
 ;; When `TYPE` is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
 ;CONN_STR =
@@ -1752,7 +1756,6 @@ LEVEL = Info
 ;ENABLE_OPENID_SIGNIN = false
 ;;
 ;; Whether to allow registering via OpenID
-;; Do not include to rely on rhw DISABLE_REGISTRATION setting
 ;;ENABLE_OPENID_SIGNUP = false
 ;;
 ;; Allowed URI patterns (POSIX regexp).
@@ -2015,8 +2018,8 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
-;; Default is "memory". "db" will reuse the configuration in [database]
-;PROVIDER = memory
+;; Default is "file". "db" will reuse the configuration in [database]
+;PROVIDER = file
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet

go.mod

@@ -68,6 +68,7 @@ require (
 	github.com/mattn/go-isatty v0.0.24
 	github.com/mattn/go-sqlite3 v1.14.52
 	github.com/meilisearch/meilisearch-go v0.36.3
+	github.com/mholt/acmez/v3 v3.1.6
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.11.2
@@ -199,7 +200,6 @@ require (
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-runewidth v0.0.24 // indirect
-	github.com/mholt/acmez/v3 v3.1.6 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect

models/actions/run.go

@@ -295,9 +295,8 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
-	var runs []*ActionRun
-	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) (runs []*ActionRun, err error) {
+	err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
 	return runs, err
 }
 

models/user/search.go

@@ -40,8 +40,8 @@ type SearchUserOptions struct {
 	Keyword       string
 	Types         []UserType
 	UID           int64
-	LoginName     string // this option should be used only for admin user
-	SourceID      int64  // this option should be used only for admin user
+	LoginName     string                 // this option should be used only for admin user
+	SourceID      optional.Option[int64] // this option should be used only for admin user, Some(0) means local users
 	OrderBy       db.SearchOrderBy
 	Visible       []structs.VisibleType
 	Actor         *User // The user doing the search
@@ -106,8 +106,8 @@ func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) db.Session
 		cond = cond.And(builder.Eq{"id": opts.UID})
 	}
 
-	if opts.SourceID > 0 {
-		cond = cond.And(builder.Eq{"login_source": opts.SourceID})
+	if opts.SourceID.Has() {
+		cond = cond.And(builder.Eq{"login_source": opts.SourceID.Value()})
 	}
 	if opts.LoginName != "" {
 		cond = cond.And(builder.Eq{"login_name": opts.LoginName})

modules/charset/escape_stream.go

@@ -8,11 +8,13 @@ import (
 	"fmt"
 	"html"
 	"io"
+	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 type htmlChunkReader struct {
@@ -30,6 +32,10 @@ type escapeStreamer struct {
 	ambiguousTables []*AmbiguousTable
 	allowed         map[rune]bool
 
+	tagPartial []byte // partial tag content, used to detect if we are in some tags
+
+	inTagMath bool // MathML operators like U+2212 are intended and wrapping them breaks the math layout
+
 	out io.Writer
 }
 
@@ -62,6 +68,7 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 		for i, part := range parts {
 			if partInTag[i] {
 				lastIsTag = true
+				es.trackHtmlTag(part)
 				if _, err := out.Write(part); err != nil {
 					return nil, err
 				}
@@ -75,7 +82,11 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 						return nil, err
 					}
 				}
-				if err = es.detectAndWriteRunes(part); err != nil {
+				if es.inTagMath {
+					if _, err := out.Write(part); err != nil {
+						return nil, err
+					}
+				} else if err = es.detectAndWriteRunes(part); err != nil {
 					return nil, err
 				}
 			}
@@ -83,6 +94,34 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 	}
 }
 
+// trackHtmlTag receives tag parts, a tag might be split into multiple parts
+func (e *escapeStreamer) trackHtmlTag(part []byte) {
+	const maxHeadLen = 100 // only read the first N bytes of the tag for detection purpose
+	if part[0] == '<' {
+		// start a new tag
+		e.tagPartial = e.tagPartial[:0]
+	}
+	if len(e.tagPartial) >= maxHeadLen {
+		return
+	}
+	e.tagPartial = append(e.tagPartial, part[:min(len(part), maxHeadLen-len(e.tagPartial))]...)
+
+	isTag := func(prefix string) bool {
+		if len(e.tagPartial) < len(prefix)+1 {
+			return false
+		}
+		if !util.AsciiEqualFold(e.tagPartial[:len(prefix)], []byte(prefix)) {
+			return false
+		}
+		return strings.IndexByte(" \t\n\r\f>", e.tagPartial[len(prefix)]) != -1
+	}
+	if isTag("<math") {
+		e.inTagMath = true
+	} else if isTag("</math") {
+		e.inTagMath = false
+	}
+}
+
 func (e *escapeStreamer) trimAndWriteBom(part []byte) ([]byte, error) {
 	remaining, ok := bytes.CutPrefix(part, globalVars().utf8Bom)
 	if ok {

modules/charset/escape_test.go

@@ -141,6 +141,12 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 		result: `O<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:𝐾 [U+1D43E],K [U+004B]"><span class="char">𝐾</span></span>`,
 		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
 	},
+	{
+		name:   "ambiguous in math",
+		text:   "<math><mo>−</mo><mi>b</mi></math> −",
+		result: `<math><mo>−</mo><mi>b</mi></math> <span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:− [U+2212],- [U+002D]"><span class="char">−</span></span>`,
+		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
+	},
 }
 
 func TestEscapeControlReader(t *testing.T) {
@@ -156,6 +162,24 @@ func TestEscapeControlReader(t *testing.T) {
 	}
 }
 
+func TestTrackHtmlTag(t *testing.T) {
+	e := &escapeStreamer{}
+	for _, tt := range []struct {
+		parts  []string
+		inMath bool
+	}{
+		{[]string{"<ma", `TH display="block">`}, true},
+		{[]string{"<mo>"}, true},
+		{[]string{"</MA", "th>"}, false},
+		{[]string{"<mathx>"}, false},
+	} {
+		for _, part := range tt.parts {
+			e.trackHtmlTag([]byte(part))
+		}
+		assert.Equal(t, tt.inMath, e.inTagMath, "%v", tt.parts)
+	}
+}
+
 func TestSettingAmbiguousUnicodeDetection(t *testing.T) {
 	defer test.MockVariableValue(&setting.UI.AmbiguousUnicodeDetection, true)()
 	_, out := EscapeControlHTML("a test", &translation.MockLocale{})

modules/markup/html.go

@@ -349,8 +349,8 @@ func visitNode(ctx *RenderContext, procs []processor, node *html.Node) *html.Nod
 		// TextNode emoji will be converted to `<span class="emoji">`, then the next iteration will visit the "span"
 		// if we don't stop it, it will go into the TextNode again and create an infinite recursion
 		return node.NextSibling
-	} else if node.Data == "code" || node.Data == "pre" {
-		return node.NextSibling // ignore code and pre nodes
+	} else if node.Data == "code" || node.Data == "pre" || node.Data == "math" {
+		return node.NextSibling // ignore code, pre and math nodes
 	} else if node.Data == "img" {
 		return visitNodeImg(ctx, node)
 	} else if node.Data == "video" {

modules/markup/html_test.go

@@ -543,6 +543,9 @@ func TestPostProcess(t *testing.T) {
 		`Some text with <span class="emoji" data-alias="smile">😄</span> in the middle`)
 	test("http://localhost:3000/person/repo/issues/4#issuecomment-1234",
 		`<a href="http://localhost:3000/person/repo/issues/4#issuecomment-1234" class="ref-issue">person/repo#4 (comment)</a>`)
+	test(
+		"<math><mtext>:gitea: go-gitea/gitea#12345</mtext></math>",
+		"<math><mtext>:gitea: go-gitea/gitea#12345</mtext></math>")
 
