Merge branch 'master' into ssh-passthrough-docker

Author: pat-s

.drone.yml

@@ -18,7 +18,6 @@ steps:
       - make node_modules
 
   - name: lint-frontend
-    pull: always
     image: node:14
     commands:
       - make lint-frontend
@@ -35,7 +34,6 @@ steps:
       TAGS: bindata sqlite sqlite_unlock_notify
 
   - name: checks-frontend
-    pull: always
     image: node:14
     commands:
       - make checks-frontend
@@ -49,7 +47,6 @@ steps:
     depends_on: [lint-backend]
 
   - name: build-frontend
-    pull: always
     image: node:14
     commands:
       - make frontend
@@ -66,7 +63,6 @@ steps:
     depends_on: [checks-backend]
 
   - name: build-backend-arm64
-    pull: always
     image: golang:1.15
     environment:
       GO111MODULE: on
@@ -80,7 +76,6 @@ steps:
     depends_on: [checks-backend]
 
   - name: build-backend-386
-    pull: always
     image: golang:1.15
     environment:
       GO111MODULE: on
@@ -108,33 +103,28 @@ workspace:
 
 services:
   - name: mysql
-    pull: default
     image: mysql:5.7
     environment:
       MYSQL_ALLOW_EMPTY_PASSWORD: yes
       MYSQL_DATABASE: test
 
   - name: mysql8
-    pull: default
     image: mysql:8.0
     environment:
       MYSQL_ALLOW_EMPTY_PASSWORD: yes
       MYSQL_DATABASE: testgitea
 
   - name: mssql
-    pull: default
     image: mcr.microsoft.com/mssql/server:latest
     environment:
       ACCEPT_EULA: Y
       MSSQL_PID: Standard
       SA_PASSWORD: MwantsaSecurePassword1
 
   - name: ldap
-    pull: default
     image: gitea/test-openldap:latest
 
   - name: elasticsearch
-    pull: default
     environment:
       discovery.type: single-node
     image: elasticsearch:7.5.0
@@ -149,7 +139,6 @@ services:
 
 steps:
   - name: fetch-tags
-    pull: default
     image: docker:git
     commands:
       - git fetch --tags --force
@@ -175,7 +164,6 @@ steps:
       - git update-ref refs/heads/tag_test ${DRONE_COMMIT_SHA}
 
   - name: unit-test
-    pull: always
     image: golang:1.15
     commands:
       - make unit-test-coverage test-check
@@ -186,7 +174,6 @@ steps:
         from_secret: github_read_token
 
   - name: test-mysql
-    pull: always
     image: golang:1.15
     commands:
       - "curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash"
@@ -202,7 +189,6 @@ steps:
       - build
 
   - name: test-mysql8
-    pull: always
     image: golang:1.15
     commands:
       - "curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash"
@@ -217,7 +203,6 @@ steps:
       - build
 
   - name: test-mssql
-    pull: always
     image: golang:1.15
     commands:
       - "curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash"
@@ -232,7 +217,6 @@ steps:
       - build
 
   - name: generate-coverage
-    pull: always
     image: golang:1.15
     commands:
       - make coverage
@@ -295,7 +279,6 @@ services:
 
 steps:
   - name: fetch-tags
-    pull: default
     image: docker:git
     commands:
       - git fetch --tags --force
@@ -315,7 +298,6 @@ steps:
       TAGS: bindata sqlite sqlite_unlock_notify
 
   - name: test-sqlite
-    pull: always
     image: golang:1.15
     commands:
       - "curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash"
@@ -329,7 +311,6 @@ steps:
       - build
 
   - name: test-pgsql
-    pull: always
     image: golang:1.15
     commands:
       - "curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash"
@@ -431,7 +412,6 @@ depends_on:
 
 steps:
   - name: fetch-tags
-    pull: default
     image: docker:git
     commands:
       - git fetch --tags --force
@@ -485,7 +465,6 @@ steps:
         - push
 
   - name: release-master
-    pull: always
     image: plugins/s3:1
     settings:
       acl: public-read
@@ -644,7 +623,6 @@ trigger:
 
 steps:
   - name: fetch-tags
-    pull: default
     image: docker:git
     commands:
       - git fetch --tags --force
@@ -668,7 +646,6 @@ steps:
         - pull_request
 
   - name: publish-rootless
-    pull: always
     image: plugins/docker:linux-amd64
     settings:
       dockerfile: Dockerfile.rootless
@@ -747,7 +724,6 @@ trigger:
   - "refs/tags/**"
 steps:
   - name: fetch-tags
-    pull: default
     image: docker:git
     commands:
       - git fetch --tags --force
@@ -774,7 +750,6 @@ steps:
         - pull_request
 
