Skip to content

Commit e31256e

Browse files
65436543
authored
Merge branch 'main' into fix-17241-daemon-export-ok-only-when-repo-created
2 parents 8f1e238 + cd0928f commit e31256e

File tree

14 files changed

+144
-30
lines changed

14 files changed

+144
-30
lines changed

‎.drone.yml

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -207,8 +207,14 @@ steps:
207207
commands:
208208
- git update-ref refs/heads/tag_test ${DRONE_COMMIT_SHA}
209209

210+
- name: fix-permissions
211+
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
212+
commands:
213+
- chown -R gitea:gitea .
214+
210215
- name: unit-test
211-
image: golang:1.17
216+
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
217+
user: gitea
212218
commands:
213219
- make unit-test-coverage test-check
214220
environment:
@@ -220,7 +226,8 @@ steps:
220226

221227
- name: unit-test-gogit
222228
pull: always
223-
image: golang:1.17
229+
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
230+
user: gitea
224231
commands:
225232
- make unit-test-coverage test-check
226233
environment:
@@ -232,6 +239,7 @@ steps:
232239

233240
- name: test-mysql
234241
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
242+
user: gitea
235243
commands:
236244
- make test-mysql-migration integration-test-coverage
237245
environment:
@@ -246,6 +254,7 @@ steps:
246254

247255
- name: test-mysql8
248256
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
257+
user: gitea
249258
commands:
250259
- timeout -s ABRT 40m make test-mysql8-migration test-mysql8
251260
environment:
@@ -259,6 +268,7 @@ steps:
259268

260269
- name: test-mssql
261270
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
271+
user: gitea
262272
commands:
263273
- make test-mssql-migration test-mssql
264274
environment:
@@ -343,9 +353,15 @@ steps:
343353
exclude:
344354
- pull_request
345355

356+
- name: fix-permissions
357+
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
358+
commands:
359+
- chown -R gitea:gitea .
360+
346361
- name: build
347362
pull: always
348-
image: golang:1.17
363+
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
364+
user: gitea
349365
commands:
350366
- make backend
351367
environment:
@@ -355,6 +371,7 @@ steps:
355371

356372
- name: test-sqlite
357373
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
374+
user: gitea
358375
commands:
359376
- timeout -s ABRT 40m make test-sqlite-migration test-sqlite
360377
environment:
@@ -368,6 +385,7 @@ steps:
368385

369386
- name: test-pgsql
370387
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
388+
user: gitea
371389
commands:
372390
- timeout -s ABRT 40m make test-pgsql-migration test-pgsql
373391
environment:

‎models/admin.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ func Notices(page, pageSize int) ([]*Notice, error) {
107107
notices := make([]*Notice, 0, pageSize)
108108
return notices, db.GetEngine(db.DefaultContext).
109109
Limit(pageSize, (page-1)*pageSize).
110-
Desc("id").
110+
Desc("created_unix").
111111
Find(&notices)
112112
}
113113

‎models/gpg_key_add.go

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,46 @@ func AddGPGKey(ownerID int64, content, token, signature string) ([]*GPGKey, erro
101101
verified = true
102102
}
103103

104+
if len(ekeys) > 1 {
105+
id2key := map[string]*openpgp.Entity{}
106+
newEKeys := make([]*openpgp.Entity, 0, len(ekeys))
107+
for _, ekey := range ekeys {
108+
id := ekey.PrimaryKey.KeyIdString()
109+
if original, has := id2key[id]; has {
110+
// Coalesce this with the other one
111+
for _, subkey := range ekey.Subkeys {
112+
if subkey.PublicKey == nil {
113+
continue
114+
}
115+
found := false
116+
117+
for _, originalSubkey := range original.Subkeys {
118+
if originalSubkey.PublicKey == nil {
119+
continue
120+
}
121+
if originalSubkey.PublicKey.KeyId == subkey.PublicKey.KeyId {
122+
found = true
123+
break
124+
}
125+
}
126+
if !found {
127+
original.Subkeys = append(original.Subkeys, subkey)
128+
}
129+
}
130+
for name, identity := range ekey.Identities {
131+
if _, has := original.Identities[name]; has {
132+
continue
133+
}
134+
original.Identities[name] = identity
135+
}
136+
continue
137+
}
138+
id2key[id] = ekey
139+
newEKeys = append(newEKeys, ekey)
140+
}
141+
ekeys = newEKeys
142+
}
143+
104144
for _, ekey := range ekeys {
105145
// Key ID cannot be duplicated.
106146
has, err := db.GetEngine(ctx).Where("key_id=?", ekey.PrimaryKey.KeyIdString()).