 	// special tags, GitHub's behavior, and for unclosed tags, output as text content as much as possible
 	test("<script>a", `&lt;script&gt;a`)

modules/setting/server.go

@@ -102,6 +102,8 @@ var (
 	AcmeEmail                  string
 	AcmeURL                    string
 	AcmeProfile                string
+	AcmeEABKID                 string
+	AcmeEABHMAC                string
 	AcmeCARoot                 string
 	SSLMinimumVersion          string
 	SSLMaximumVersion          string
@@ -144,6 +146,11 @@ func loadServerDomainAndURL(sec ConfigSection, protocol string) {
 	AppDomain = appURL.Hostname()
 }
 
+func loadAcmeEABFrom(sec ConfigSection) {
+	AcmeEABKID = sec.Key("ACME_EAB_KID").MustString("")
+	AcmeEABHMAC = sec.Key("ACME_EAB_HMAC").MustString("")
+}
+
 func loadServerFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("server")
 	AppName = rootCfg.Section("").Key("APP_NAME").MustString("Gitea: Git with a cup of tea")
@@ -173,6 +180,7 @@ func loadServerFrom(rootCfg ConfigProvider) {
 		if EnableAcme {
 			AcmeURL = sec.Key("ACME_URL").MustString("")
 			AcmeProfile = sec.Key("ACME_PROFILE").MustString("")
+			loadAcmeEABFrom(sec)
 			AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("")
 
 			if sec.HasKey("ACME_ACCEPTTOS") {
@@ -208,6 +216,7 @@ func loadServerFrom(rootCfg ConfigProvider) {
 				KeyFile = filepath.Join(CustomPath, KeyFile)
 			}
 		}
+
 		SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").MustString("")
 		SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").MustString("")
 		SSLCurvePreferences = sec.Key("SSL_CURVE_PREFERENCES").Strings(",")

modules/setting/server_test.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"testing"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadAcmeEABFrom(t *testing.T) {
+	t.Cleanup(test.MockVariableValue(&AcmeEABKID, ""))
+	t.Cleanup(test.MockVariableValue(&AcmeEABHMAC, ""))
+
+	cfg, err := NewConfigProviderFromData(`
+[server]
+ACME_EAB_KID = kid
+ACME_EAB_HMAC = hmac
+`)
+	assert.NoError(t, err)
+
+	loadAcmeEABFrom(cfg.Section("server"))
+
+	assert.Equal(t, "kid", AcmeEABKID)
+	assert.Equal(t, "hmac", AcmeEABHMAC)
+}

modules/util/string.go

@@ -121,7 +121,7 @@ func asciiLower(b byte) byte {
 
 // AsciiEqualFold is from Golang https://cs.opensource.google/go/go/+/refs/tags/go1.24.4:src/net/http/internal/ascii/print.go
 // ASCII only. In most cases for protocols, we should only use this but not [strings.EqualFold]
-func AsciiEqualFold(s, t string) bool {
+func AsciiEqualFold[T string | []byte](s, t T) bool {
 	if len(s) != len(t) {
 		return false
 	}

modules/web/router_path.go

@@ -5,6 +5,7 @@ package web
 
 import (
 	"net/http"
+	"net/url"
 	"regexp"
 	"slices"
 	"strings"
@@ -19,13 +20,17 @@ type RouterPathGroup struct {
 	r         *Router
 	pathParam string
 	matchers  []*routerPathMatcher
+	unescape  bool
 }
 
 func (g *RouterPathGroup) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
 	chiCtx := chi.RouteContext(req.Context())
 	path := chiCtx.URLParam(g.pathParam)
+	if g.unescape {
+		path, _ = url.PathUnescape(path)
+	}
 	for _, m := range g.matchers {
-		if m.matchPath(chiCtx, path) {
+		if m.matchPath(chiCtx, path, g.unescape) {
 			chiCtx.RoutePatterns = append(chiCtx.RoutePatterns, m.pattern)
 			executeMiddlewaresHandler(resp, req, m.middlewares, m.handlerFunc)
 			return
@@ -53,6 +58,10 @@ func (g *RouterPathGroup) MatchPattern(methods string, pattern *RouterPathGroupP
 	g.matchers = append(g.matchers, newRouterPathMatcher(methods, pattern, h...))
 }
 
+func (g *RouterPathGroup) UseUnescapedPath() {
+	g.unescape = true
+}
+
 type routerPathParam struct {
 	name         string
 	pathSepEnd   bool
@@ -68,7 +77,7 @@ type routerPathMatcher struct {
 	handlerFunc http.HandlerFunc
 }
 
-func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string) bool {
+func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string, unescaped bool) bool {
 	if !p.methods.Contains(chiCtx.RouteMethod) {
 		return false
 	}
@@ -102,6 +111,9 @@ func (p *routerPathMatcher) matchPath(chiCtx *chi.Context, path string) bool {
 		if p.params[i].pathSepEnd {
 			val = strings.TrimSuffix(val, "/")
 		}
+		if unescaped {
+			val = url.PathEscape(val)
+		}
 		chiCtx.URLParams.Add(p.params[i].name, val)
 	}
 	return true

modules/web/router_test.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 
@@ -97,12 +98,16 @@ func (r *testRecorder) test(t *testing.T, rt *Router, methodPath string, expecte
 }
 
 func TestPathProcessor(t *testing.T) {
+	unescape := false
 	testProcess := func(pattern, uri string, expectedPathParams map[string]string) {
 		chiCtx := chi.NewRouteContext()
 		chiCtx.RouteMethod = "GET"
 		p := newRouterPathMatcher("GET", patternRegexp(pattern), http.NotFound)
 		shouldProcess := expectedPathParams != nil
-		assert.Equal(t, shouldProcess, p.matchPath(chiCtx, uri), "use pattern %s to process uri %s", pattern, uri)
+		if unescape {
+			uri, _ = url.PathUnescape(uri)
+		}
+		assert.Equal(t, shouldProcess, p.matchPath(chiCtx, uri, unescape), "use pattern %s to process uri %s", pattern, uri)
 		assert.Equal(t, expectedPathParams, chiURLParamsToMap(chiCtx), "use pattern %s to process uri %s", pattern, uri)
 	}
 