   - name: publish-rootless
-    pull: always
     image: plugins/docker:linux-arm64
     settings:
       dockerfile: Dockerfile.rootless
@@ -817,7 +792,6 @@ steps:
         from_secret: docker_username
 
   - name: manifest
-    pull: always
     image: plugins/manifest
     settings:
       auto_tag: true

.editorconfig

@@ -9,7 +9,7 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[*.{go, tmpl, html}]
+[*.{go,tmpl,html}]
 indent_style = tab
 
 [Makefile]

.eslintrc

@@ -9,7 +9,7 @@ ignorePatterns:
 
 parserOptions:
   sourceType: module
-  ecmaVersion: 2020
+  ecmaVersion: 2021
 
 plugins:
   - eslint-plugin-unicorn
@@ -235,6 +235,7 @@ rules:
   no-new-symbol: [2]
   no-new-wrappers: [2]
   no-new: [0]
+  no-nonoctal-decimal-escape: [2]
   no-obj-calls: [2]
   no-octal-escape: [2]
   no-octal: [2]

.gitattributes

@@ -2,3 +2,5 @@
 /vendor/** -text -eol linguist-vendored
 /public/vendor/** -text -eol linguist-vendored
 /templates/**/*.tmpl linguist-language=Handlebars
+/.eslintrc linguist-language=YAML
+/.stylelintrc linguist-language=YAML

.npmrc

@@ -1,2 +1,4 @@
+audit=false
+fund=false
 package-lock=true
 save-exact=true

Makefile

@@ -255,7 +255,7 @@ swagger-check: generate-swagger
 		echo "Please run 'make generate-swagger' and commit the result:"; \
 		echo "$${diff}"; \
 		exit 1; \
-	fi;
+	fi
 
 .PHONY: swagger-validate
 swagger-validate:
@@ -296,7 +296,7 @@ fmt-check:
 		echo "Please run 'make fmt' and commit the result:"; \
 		echo "$${diff}"; \
 		exit 1; \
-	fi;
+	fi
 
 .PHONY: checks
 checks: checks-frontend checks-backend
@@ -348,7 +348,7 @@ test-check:
 		echo "You should change the tests to create these files in a temporary directory."; \
 		echo "Do not simply add these files to .gitignore"; \
 		exit 1; \
-	fi;
+	fi
 
 .PHONY: test\#%
 test\#%:
@@ -373,7 +373,7 @@ test-vendor: vendor
 		echo "Please run 'make vendor' and commit the result:"; \
 		echo "$${diff}"; \
 		exit 1; \
-	fi;
+	fi
 
 generate-ini-sqlite:
 	sed -e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
@@ -637,6 +637,9 @@ npm-update: node-check | node_modules
 fomantic: $(FOMANTIC_DEST)
 
 $(FOMANTIC_DEST): $(FOMANTIC_CONFIGS) | node_modules
+	@if [ ! -d node_modules/fomantic-ui ]; then \
+		npm install --no-save --no-package-lock [email protected]; \
+	fi
 	rm -rf $(FOMANTIC_DEST_DIR)
 	cp -f web_src/fomantic/theme.config.less node_modules/fomantic-ui/src/theme.config
 	cp -rf web_src/fomantic/_site/* node_modules/fomantic-ui/src/_site/
@@ -664,7 +667,7 @@ svg-check: svg
 		echo "Please run 'make svg' and 'git add $(SVG_DEST_DIR)' and commit the result:"; \
 		echo "$${diff}"; \
 		exit 1; \
-	fi;
+	fi
 
 .PHONY: update-translations
 update-translations:

custom/conf/app.example.ini

@@ -8,8 +8,8 @@
 APP_NAME = Gitea: Git with a cup of tea
 ; Change it if you run locally
 RUN_USER = git
-; Either "dev", "prod" or "test", default is "dev"
-RUN_MODE = dev
+; Application run mode, affects performance and debugging. Either "dev", "prod" or "test", default is "prod"
+RUN_MODE = prod
 
 [project]
 ; Default templates for project boards
@@ -1187,6 +1187,14 @@ QUEUE_CONN_STR = "addrs=127.0.0.1:6379 db=0"
 MAX_ATTEMPTS = 3
 ; Backoff time per http/https request retry (seconds)
 RETRY_BACKOFF = 3
+; Allowed domains for migrating, default is blank. Blank means everything will be allowed.
+; Multiple domains could be separated by commas.
+ALLOWED_DOMAINS =
+; Blocklist for migrating, default is blank. Multiple domains could be separated by commas.
+; When ALLOWED_DOMAINS is not blank, this option will be ignored.
+BLOCKED_DOMAINS =
+; Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291 (false by default)
+ALLOW_LOCALNETWORKS = false
 