‎models/issue.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -843,7 +843,7 @@ func (issue *Issue) GetLastEventLabel() string {
843843
func (issue *Issue) GetLastComment() (*Comment, error) {
844844
var c Comment
845845
exist, err := db.GetEngine(db.DefaultContext).Where("type = ?", CommentTypeComment).
846-
And("issue_id = ?", issue.ID).Desc("id").Get(&c)
846+
And("issue_id = ?", issue.ID).Desc("created_unix").Get(&c)
847847
if err != nil {
848848
return nil, err
849849
}

‎models/review.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -444,7 +444,7 @@ func SubmitReview(doer *User, issue *Issue, reviewType ReviewType, content, comm
444444
// try to remove team review request if need
445445
if issue.Repo.Owner.IsOrganization() && (reviewType == ReviewTypeApprove || reviewType == ReviewTypeReject) {
446446
teamReviewRequests := make([]*Review, 0, 10)
447-
if err := sess.SQL("SELECT * FROM review WHERE reviewer_team_id > 0 AND type = ?", ReviewTypeRequest).Find(&teamReviewRequests); err != nil {
447+
if err := sess.SQL("SELECT * FROM review WHERE issue_id = ? AND reviewer_team_id > 0 AND type = ?", issue.ID, ReviewTypeRequest).Find(&teamReviewRequests); err != nil {
448448
return nil, nil, err
449449
}
450450

‎models/token.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ func ListAccessTokens(opts ListAccessTokensOptions) ([]*AccessToken, error) {
161161
sess = sess.Where("name=?", opts.Name)
162162
}
163163

164-
sess = sess.Desc("id")
164+
sess = sess.Desc("created_unix")
165165

166166
if opts.Page != 0 {
167167
sess = db.SetSessionPagination(sess, &opts)

‎models/user.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ func (u *User) CanImportLocal() bool {
300300
// DashboardLink returns the user dashboard page link.
301301
func (u *User) DashboardLink() string {
302302
if u.IsOrganization() {
303-
return u.OrganisationLink() + "/dashboard/"
303+
return u.OrganisationLink() + "/dashboard"
304304
}
305305
return setting.AppSubURL + "/"
306306
}

‎modules/convert/pull.go

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
// ToAPIPullRequest assumes following fields have been assigned with valid values:
1818
// Required - Issue
1919
// Optional - Merger
20-
func ToAPIPullRequest(pr *models.PullRequest) *api.PullRequest {
20+
func ToAPIPullRequest(pr *models.PullRequest, doer *models.User) *api.PullRequest {
2121
var (
2222
baseBranch *git.Branch
2323
headBranch *git.Branch
@@ -41,6 +41,12 @@ func ToAPIPullRequest(pr *models.PullRequest) *api.PullRequest {
4141
return nil
4242
}
4343

44+
perm, err := models.GetUserRepoPermission(pr.BaseRepo, doer)
45+
if err != nil {
46+
log.Error("GetUserRepoPermission[%d]: %v", pr.BaseRepoID, err)
47+
perm.AccessMode = models.AccessModeNone
48+
}
49+
4450
apiPullRequest := &api.PullRequest{
4551
ID: pr.ID,
4652
URL: pr.Issue.HTMLURL(),
@@ -68,7 +74,7 @@ func ToAPIPullRequest(pr *models.PullRequest) *api.PullRequest {
6874
Name: pr.BaseBranch,
6975
Ref: pr.BaseBranch,
7076
RepoID: pr.BaseRepoID,
71-
Repository: ToRepo(pr.BaseRepo, models.AccessModeNone),
77+
Repository: ToRepo(pr.BaseRepo, perm.AccessMode),
7278
},
7379
Head: &api.PRBranchInfo{
7480
Name: pr.HeadBranch,
@@ -114,8 +120,14 @@ func ToAPIPullRequest(pr *models.PullRequest) *api.PullRequest {
114120
}
115121

116122
if pr.HeadRepo != nil && pr.Flow == models.PullRequestFlowGithub {
123+
perm, err := models.GetUserRepoPermission(pr.HeadRepo, doer)
124+
if err != nil {
125+
log.Error("GetUserRepoPermission[%d]: %v", pr.HeadRepoID, err)
126+
perm.AccessMode = models.AccessModeNone
127+
}
128+
117129
apiPullRequest.Head.RepoID = pr.HeadRepo.ID
118-
apiPullRequest.Head.Repository = ToRepo(pr.HeadRepo, models.AccessModeNone)
130+
apiPullRequest.Head.Repository = ToRepo(pr.HeadRepo, perm.AccessMode)
119131

120132
headGitRepo, err := git.OpenRepository(pr.HeadRepo.RepoPath())
121133
if err != nil {