@@ -119,6 +124,9 @@ func TestPathProcessor(t *testing.T) {
 	testProcess("/<p1:*>/part/<p2>", "/part/c", map[string]string{"p1": "", "p2": "c"})
 	testProcess("/<p1:*>/part/<p2>", "/a/other-part/c", nil)
 	testProcess("/<p1:*>-part/<p2>", "/a-other-part/c", map[string]string{"p1": "a-other", "p2": "c"})
+
+	unescape = true
+	testProcess("/<p1:@/x>", "/%40%2fx", map[string]string{"p1": "@%2Fx"})
 }
 
 func TestRouter(t *testing.T) {

routers/api/packages/api.go

@@ -405,37 +405,24 @@ func CommonRoutes() *web.Router {
 			}, reqPackageAccess(perm.AccessModeRead))
 		})
 		r.Group("/npm", func() {
-			// HINT: NPM-ROUTE-PATH-PATTERN: search this keyword to see more details
-			scopeRegexp := `^@` + npm_module.RegexpNamePart + `$`
-			idRegexp := `^(@` + npm_module.RegexpNamePart + `%2[fF])?` + npm_module.RegexpNamePart + `$`
-			addPackageHandlers := func() {
-				r.Get("", npm.PackageMetadata)
-				r.Put("", reqPackageAccess(perm.AccessModeWrite), npm.UploadPackage)
-				r.Get("/{version}", npm.PackageVersionMetadata)
-				r.Group("/-/{version}/{filename}", func() {
-					r.Get("", npm.DownloadPackageFile)
-					r.Delete("/-rev/{revision}", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageVersion)
-				})
-				r.Get("/-/{filename}", npm.DownloadPackageFileByName)
-				r.Group("/-rev/{revision}", func() {
-					r.Delete("", npm.DeletePackage)
-					r.Put("", npm.DeletePreview)
-				}, reqPackageAccess(perm.AccessModeWrite))
-			}
-			r.Group("/{scope:"+scopeRegexp+"}/{id:"+idRegexp+"}", addPackageHandlers)
-			r.Group("/{id:"+idRegexp+"}", addPackageHandlers)
+			r.Get("/-/v1/search", npm.PackageSearch)
+			r.PathGroup("/*", func(g *web.RouterPathGroup) {
+				// HINT: NPM-ROUTE-PATH-PATTERN: search this keyword to see more details
+				packageId := `/<id:(@` + npm_module.RegexpNamePart + `/)?` + npm_module.RegexpNamePart + ">"
+				g.UseUnescapedPath()
+				g.MatchPath("DELETE", packageId+"/-/<version>/<filename>/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageVersion)
+				g.MatchPath("GET", packageId+"/-/<version>/<filename>", npm.DownloadPackageFile)
+				g.MatchPath("GET", packageId+"/-/<filename>", npm.DownloadPackageFileByName)
+				g.MatchPath("DELETE", packageId+"/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackage)
+				g.MatchPath("PUT", packageId+"/-rev/<revision>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePreview)
+				g.MatchPath("GET", packageId+"/<version>", npm.PackageVersionMetadata)
+				g.MatchPath("GET", packageId, npm.PackageMetadata)
+				g.MatchPath("PUT", packageId, reqPackageAccess(perm.AccessModeWrite), npm.UploadPackage)
 
-			addPackageDistTagsHandlers := func() {
-				r.Get("", npm.ListPackageTags)
-				r.Group("/{tag}", func() {
-					r.Put("", npm.AddPackageTag)
-					r.Delete("", npm.DeletePackageTag)
-				}, reqPackageAccess(perm.AccessModeWrite))
-			}
-			r.Group("/-/package/{scope:"+scopeRegexp+"}/{id:"+idRegexp+"}/dist-tags", addPackageDistTagsHandlers)
-			r.Group("/-/package/{id:"+idRegexp+"}/dist-tags", addPackageDistTagsHandlers)
-			r.Group("/-/v1/search", func() {
-				r.Get("", npm.PackageSearch)
+				packageDistTags := "/-/package" + packageId + "/dist-tags"
+				g.MatchPath("GET", packageDistTags, npm.ListPackageTags)
+				g.MatchPath("PUT", packageDistTags+"/<tag>", reqPackageAccess(perm.AccessModeWrite), npm.AddPackageTag)
+				g.MatchPath("DELETE", packageDistTags+"/<tag>", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageTag)
 			})
 		}, reqPackageAccess(perm.AccessModeRead))
 		r.Group("/pub", func() {

routers/api/packages/npm/npm.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	std_ctx "context"
 	"errors"
-	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -44,21 +43,12 @@ func apiError(ctx *context.Context, status int, obj any) {
 
 // packageNameFromParams gets the package name from the url parameters
 func packageNameFromParams(ctx *context.Context) string {
-	// Real examples: these 2 both should work:
+	// HINT: NPM-ROUTE-PATH-PATTERN: real examples: these cases all should work:
 	// * "https://registry.npmjs.org/@angular/core"
 	// * "https://registry.npmjs.org/@angular%2Fcore"
+	// * "https://registry.npmjs.org/%40angular%2Fcore"
 	//
-	// HINT: NPM-ROUTE-PATH-PATTERN: The cases for the path parameters:
-	// * ".../TheName/...": id="TheName"
-	// * ".../@TheScope/TheName/...": scope="@TheScope", id="TheName"
-	// * ".../@TheScope%2FTheName/...": id="@TheScope/TheName"
-	scope := ctx.PathParam("scope")
-	fullOrSub := ctx.PathParam("id") // may be a full name or a subpath of the full package name
-	if scope != "" {
-		// now id is the subpath of the full package name, e.g. "core" in "@angular/core"
-		return fmt.Sprintf("%s/%s", scope, fullOrSub)
-	}
-	return fullOrSub // id is the full package name, e.g.: "@angular/core" or "lodash"
+	return ctx.PathParam("id") // id is the full package name, e.g.: "@angular/core" or "lodash"
 }
 
 func buildNpmRegistryURL(ctx std_ctx.Context, owner *user_model.User) string {

routers/api/v1/admin/user.go

@@ -400,7 +400,7 @@ func SearchUsers(ctx *context.APIContext) {
 	// parameters:
 	// - name: source_id
 	//   in: query
-	//   description: ID of the user's login source to search for
+	//   description: ID of the user's login source to search for, 0 means the local users
 	//   type: integer
 	//   format: int64
 	// - name: login_name
@@ -483,7 +483,7 @@ func SearchUsers(ctx *context.APIContext) {
 		Actor:         ctx.Doer,
 		Types:         []user_model.UserType{user_model.UserTypeIndividual},
 		LoginName:     ctx.FormTrim("login_name"),
-		SourceID:      ctx.FormInt64("source_id"),
+		SourceID:      ctx.FormOptionalInt64("source_id"),
 		Keyword:       ctx.FormTrim("q"),
 		Visible:       visible,
 		OrderBy:       orderBy,

routers/api/v1/repo/file.go

@@ -162,7 +162,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 
 	// if it's not a pointer, just serve the data directly
 	if !pointer.IsValid() {
-		_, _ = ctx.Resp.Write(lfsPointerBuf)
+		httplib.ServeUserContentByReader(ctx.Req, ctx.Resp, int64(len(lfsPointerBuf)), bytes.NewReader(lfsPointerBuf), httplib.ServeHeaderOptions{Filename: blob.Name()})
 		return
 	}
 
