gitconfig: set safe.directory = *

Allow git push to work when networked file systems with mixed
ownership are used with Gitea docker images >= 1.16.6 or Gitea
binaries running alongside git versions published after 04/2022.

There are circumstances independent of Gitea (networked file systems
with various permission systems) by which the git repositories managed
by Gitea may have mixed owners. It is not a behavior that Gitea have
control over nor is it a problem as long as the permissions for Gitea to
operate are correct. Gitea instances have been operating under these
conditions for a number of years.

It is detected as a potential security risk ( see
GHSA-vw2c-22j4-2fh2
) by the most recent git versions. However, Gitea always runs git
commands with a current directory matching the repository on
which it operates. That makes Gitea immune from this security problem
and it is safe to ignore the mixed owner permission check.

This gitconfig modification is done on a file dedicated to the user
exclusively used by Gitea.

Fixes: #19455

Author: singuliere

docs/content/doc/installation/from-binary.en-us.md

@@ -68,6 +68,8 @@ adduser \
    git
 ```
 
+**NOTE:** If such a dedicated Gitea user is not created and Gitea is run from an already existing user instead, it may modify the global git configuration file. It is possible to use an altnerate global git configuration file by setting the [GIT_CONFIG_GLOBAL](https://git-scm.com/docs/git#Documentation/git.txt-codeGITCONFIGGLOBALcode) if [git version 2.32 or above](https://github.com/git/git/blob/master/Documentation/RelNotes/2.32.0.txt#L92-L93) is installed.
+
 ### Create required directory structure
 
 ```sh

modules/git/git.go

@@ -251,6 +251,16 @@ func syncGitConfig() (err error) {
 		}
 	}
 
+	if CheckGitVersionAtLeast("2.36") == nil {
+		//
+		// Disable the security check because Gitea runs the git CLI from within the
+		// repository. See https://github.com/go-gitea/gitea/issues/19455 for the full discussion.
+		//
+		if err := checkAndSetConfig("safe.directory", "*", true); err != nil {
+			return err
+		}
+	}
+
 	if runtime.GOOS == "windows" {
 		if err := configSet("core.longpaths", "true"); err != nil {
 			return err