‎modules/convert/pull_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@ func TestPullRequest_APIFormat(t *testing.T) {
2121
pr := db.AssertExistsAndLoadBean(t, &models.PullRequest{ID: 1}).(*models.PullRequest)
2222
assert.NoError(t, pr.LoadAttributes())
2323
assert.NoError(t, pr.LoadIssue())
24-
apiPullRequest := ToAPIPullRequest(pr)
24+
apiPullRequest := ToAPIPullRequest(pr, nil)
2525
assert.NotNil(t, apiPullRequest)
2626
assert.EqualValues(t, &structs.PRBranchInfo{
2727
Name: "branch1",
2828
Ref: "refs/pull/2/head",
2929
Sha: "4a357436d925b5c974181ff12a994538ddc5a269",
3030
RepoID: 1,
31-
Repository: ToRepo(headRepo, models.AccessModeNone),
31+
Repository: ToRepo(headRepo, models.AccessModeRead),
3232
}, apiPullRequest.Head)
3333

3434
//withOut HeadRepo
@@ -38,7 +38,7 @@ func TestPullRequest_APIFormat(t *testing.T) {
3838
// simulate fork deletion
3939
pr.HeadRepo = nil
4040
pr.HeadRepoID = 100000
41-
apiPullRequest = ToAPIPullRequest(pr)
41+
apiPullRequest = ToAPIPullRequest(pr, nil)
4242
assert.NotNil(t, apiPullRequest)
4343
assert.Nil(t, apiPullRequest.Head.Repository)
4444
assert.EqualValues(t, -1, apiPullRequest.Head.RepoID)