@@ -171,7 +171,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 
 	// If there isn't one, just serve the data directly
 	if errors.Is(err, git_model.ErrLFSObjectNotExist) {
-		_, _ = ctx.Resp.Write(lfsPointerBuf)
+		httplib.ServeUserContentByReader(ctx.Req, ctx.Resp, int64(len(lfsPointerBuf)), bytes.NewReader(lfsPointerBuf), httplib.ServeHeaderOptions{Filename: blob.Name()})
 		return
 	} else if err != nil {
 		ctx.APIErrorInternal(err)
@@ -198,7 +198,7 @@ func GetRawFileOrLFS(ctx *context.APIContext) {
 		return
 	}
 	defer lfsDataFile.Close()
-	httplib.ServeUserContentByFile(ctx.Base.Req, ctx.Base.Resp, lfsDataFile, httplib.ServeHeaderOptions{Filename: ctx.Repo.TreePath})
+	httplib.ServeUserContentByFile(ctx.Base.Req, ctx.Base.Resp, lfsDataFile, httplib.ServeHeaderOptions{Filename: blob.Name()})
 }
 
 func getBlobForEntry(ctx *context.APIContext) (blob *git.Blob, entry *git.TreeEntry, lastModified *time.Time) {

routers/api/v1/repo/issue_attachment.go

@@ -386,8 +386,8 @@ func attachmentBelongsToRepoOrIssue(ctx *context.APIContext, attachment *repo_mo
 		ctx.APIErrorNotFound("no such attachment in repo")
 		return false
 	}
-	if attachment.IssueID == 0 {
-		log.Debug("Requested attachment[%d] is not in an issue.", attachment.ID)
+	if attachment.IssueID == 0 || attachment.CommentID != 0 {
+		log.Debug("Requested attachment[%d] is not an issue attachment.", attachment.ID)
 		ctx.APIErrorNotFound("no such attachment in issue")
 		return false
 	} else if issue != nil && attachment.IssueID != issue.ID {

routers/api/v1/repo/mirror.go

@@ -291,6 +291,11 @@ func AddPushMirror(ctx *context.APIContext) {
 		return
 	}
 
+	if setting.Mirror.DisableNewPush {
+		ctx.APIError(http.StatusForbidden, "the site administrator has disabled the creation of new push mirrors")
+		return
+	}
+
 	pushMirror := web.GetForm[*api.CreatePushMirrorOption](ctx)
 	CreatePushMirror(ctx, pushMirror)
 }
@@ -356,7 +361,7 @@ func CreatePushMirror(ctx *context.APIContext, mirrorOption *api.CreatePushMirro
 
 	address, err := git.ParseRemoteAddr(mirrorOption.RemoteAddress, mirrorOption.RemoteUsername, mirrorOption.RemotePassword)
 	if err == nil {
-		err = migrations.IsMigrateURLAllowed(address, ctx.ContextUser)
+		err = migrations.IsMigrateURLAllowed(address, ctx.Doer)
 	}
 	if err != nil {
 		HandleRemoteAddressError(ctx, err)

routers/api/v1/repo/mirror_test.go

@@ -10,13 +10,36 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/test"
 	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
 
+func TestCreatePushMirrorUsesCallerPermission(t *testing.T) {
+	defer test.MockVariableValue(&setting.ImportLocalPaths, true)()
+	ctx, resp := contexttest.MockAPIContext(t, "user2/repo1")
+	ctx.Doer = &user_model.User{}
+	ctx.ContextUser = &user_model.User{AllowImportLocal: true}
+
+	CreatePushMirror(ctx, &api.CreatePushMirrorOption{RemoteAddress: "local-mirror", Interval: "0"})
+
+	assert.Equal(t, http.StatusUnauthorized, resp.Code)
+}
+
+func TestAddPushMirrorDisabled(t *testing.T) {
+	defer test.MockVariableValue(&setting.Mirror.DisableNewPush, true)()
+	ctx, resp := contexttest.MockAPIContext(t, "user2/repo1")
+
+	AddPushMirror(ctx)
+
+	assert.Equal(t, http.StatusForbidden, resp.Code)
+	assert.Contains(t, resp.Body.String(), "the site administrator has disabled the creation of new push mirrors")
+}
+
 // TestPushMirrorSync verifies the endpoint attempts every push mirror instead
 // of aborting on the first failure, reporting all failed remotes with a 422.
 // Each remote name is not a configured git remote, so SyncPushMirror fails fast

routers/private/hook_post_receive.go

@@ -139,7 +139,8 @@ func hookPostReceiveUpdateRepoByOptions(ctx *gitea_context.PrivateContext, opts
 	// The repo is empty and being initialized by this push, so there is no
 	// dependent state (webhooks, notifications, visibility fan-out) to reconcile
 	// yet; setting the flags directly is sufficient in this push-to-create case.
-	if isPrivate.Has() && repo.IsPrivate != isPrivate.Value() {
+	if isPrivate.Has() && repo.IsPrivate != isPrivate.Value() &&
+		(isPrivate.Value() || !setting.Repository.ForcePrivate || ctx.Doer.IsAdmin) {
 		repo.IsPrivate = isPrivate.Value()
 		if err := repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_private"); err != nil {
 			log.Error("failed to update repo is_private: %v", err)

routers/web/admin/users.go

@@ -48,6 +48,13 @@ const (
 // UserSearchDefaultAdminSort is the default sort type for admin view
 const UserSearchDefaultAdminSort = "alphabetically"
 
+// authSourceFilterOption is one radio item of the authentication source filter dropdown
+type authSourceFilterOption struct {
+	Value    string
+	Label    string
+	Selected bool
+}
+
 // Users show all the users
 func Users(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("admin.users")
@@ -76,6 +83,30 @@ func Users(ctx *context.Context) {
 		"SortType":        sortType,
 	}
 