 ; default storage for attachments, lfs and avatars
 [storage]

docker/root/etc/s6/gitea/setup

@@ -25,7 +25,7 @@ if [ ! -f ${GITEA_CUSTOM}/conf/app.ini ]; then
 
     # Substitude the environment variables in the template
     APP_NAME=${APP_NAME:-"Gitea: Git with a cup of tea"} \
-    RUN_MODE=${RUN_MODE:-"dev"} \
+    RUN_MODE=${RUN_MODE:-"prod"} \
     DOMAIN=${DOMAIN:-"localhost"} \
     SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
     HTTP_PORT=${HTTP_PORT:-"3000"} \

docker/rootless/usr/local/bin/docker-setup.sh

@@ -27,7 +27,7 @@ if [ ! -f ${GITEA_APP_INI} ]; then
 
     # Substitude the environment variables in the template
     APP_NAME=${APP_NAME:-"Gitea: Git with a cup of tea"} \
-    RUN_MODE=${RUN_MODE:-"dev"} \
+    RUN_MODE=${RUN_MODE:-"prod"} \
     RUN_USER=${USER:-"git"} \
     SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
     HTTP_PORT=${HTTP_PORT:-"3000"} \

docs/content/doc/advanced/config-cheat-sheet.en-us.md

@@ -36,9 +36,7 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`.
 - `APP_NAME`: **Gitea: Git with a cup of tea**: Application name, used in the page title.
 - `RUN_USER`: **git**: The user Gitea will run as. This should be a dedicated system
    (non-user) account. Setting this incorrectly will cause Gitea to not start.
-- `RUN_MODE`: **dev**: For performance and other purposes, change this to `prod` when
-   deployed to a production environment. The installation process will set this to `prod`
-   automatically. \[prod, dev, test\]
+- `RUN_MODE`: **prod**: Application run mode, affects performance and debugging. Either "dev", "prod" or "test".
 
 ## Repository (`repository`)
 
@@ -846,6 +844,9 @@ Task queue configuration has been moved to `queue.task`. However, the below conf
 
 - `MAX_ATTEMPTS`: **3**: Max attempts per http/https request on migrations.
 - `RETRY_BACKOFF`: **3**: Backoff time per http/https request retry (seconds)
+- `ALLOWED_DOMAINS`: **\<empty\>**: Domains allowlist for migrating repositories, default is blank. It means everything will be allowed. Multiple domains could be separated by commas.
+- `BLOCKED_DOMAINS`: **\<empty\>**: Domains blocklist for migrating repositories, default is blank. Multiple domains could be separated by commas. When `ALLOWED_DOMAINS` is not blank, this option will be ignored.
+- `ALLOW_LOCALNETWORKS`: **false**: Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291
 
 ## Mirror (`mirror`)
 

docs/content/doc/advanced/config-cheat-sheet.zh-cn.md

@@ -313,6 +313,9 @@ IS_INPUT_FILE = false
 
 - `MAX_ATTEMPTS`: **3**: 在迁移过程中的 http/https 请求重试次数。
 - `RETRY_BACKOFF`: **3**: 等待下一次重试的时间，单位秒。
+- `ALLOWED_DOMAINS`: **\<empty\>**: 迁移仓库的域名白名单，默认为空，表示允许从任意域名迁移仓库，多个域名用逗号分隔。
+- `BLOCKED_DOMAINS`: **\<empty\>**: 迁移仓库的域名黑名单，默认为空，多个域名用逗号分隔。如果 `ALLOWED_DOMAINS` 不为空，此选项将会被忽略。
+- `ALLOW_LOCALNETWORKS`: **false**: Allow private addresses defined by RFC 1918
 
 ## LFS (`lfs`)
 

docs/content/doc/installation/with-docker-rootless.en-us.md

@@ -240,7 +240,7 @@ You can configure some of Gitea's settings via environment variables:
 (Default values are provided in **bold**)
 
 * `APP_NAME`: **"Gitea: Git with a cup of tea"**: Application name, used in the page title.
-* `RUN_MODE`: **dev**: For performance and other purposes, change this to `prod` when deployed to a production environment.
+* `RUN_MODE`: **prod**: Application run mode, affects performance and debugging. Either "dev", "prod" or "test".
 * `SSH_DOMAIN`: **localhost**: Domain name of this server, used for the displayed clone URL in Gitea's UI.
 * `SSH_PORT`: **2222**: SSH port displayed in clone URL.
 * `SSH_LISTEN_PORT`: **%(SSH\_PORT)s**: Port for the built-in SSH server.