‎modules/notification/webhook/webhook.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func (m *webhookNotifier) NotifyIssueClearLabels(doer *models.User, issue *model
5151
err = webhook_services.PrepareWebhooks(issue.Repo, models.HookEventPullRequestLabel, &api.PullRequestPayload{
5252
Action: api.HookIssueLabelCleared,
5353
Index: issue.Index,
54-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
54+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
5555
Repository: convert.ToRepo(issue.Repo, mode),
5656
Sender: convert.ToUser(doer, nil),
5757
})
@@ -145,7 +145,7 @@ func (m *webhookNotifier) NotifyIssueChangeAssignee(doer *models.User, issue *mo
145145
issue.PullRequest.Issue = issue
146146
apiPullRequest := &api.PullRequestPayload{
147147
Index: issue.Index,
148-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
148+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
149149
Repository: convert.ToRepo(issue.Repo, mode),
150150
Sender: convert.ToUser(doer, nil),
151151
}
@@ -197,7 +197,7 @@ func (m *webhookNotifier) NotifyIssueChangeTitle(doer *models.User, issue *model
197197
From: oldTitle,
198198
},
199199
},
200-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
200+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
201201
Repository: convert.ToRepo(issue.Repo, mode),
202202
Sender: convert.ToUser(doer, nil),
203203
})
@@ -232,7 +232,7 @@ func (m *webhookNotifier) NotifyIssueChangeStatus(doer *models.User, issue *mode
232232
// Merge pull request calls issue.changeStatus so we need to handle separately.
233233
apiPullRequest := &api.PullRequestPayload{
234234
Index: issue.Index,
235-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
235+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
236236
Repository: convert.ToRepo(issue.Repo, mode),
237237
Sender: convert.ToUser(doer, nil),
238238
}
@@ -301,7 +301,7 @@ func (m *webhookNotifier) NotifyNewPullRequest(pull *models.PullRequest, mention
301301
if err := webhook_services.PrepareWebhooks(pull.Issue.Repo, models.HookEventPullRequest, &api.PullRequestPayload{
302302
Action: api.HookIssueOpened,
303303
Index: pull.Issue.Index,
304-
PullRequest: convert.ToAPIPullRequest(pull),
304+
PullRequest: convert.ToAPIPullRequest(pull, nil),
305305
Repository: convert.ToRepo(pull.Issue.Repo, mode),
306306
Sender: convert.ToUser(pull.Issue.Poster, nil),
307307
}); err != nil {
@@ -322,7 +322,7 @@ func (m *webhookNotifier) NotifyIssueChangeContent(doer *models.User, issue *mod
322322
From: oldContent,
323323
},
324324
},
325-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
325+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
326326
Repository: convert.ToRepo(issue.Repo, mode),
327327
Sender: convert.ToUser(doer, nil),
328328
})
@@ -500,7 +500,7 @@ func (m *webhookNotifier) NotifyIssueChangeLabels(doer *models.User, issue *mode
500500
err = webhook_services.PrepareWebhooks(issue.Repo, models.HookEventPullRequestLabel, &api.PullRequestPayload{
501501
Action: api.HookIssueLabelUpdated,
502502
Index: issue.Index,
503-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
503+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
504504
Repository: convert.ToRepo(issue.Repo, models.AccessModeNone),
505505
Sender: convert.ToUser(doer, nil),
506506
})
@@ -542,7 +542,7 @@ func (m *webhookNotifier) NotifyIssueChangeMilestone(doer *models.User, issue *m
542542
err = webhook_services.PrepareWebhooks(issue.Repo, models.HookEventPullRequestMilestone, &api.PullRequestPayload{
543543
Action: hookAction,
544544
Index: issue.Index,
545-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
545+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
546546
Repository: convert.ToRepo(issue.Repo, mode),
547547
Sender: convert.ToUser(doer, nil),
548548
})
@@ -609,7 +609,7 @@ func (*webhookNotifier) NotifyMergePullRequest(pr *models.PullRequest, doer *mod
609609
// Merge pull request calls issue.changeStatus so we need to handle separately.
610610
apiPullRequest := &api.PullRequestPayload{
611611
Index: pr.Issue.Index,
612-
PullRequest: convert.ToAPIPullRequest(pr),
612+
PullRequest: convert.ToAPIPullRequest(pr, nil),
613613
Repository: convert.ToRepo(pr.Issue.Repo, mode),
614614
Sender: convert.ToUser(doer, nil),
615615
Action: api.HookIssueClosed,
@@ -642,7 +642,7 @@ func (m *webhookNotifier) NotifyPullRequestChangeTargetBranch(doer *models.User,
642642
From: oldBranch,
643643
},
644644
},
645-
PullRequest: convert.ToAPIPullRequest(issue.PullRequest),
645+
PullRequest: convert.ToAPIPullRequest(issue.PullRequest, nil),
646646
Repository: convert.ToRepo(issue.Repo, mode),
647647
Sender: convert.ToUser(doer, nil),
648648
})
@@ -681,7 +681,7 @@ func (m *webhookNotifier) NotifyPullRequestReview(pr *models.PullRequest, review
681681
if err := webhook_services.PrepareWebhooks(review.Issue.Repo, reviewHookType, &api.PullRequestPayload{
682682
Action: api.HookIssueReviewed,
683683
Index: review.Issue.Index,
684-
PullRequest: convert.ToAPIPullRequest(pr),
684+
PullRequest: convert.ToAPIPullRequest(pr, nil),
685685
Repository: convert.ToRepo(review.Issue.Repo, mode),
686686
Sender: convert.ToUser(review.Reviewer, nil),
687687
Review: &api.ReviewPayload{
@@ -736,7 +736,7 @@ func (m *webhookNotifier) NotifyPullRequestSynchronized(doer *models.User, pr *m
736736
if err := webhook_services.PrepareWebhooks(pr.Issue.Repo, models.HookEventPullRequestSync, &api.PullRequestPayload{
737737
Action: api.HookIssueSynchronized,
738738
Index: pr.Issue.Index,
739-
PullRequest: convert.ToAPIPullRequest(pr),
739+
PullRequest: convert.ToAPIPullRequest(pr, nil),
740740
Repository: convert.ToRepo(pr.Issue.Repo, models.AccessModeNone),
741741
Sender: convert.ToUser(doer, nil),
742742
}); err != nil {

‎modules/setting/setting.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -902,6 +902,9 @@ func NewContext() {
902902
}
903903

904904
RunUser = Cfg.Section("").Key("RUN_USER").MustString(user.CurrentUsername())
905+
// The following is a purposefully undocumented option. Please do not run Gitea as root. It will only cause future headaches.
906+
// Please don't use root as a bandaid to "fix" something that is broken, instead the broken thing should instead be fixed properly.
907+
unsafeAllowRunAsRoot := Cfg.Section("").Key("I_AM_BEING_UNSAFE_RUNNING_AS_ROOT").MustBool(false)
905908
RunMode = Cfg.Section("").Key("RUN_MODE").MustString("prod")
906909
// Does not check run user when the install lock is off.
907910
if InstallLock {
@@ -911,6 +914,15 @@ func NewContext() {
911914
}
912915
}
913916

917+
// check if we run as root
918+
if os.Getuid() == 0 {
919+
if !unsafeAllowRunAsRoot {
920+
// Special thanks to VLC which inspired the wording of this messaging.
921+
log.Fatal("Gitea is not supposed to be run as root. Sorry. If you need to use privileged TCP ports please instead use setcap and the `cap_net_bind_service` permission")
922+
}
923+
log.Critical("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
924+
}
925+
914926
SSH.BuiltinServerUser = Cfg.Section("server").Key("BUILTIN_SSH_SERVER_USER").MustString(RunUser)
915927

916928
newRepository()

0 commit comments

Comments
 (0)