+	// inactive sources are listed too, users stay attached to a source after it is deactivated
+	sources, err := db.Find[auth.Source](ctx, auth.FindSourcesOptions{})
+	if err != nil {
+		ctx.ServerError("auth.Sources", err)
+		return
+	}
+	sourceIDFilter := ctx.FormOptionalInt64("source_id")
+	sourceNames := make(map[int64]string, len(sources))
+	authSourceFilterOptions := []*authSourceFilterOption{
+		{Value: "", Label: ctx.Locale.TrString("all"), Selected: !sourceIDFilter.Has()},
+		{Value: "0", Label: ctx.Locale.TrString("admin.users.local"), Selected: sourceIDFilter.Has() && sourceIDFilter.Value() == 0},
+	}
+	for _, source := range sources {
+		sourceNames[source.ID] = source.Name
+		authSourceFilterOptions = append(authSourceFilterOptions, &authSourceFilterOption{
+			Value:    strconv.FormatInt(source.ID, 10),
+			Label:    source.Name,
+			Selected: sourceIDFilter.Has() && sourceIDFilter.Value() == source.ID,
+		})
+	}
+	ctx.Data["HasAuthSources"] = len(sources) > 0
+	ctx.Data["SourceNames"] = sourceNames
+	ctx.Data["AuthSourceFilterOptions"] = authSourceFilterOptions
+
 	explore.RenderUserSearch(ctx, user_model.SearchUserOptions{
 		Actor: ctx.Doer,
 		Types: types,
@@ -88,6 +119,7 @@ func Users(ctx *context.Context) {
 		IsRestricted:       optional.ParseBool(statusFilterMap["is_restricted"]),
 		IsTwoFactorEnabled: optional.ParseBool(statusFilterMap["is_2fa_enabled"]),
 		IsProhibitLogin:    optional.ParseBool(statusFilterMap["is_prohibit_login"]),
+		SourceID:           sourceIDFilter,
 		OrderBy:            db.SearchOrderBy(sortType),
 	}, tplUsers)
 }

routers/web/auth/oauth2_provider.go

@@ -576,7 +576,7 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, server
 	}
 
 	token, err := oauth2_provider.ParseToken(form.RefreshToken, serverKey)
-	if err != nil {
+	if err != nil || token.Kind != oauth2_provider.KindRefreshToken {
 		handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{
 			ErrorCode:        oauth2_provider.AccessTokenErrorCodeUnauthorizedClient,
 			ErrorDescription: "unable to parse refresh token",

routers/web/feed/profile.go

@@ -9,7 +9,9 @@ import (
 	activities_model "gitea.dev/models/activities"
 	"gitea.dev/models/organization"
 	"gitea.dev/models/renderhelper"
+	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
 	"gitea.dev/services/context"
 	feed_service "gitea.dev/services/feed"
 
@@ -28,8 +30,15 @@ func ShowUserFeedAtom(ctx *context.Context) {
 
 // showUserFeed show user activity as RSS / Atom feed
 func showUserFeed(ctx *context.Context, formatType string) {
-	includePrivate := ctx.IsSigned && (ctx.Doer.IsAdmin || ctx.Doer.ID == ctx.ContextUser.ID)
 	isOrganisation := ctx.ContextUser.IsOrganization()
+	if !setting.Other.EnableFeed ||
+		isOrganisation && !organization.HasOrgOrUserVisible(ctx, ctx.ContextUser, ctx.Doer) ||
+		!isOrganisation && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
+		ctx.NotFound(nil)
+		return
+	}
+
+	includePrivate := ctx.IsSigned && (ctx.Doer.IsAdmin || ctx.Doer.ID == ctx.ContextUser.ID)
 	if ctx.IsSigned && isOrganisation && !includePrivate {
 		// When feed is requested by a member of the organization,
 		// include the private repo's the member has access to.

routers/web/repo/actions/actions.go

@@ -642,7 +642,15 @@ func (data *actionRunListData) preparePartialRefreshRuns(ctx *context.Context) b
 		ctx.ServerError("GetRunsByRepoAndID", err)
 		return false
 	}
-	data.ActionRuns = runs
+	runsMap := make(map[int64]*actions_model.ActionRun, len(runs))
+	for _, run := range runs {
+		runsMap[run.ID] = run
+	}
+	for _, id := range data.refreshRunIDs {
+		if run, ok := runsMap[id]; ok {
+			data.ActionRuns = append(data.ActionRuns, run)
+		}
+	}
 	return true
 }
 

routers/web/repo/actions/actions_test.go

@@ -15,6 +15,7 @@ import (
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	web_context "gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -74,3 +75,17 @@ func newWorkflowBadgeTestContext(t *testing.T) *web_context.Context {
 	}
 	return ctx
 }
+
+func TestActionRunListData(t *testing.T) {
+	unittest.PrepareTestEnv(t)
+	t.Run("preparePartialRefreshRuns", func(t *testing.T) {
+		ctx, _ := contexttest.MockContext(t, "user5/repo4/actions")
+		contexttest.LoadRepo(t, ctx, 4)
+		d := &actionRunListData{refreshRunIDs: []int64{791, 792}}
+		d.preparePartialRefreshRuns(ctx)
+		assert.Equal(t, []int64{791, 792}, []int64{d.ActionRuns[0].ID, d.ActionRuns[1].ID})
+		d = &actionRunListData{refreshRunIDs: []int64{792, 791}}
+		d.preparePartialRefreshRuns(ctx)
+		assert.Equal(t, []int64{792, 791}, []int64{d.ActionRuns[0].ID, d.ActionRuns[1].ID})
+	})
+}

routers/web/repo/release.go

@@ -660,6 +660,11 @@ func deleteReleaseOrTag(ctx *context.Context, isDelTag bool) {
 		return
 	}
 
+	if isDelTag && !rel.IsTag {
+		ctx.HTTPError(http.StatusConflict, "a tag attached to a release cannot be deleted directly")
+		return
+	}
+
 	if err := release_service.DeleteReleaseByID(ctx, ctx.Repo.Repository, rel, ctx.Doer, isDelTag); err != nil {
 		if release_service.IsErrProtectedTagName(err) {
 			ctx.Flash.Error(ctx.Tr("repo.release.tag_name_protected"))

routers/web/repo/release_test.go

@@ -4,6 +4,7 @@
 package repo
 
 import (
+	"net/http"
 	"net/http/httptest"
 	"testing"
 
@@ -21,6 +22,21 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestDeleteTagRetainsReleaseAndAttachments(t *testing.T) {
+	unittest.PrepareTestEnv(t)
+	ctx, resp := contexttest.MockContext(t, "POST user2/repo1/tags/delete?id=1")
+	contexttest.LoadUser(t, ctx, 2)
+	contexttest.LoadRepo(t, ctx, 1)
+	release := unittest.AssertExistsAndLoadBean(t, &repo_model.Release{ID: 1})
+	attachment := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 9, ReleaseID: 1})
+
+	DeleteTag(ctx)
+
+	assert.Equal(t, http.StatusConflict, resp.Code)
+	assert.Equal(t, release, unittest.AssertExistsAndLoadBean(t, &repo_model.Release{ID: 1}))
+	assert.Equal(t, attachment, unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 9}))
+}
+
 func TestNewReleasePost(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 

routers/web/user/home.go

@@ -734,18 +734,10 @@ func UsernameSubRoute(ctx *context.Context) {
 			ShowGPGKeys(ctx)
 		}
 	case strings.HasSuffix(username, ".rss"):
-		if !setting.Other.EnableFeed {
-			ctx.HTTPError(http.StatusNotFound)
-			return
-		}
 		if reloadParam(".rss") {
 			feed.ShowUserFeedRSS(ctx)
 		}
 	case strings.HasSuffix(username, ".atom"):
-		if !setting.Other.EnableFeed {
-			ctx.HTTPError(http.StatusNotFound)
-			return
-		}
 		if reloadParam(".atom") {
 			feed.ShowUserFeedAtom(ctx)
 		}

routers/web/user/profile.go

@@ -322,6 +322,13 @@ func prepareUserProfileTabData(ctx *context.Context, profileDbRepo *repo_model.R
 
 // ActionUserFollow is for follow/unfollow user request
 func ActionUserFollow(ctx *context.Context) {
+	isOrg := ctx.ContextUser.IsOrganization()
+	if isOrg && !organization.HasOrgOrUserVisible(ctx, ctx.ContextUser, ctx.Doer) ||
+		!isOrg && !user_model.IsUserVisibleToViewer(ctx, ctx.ContextUser, ctx.Doer) {
+		ctx.NotFound(nil)
+		return
+	}
+
 	var err error
 	switch ctx.FormString("action") {
 	case "follow":

services/migrations/gitea_downloader.go

@@ -107,9 +107,8 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 	if err != nil {
 		log.Info("Unable to get global API settings. Ignoring these.")
 		log.Debug("giteaClient.GetGlobalAPISettings. Error: %v", err)
-	}
-	if apiConf != nil {
-		maxPerPage = apiConf.MaxResponseItems
+	} else if apiConf != nil && apiConf.MaxResponseItems > 0 {
+		maxPerPage = min(apiConf.MaxResponseItems, 100)
 	}
 
 	return &GiteaDownloader{

services/migrations/gitea_downloader_test.go

@@ -5,6 +5,7 @@ package migrations
 
 import (
 	"fmt"
+	"math"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -317,15 +318,16 @@ func TestGiteaDownloadRepo(t *testing.T) {
 
 func TestGiteaDownloadCommentsPaging(t *testing.T) {
 	for _, tc := range []struct {
-		maxResponseItems, commentCount, requests int
-		paginated                                bool
+		maxResponseItems, pageSize, commentCount, requests int
+		paginated                                          bool
 	}{
-		{maxResponseItems: 2, commentCount: 2, requests: 2},
-		{maxResponseItems: 2, commentCount: 3, requests: 1},
-		{maxResponseItems: 2, commentCount: 4, requests: 3, paginated: true},
-		{maxResponseItems: 0, commentCount: 0, requests: 1},
+		{maxResponseItems: 2, pageSize: 2, commentCount: 2, requests: 2},
+		{maxResponseItems: 2, pageSize: 2, commentCount: 3, requests: 1},
+		{maxResponseItems: 2, pageSize: 2, commentCount: 4, requests: 3, paginated: true},
+		{maxResponseItems: 0, pageSize: 10, commentCount: 0, requests: 1},
+		{maxResponseItems: math.MaxInt, pageSize: 100, commentCount: 0, requests: 1},
 	} {
-		t.Run(strconv.Itoa(tc.commentCount), func(t *testing.T) {
+		t.Run(fmt.Sprintf("maxResponseItems=%d/comments=%d", tc.maxResponseItems, tc.commentCount), func(t *testing.T) {
 			commentRequests := 0
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				switch r.URL.Path {
@@ -352,6 +354,7 @@ func TestGiteaDownloadCommentsPaging(t *testing.T) {
 
 			downloader, err := NewGiteaDownloader(t.Context(), server.URL, "o/r", "", "", "")
 			require.NoError(t, err)
+			require.Equal(t, tc.pageSize, downloader.maxPerPage)
 
 			comments, _, err := downloader.GetComments(t.Context(), &base.Issue{Number: 1})
 			require.NoError(t, err)

templates/admin/user/list.tmpl

@@ -47,6 +47,20 @@
 						</div>
 					</div>
 
+					<!-- Authentication Source Filter Menu Item -->
+					{{if .HasAuthSources}}
+						<div class="ui dropdown type jump item">
+							<span class="text">{{ctx.Locale.Tr "admin.users.auth_source"}}</span>
+							{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+							<div class="menu flex-items-menu">
+								{{range $index, $option := .AuthSourceFilterOptions}}
+									{{if eq $index 1}}<div class="divider"></div>{{end}}
+									<label class="item"><input type="radio" name="source_id" value="{{$option.Value}}" {{if $option.Selected}}checked{{end}}> {{$option.Label}}</label>
+								{{end}}
+							</div>
+						</div>
+					{{end}}
+
 					<!-- Sort Menu Item -->
 					<div class="ui dropdown type jump item">
 						<span class="text">
@@ -75,6 +89,7 @@
 							{{SortArrow "alphabetically" "reversealphabetically" $.SortType true}}
 						</th>
 						<th>{{ctx.Locale.Tr "email"}}</th>
+						<th>{{ctx.Locale.Tr "admin.users.auth_source"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.activated"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.restricted"}}</th>
 						<th>{{ctx.Locale.Tr "admin.users.2fa"}}</th>
@@ -102,6 +117,7 @@
 								{{template "shared/user/user_type_label" .}}
 							</td>
 							<td class="gt-ellipsis tw-max-w-48">{{.Email}}</td>
+							<td class="gt-ellipsis tw-max-w-32">{{if .LoginSource}}{{index $.SourceNames .LoginSource}}{{else}}{{ctx.Locale.Tr "admin.users.local"}}{{end}}</td>
 							<td>{{svg (Iif .IsActive "octicon-check" "octicon-x")}}</td>
 							<td>{{svg (Iif .IsRestricted "octicon-check" "octicon-x")}}</td>
 							<td>{{svg (Iif (index $.UsersTwoFaStatus .ID) "octicon-check" "octicon-x")}}</td>
@@ -119,7 +135,7 @@
 							</td>
 						</tr>
 					{{else}}
-						<tr class="no-results-row"><td class="tw-text-center" colspan="9">{{ctx.Locale.Tr "no_results_found"}}</td></tr>
+						<tr class="no-results-row"><td class="tw-text-center" colspan="10">{{ctx.Locale.Tr "no_results_found"}}</td></tr>
 					{{end}}
 				</tbody>
 			</table>

templates/swagger/v1-openapi3.generated.json

@@ -11939,7 +11939,7 @@
         "operationId": "adminSearchUsers",
         "parameters": [
           {
-            "description": "ID of the user's login source to search for",
+            "description": "ID of the user's login source to search for, 0 means the local users",
             "in": "query",
             "name": "source_id",
             "schema": {

templates/swagger/v1-swagger.generated.json

@@ -825,7 +825,7 @@
           {
             "type": "integer",
             "format": "int64",
-            "description": "ID of the user's login source to search for",
+            "description": "ID of the user's login source to search for, 0 means the local users",
             "name": "source_id",
             "in": "query"
           },

tests/e2e/admin.test.ts

@@ -17,6 +17,8 @@ test('create a bot and manage its access token', async ({page, request}) => {
   await page.getByRole('row', {name: /^user /}).getByRole('radio', {name: 'Read', exact: true}).check();
   await page.getByRole('button', {name: 'Generate Token'}).click();
   const token = await page.getByRole('code').textContent();
+  await page.getByRole('button', {name: 'Copy', exact: true}).click();
+  await expect.poll(() => page.evaluate(() => navigator.clipboard.readText())).toBe(token);
   const response = await request.get('/api/v1/user', {headers: {Authorization: `token ${token}`}});
   expect(await response.json()).toMatchObject({login: botName, type: 'Bot'});
 

tests/e2e/file-view-render.test.ts

@@ -39,6 +39,18 @@ test('pdf file', async ({page, request}) => {
   await assertFlushWithParent(container, page.locator('.file-view'));
 });
 
+test('code line anchors', async ({page, request}) => {
+  const repoName = `e2e-line-anchor-${randomString(8)}`;
+  const owner = env.GITEA_TEST_E2E_USER;
+  await apiCreateRepo(request, {name: repoName});
+  await apiCreateFiles(request, owner, repoName, [{path: 'test.txt', content: 'a\n'}]);
+  const url = `/${owner}/${repoName}/src/branch/main/test.txt`;
+  await page.goto(`${url}#L0`);
+  await page.goto(`${url}#L1`);
+  await expect(page.locator('.code-view tr.active')).toHaveCount(1);
+  await assertNoJsError(page);
+});
+
 test('asciicast file', async ({page, request}) => {
   const repoName = `e2e-asciicast-render-${randomString(8)}`;
   const owner = env.GITEA_TEST_E2E_USER;

tests/integration/admin_user_test.go

@@ -16,8 +16,10 @@ import (
 	"gitea.dev/modules/setting"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/modules/test"
+	"gitea.dev/services/auth/source/ldap"
 	"gitea.dev/tests"
 
+	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -34,6 +36,49 @@ func TestAdminViewUsers(t *testing.T) {
 	session.MakeRequest(t, req, http.StatusForbidden)
 }
 
+func TestAdminViewUsersFilterAuthSource(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	source := &auth_model.Source{Type: auth_model.LDAP, Name: "test-user-list-filter", IsActive: false, Cfg: &ldap.Source{}} // users stay attached to a deactivated source
+	require.NoError(t, auth_model.CreateSource(t.Context(), source))
+
+	user2 := &user_model.User{ID: 2, LoginType: auth_model.LDAP, LoginSource: source.ID}
+	require.NoError(t, user_model.UpdateUserCols(t.Context(), user2, "login_type", "login_source"))
+
+	session := loginUser(t, "user1")
+	listUsers := func(query string) (*HTMLDoc, []string) {
+		req := NewRequest(t, "GET", "/-/admin/users?"+query)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
+		return doc, doc.Find("table tbody tr td:nth-child(2) a").Map(func(_ int, s *goquery.Selection) string {
+			return s.Text()
+		})
+	}
+
+	doc, users := listUsers("source_id=") // the "All" option submits an empty value
+	AssertHTMLElement(t, doc, `input[name="source_id"][value=""][checked]`, true)
+	assert.Subset(t, users, []string{"user1", "user2"})
+
+	doc, users = listUsers(fmt.Sprintf("source_id=%d", source.ID)) // the "test-user-list-filter" LDAP source
+	AssertHTMLElement(t, doc, fmt.Sprintf(`input[name="source_id"][value="%d"][checked]`, source.ID), true)
+	assert.Equal(t, []string{"user2"}, users)
+	assert.Equal(t, source.Name, doc.Find("table tbody tr td:nth-child(4)").Text())
+
+	_, users = listUsers("source_id=0") // 0 means the "Local" source
+	assert.Contains(t, users, "user1")
+	assert.NotContains(t, users, "user2")
+
+	token := getUserToken(t, "user1", auth_model.AccessTokenScopeReadAdmin)
+	req := NewRequest(t, "GET", "/api/v1/admin/users?source_id=0").AddTokenAuth(token) // the API also treats 0 as local users
+	apiUsers := DecodeJSON(t, MakeRequest(t, req, http.StatusOK), []api.User{})
+	apiUserNames := make([]string, 0, len(apiUsers))
+	for _, u := range apiUsers {
+		apiUserNames = append(apiUserNames, u.UserName)
+	}
+	assert.Contains(t, apiUserNames, "user1")
+	assert.NotContains(t, apiUserNames, "user2")
+}
+
 func TestAdminViewUser(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 

tests/integration/api_issue_attachment_test.go

@@ -38,6 +38,11 @@ func TestAPIGetIssueAttachment(t *testing.T) {
 	apiAttachment := DecodeJSON(t, resp, &api.Attachment{})
 
 	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: apiAttachment.ID, IssueID: issue.ID})
+
+	commentAttachment := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 3, RepoID: repo.ID})
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assets/%d", repoOwner.Name, repo.Name, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: commentAttachment.IssueID}).Index, commentAttachment.ID)).
+		AddTokenAuth(token)
+	session.MakeRequest(t, req, http.StatusNotFound)
 }
 
 func TestAPIListIssueAttachments(t *testing.T) {

tests/integration/api_packages_npm_test.go

@@ -170,8 +170,9 @@ func TestPackageNpm(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
 		rootPaths := []string{
-			fmt.Sprintf("/api/packages/%s/npm/@scope/test-package", user.Name),
-			fmt.Sprintf("/api/packages/%s/npm/@scope%%2ftest-package", user.Name),
+			"/api/packages/user2/npm/@scope/test-package",
+			"/api/packages/user2/npm/@scope%2Ftest-package",
+			"/api/packages/user2/npm/%40scope%2ftest-package",
 		}
 		for _, root := range rootPaths {
 			req := NewRequest(t, "GET", fmt.Sprintf("%s/-/%s/%s", root, packageVersion, filename)).AddTokenAuth(token)
@@ -186,7 +187,7 @@ func TestPackageNpm(t *testing.T) {
 		pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeNpm)
 		assert.NoError(t, err)
 		assert.Len(t, pvs, 1)
-		assert.Equal(t, int64(4), pvs[0].DownloadCount)
+		assert.EqualValues(t, 6, pvs[0].DownloadCount)
 	})
 
 	t.Run("PackageMetadata", func(t *testing.T) {

tests/integration/api_repo_file_get_test.go

@@ -22,6 +22,10 @@ func TestAPIGetRawFileOrLFS(t *testing.T) {
 	resp := MakeRequest(t, req, http.StatusOK)
 	assert.Equal(t, "# repo1\n\nDescription for repo1", resp.Body.String())
 
+	req = NewRequest(t, "GET", "/api/v1/repos/user2/repo2/media/test.xml").AddTokenAuth(getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository))
+	resp = MakeRequest(t, req, http.StatusOK)
+	assert.Equal(t, "text/plain; charset=utf-8", resp.Header().Get("Content-Type"))
+
 	// Test with LFS
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		createLFSTestRepository(t, "repo-lfs-test")

tests/integration/git_push_test.go

@@ -16,6 +16,8 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
@@ -175,6 +177,14 @@ func TestGitPushVisibilityOption(t *testing.T) {
 		doGitPushTestRepository(gitPath, "origin", "branch2", "-o", "repo.private=false")(t)
 		repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repo.ID})
 		assert.True(t, repo.IsPrivate, "repo.private option must be ignored on an existing repository")
+
+		defer test.MockVariableValue(&setting.Repository.ForcePrivate, true)()
+		forcedRepo, err := repo_service.CreateRepository(t.Context(), user, user, repo_service.CreateRepoOptions{Name: "repo-visibility-forced", DefaultBranch: "master", IsPrivate: true})
+		require.NoError(t, err)
+		u.Path = forcedRepo.FullName() + ".git"
+		doGitAddRemote(gitPath, "forced", u)(t)
+		doGitPushTestRepository(gitPath, "forced", "master", "-o", "repo.private=false")(t)
+		assert.True(t, unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: forcedRepo.ID}).IsPrivate)
 	})
 }
 

tests/integration/oauth_test.go

@@ -571,6 +571,15 @@ func testRefreshTokenInvalidation(t *testing.T) {
 	assert.Equal(t, "unauthorized_client", string(parsedError.ErrorCode))
 	assert.Equal(t, "unable to parse refresh token", parsedError.ErrorDescription)
 
+	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "refresh_token",
+		"client_id":     "da7da3ba-9a13-4167-856f-3899de0b0138",
+		"client_secret": "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=",
+		"redirect_uri":  "https://example.com",
+		"refresh_token": parsed.AccessToken,
+	})
+	MakeRequest(t, req, http.StatusBadRequest)
+
 	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
 		"grant_type":    "refresh_token",
 		"client_id":     "da7da3ba-9a13-4167-856f-3899de0b0138",

tests/integration/user_test.go

@@ -84,6 +84,7 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	org22 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 22})
 	req := NewRequest(t, "GET", "/"+org22.Name)
 	MakeRequest(t, req, http.StatusNotFound)
+	MakeRequest(t, NewRequest(t, "GET", "/"+org22.Name).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
 
 	session := loginUser(t, "user1")
 	oldName := org22.Name
@@ -106,6 +107,8 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	org23 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 23})
 	req = NewRequest(t, "GET", "/"+org23.Name)
 	MakeRequest(t, req, http.StatusNotFound)
+	strangerSession := loginUser(t, "user4")
+	strangerSession.MakeRequest(t, NewRequest(t, "POST", "/"+org23.Name+"?action=follow"), http.StatusNotFound)
 
 	oldName = org23.Name
 	newName = "org23_renamed"
@@ -127,6 +130,8 @@ func testViewLimitedAndPrivateUserAndRename(t *testing.T) {
 	user31 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 31})
 	req = NewRequest(t, "GET", "/"+user31.Name)
 	MakeRequest(t, req, http.StatusNotFound)
+	MakeRequest(t, NewRequest(t, "GET", "/"+user31.Name).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
+	strangerSession.MakeRequest(t, NewRequest(t, "POST", "/"+user31.Name+"?action=follow"), http.StatusNotFound)
 
 	oldName = user31.Name
 	newName = "user31_renamed"
@@ -330,6 +335,10 @@ func testGetUserRss(t *testing.T) {
 	session := loginUser(t, "user2")
 	req = NewRequestf(t, "GET", "/non-existent-user.rss")
 	session.MakeRequest(t, req, http.StatusNotFound)
+
+	defer test.MockVariableValue(&setting.Other.EnableFeed, false)()
+	MakeRequest(t, NewRequestf(t, "GET", "/%s.rss", user34), http.StatusNotFound)
+	MakeRequest(t, NewRequestf(t, "GET", "/%s", user34).SetHeader("Accept", "application/rss+xml"), http.StatusNotFound)
 }
 
 func testUserListStopWatches(t *testing.T) {

web_src/js/features/repo-code.ts

@@ -58,6 +58,7 @@ function selectRange(range: string): Element | null {
     stopLineNum = tmp;
     range = `${stop}-${start}`;
   }
+  if (startLineNum < 1) return null;
 
   const first = elLineNums[startLineNum - 1] ?? null;
   for (let i = startLineNum - 1; i <= stopLineNum - 1 && i < elLineNums.length; i++) {

web_src/js/modules/clipboard.ts

@@ -64,7 +64,7 @@ function replaceWithFeedbackSvg(origSvg: SVGElement, success: boolean): () => vo
 
 // Enable clipboard copy from HTML attributes. These properties are supported:
 // - data-clipboard-text: Direct text to copy
-// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of <div> will be copied
+// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of other elements will be copied
 export function initGlobalCopyToClipboardListener() {
   document.addEventListener('click', async (e) => {
     const target = (e.target as HTMLElement).closest<HTMLElement>('[data-clipboard-text], [data-clipboard-target]');
@@ -78,10 +78,8 @@ export function initGlobalCopyToClipboardListener() {
       const textTarget = document.querySelector(textSelector)!;
       if (textTarget.nodeName === 'INPUT' || textTarget.nodeName === 'TEXTAREA') {
         text = (textTarget as HTMLInputElement | HTMLTextAreaElement).value;
-      } else if (textTarget.nodeName === 'DIV') {
-        text = textTarget.textContent;
       } else {
-        throw new Error(`Unsupported element for clipboard target: ${textSelector}`);
+        text = textTarget.textContent;
       }
     }
     // now, text can not be null

web_src/js/modules/errors.test.ts

@@ -17,7 +17,11 @@ test('isGiteaError', () => {
   expect(isGiteaError('', `Error\n    at chrome-extension://abc/content.js:1:1`)).toBe(false);
   expect(isGiteaError('', `Error\n    at https://other-site.com/script.js:1:1`)).toBe(false);
   expect(isGiteaError('', `Error\n    at ${origin}/assets/js/index.abc123.js:1:1`)).toBe(true);
+  expect(isGiteaError('', `Error\n    at ${origin}/web_src/js/index.ts:1:1`)).toBe(false);
   expect(isGiteaError(`${origin}/assets/js/index.js`, `Error\n    at chrome-extension://abc/content.js:1:1`)).toBe(false);
+  vi.spyOn(window.config, 'runModeIsProd', 'get').mockReturnValue(false);
+  expect(isGiteaError('', `Error\n    at ${origin}/web_src/js/index.ts:1:1`)).toBe(true);
+  vi.restoreAllMocks();
 });
 
 test('showGlobalErrorMessage', () => {

web_src/js/modules/errors.ts

@@ -58,6 +58,7 @@ export function isGiteaError(filename: string, stack: string): boolean {
   if (extensionRe.test(filename) || extensionRe.test(stack)) return false;
   const assetBaseUrl = new URL(`${windowConfig()?.assetUrlPrefix}/`, window.location.origin).href;
   if (filename && !filename.startsWith(assetBaseUrl) && !filename.startsWith(window.location.origin)) return false;
+  if (!windowConfig()?.runModeIsProd && stack.includes(`${window.location.origin}/web_src/`)) return true;
   return !stack || stack.includes(assetBaseUrl);
 }