Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add single sign-on support via SSPI on Windows #8463

Merged
merged 41 commits into from
Nov 22, 2019
Merged

Conversation

quasoft
Copy link
Contributor

@quasoft quasoft commented Oct 11, 2019

This pull request adds support for Single single-on authentication with Kerberos/NTLM by implementing the protocol defined by RFC4559 (SPNEGO-based HTTP Authentication in Microsoft Windows) to exchange authentication data between the web browser and the HTTP server, and using the Security Support Provider Interface (SSPI) to perform the authentication.

This is a sample implementation of the design proposed with #8462. The referenced proposal contains more details on the design choices.

@guillep2k
Copy link
Member

guillep2k commented Oct 11, 2019

I'm currently using Gitea in a Linux system with PAM authentication for validating the user accounts from our AD. That's because my (CentOS 7) has sssd integration with our AD. I wonder if your solution could be integrated with that (I don't even know if pam can be compiled on Windows).

Regarding the "Disable Sign On" button, I find it adds too much clutter to the login page. I'd rather make "Sign in" a drop-down menu:

image

I don't mean to use ticks for the drop-down, the user just clicks the option they want; no cookies, no preferences.

When clicking to "Sign In" (the header of the menu), it uses a default log in mode, which the admin can select in app.ini

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 11, 2019
@zeripath
Copy link
Contributor

The continuous integration is failing because you need to:

Please run 'make vendor' and commit the result:

@quasoft
Copy link
Contributor Author

quasoft commented Oct 14, 2019

@guillep2k Thank you for the feedback.

You are actually right that an additional button in the navbar adds too much clutter and a dropdown will look better. Will definitely change it to a dropdown.

Initially, I added a similar Login with a local account button that opens the user/login page with a suppress_sso=1 (user/login?suppress_sso=1) query parameter. Then I figured out that I have to persist this value as a hidden input in the login form (in case the user types a wrong password - writing a wrong local username or password reloads user/login, but without the query parameter). It turned out the same has to be done on the user registration page, the forgot password page and probably a few more.

That's why I decided to use a cookie. It allows the user to toggle between Single Sign-On and the default login behavior on the go, with a single click. And it does not require modification of existing handlers or templates related to the login process.

But if anyone can give an idea, how to check (at the middleware level, inside Contexter) if current page requires the user to be signed in, SSO could be automatically disabled on all pages that do not require authentication, which would make the use of the cookie unnecessary.
If I understand it correctly this decision is made when routes are created. For example in:

m.Group("/repo", func() {
m.Get("/create", repo.Create)
m.Post("/create", bindIgnErr(auth.CreateRepoForm{}), repo.CreatePost)
m.Get("/migrate", repo.Migrate)
m.Post("/migrate", bindIgnErr(auth.MigrateRepoForm{}), repo.MigratePost)
m.Group("/fork", func() {
m.Combo("/:repoid").Get(repo.Fork).
Post(bindIgnErr(auth.CreateRepoForm{}), repo.ForkPost)
}, context.RepoIDAssignment(), context.UnitTypes(), reqRepoCodeReader)
}, reqSignIn)

repo routes have a group handler reqSignIn, which enforces the user to be signed in, but that is executed after all middlewares.
Would it somehow be possible to check inside a middleware if the reqSignIn or ignSignIn handlers have been assigned to the current page?

As for sssd I haven't used it with active directory, but I believe that plugin authentication modules are a Linux thing. A Gitea web server running on Linux could authenticate to AD with GSSAPI (eg, I believe that is what PostgreSQL uses on Linux). And there seems to exist Golang packages that implement Kerberos with GSSAPI, so at a later stage that would also be possible by writing a gssapi_linux.go plugin inside modules/auth/sso/.

@quasoft
Copy link
Contributor Author

quasoft commented Oct 14, 2019

@zeripath Thanks, I will run make vendor together with my next commit.

@quasoft
Copy link
Contributor Author

quasoft commented Oct 14, 2019

Updated vendor directory and made two other changes:

  1. Replaced buttons Enable Single Sign-On and Disable Single Sign-On on the anonymous dashboard with a dropdown menu with hover text "Single Sign-On":
    SSOMenuDown

  2. handleSignIn function is not called when accessing API paths, /manifest.json and /serviceworker.js.
    It should not be called on API paths because that would change existing behaviour for Basic authentication, OAuth or Reverse proxy authentication.

        // Try to sign in with each of the enabled plugins
	for _, ssoMethod := range sso.Methods() {
		if !ssoMethod.IsEnabled() {
			continue
		}
		user = ssoMethod.VerifyAuthData(ctx)
		if user != nil {
			// Make sure requests to API paths and PWA resources do not create a new session
			if !IsAPIPath(ctx.Req.URL.Path) && !IsPWAResource(ctx.Req.URL.Path) {
				handleSignIn(ctx, sess, user)
			}
			_, isBasic := ssoMethod.(*sso.Basic)
			return user, isBasic
		}
	}

@zeripath zeripath added this to the 1.11.0 milestone Oct 14, 2019
@quasoft
Copy link
Contributor Author

quasoft commented Oct 16, 2019

Made a few more changes:

  1. First, Introduced a Priority() method to the SingleSignOn interface. This method should return an integer, that determines the order in which authentication plugins are executed.
// SingleSignOn represents a SSO authentication method (plugin) for HTTP requests.
type SingleSignOn interface {
	...
	// Priority determines the order in which authentication methods are executed.
	// The lower the priority, the sooner the plugin is executed.
	Priority() int
	...
}
  1. Added a second parameter to the VerifyAuthData() of the SingleSignOn interface that accepts arguments of type session.Store. The purpose is to allow authentication plugins to use the data of the session object when making the decision to authenticate the request:
// SingleSignOn represents a SSO authentication method (plugin) for HTTP requests.
type SingleSignOn interface {
	...
	VerifyAuthData(ctx *macaron.Context, sess session.Store) *models.User
}
  1. Introduced a new SSO plugin session.go, which checks if there is a user uid stored in the session and returns the corresponding user object for that uid (that behaviour was extracted from modules/auth/auth.go).

  2. Order of execution of plugins set to (in order to keep existing behaviour before the pull request; random order was breaking integration tests for the /api/v1/admin/ path):

    • oauth2
    • session
    • reverseproxy
    • basic
    • sspi

    The SSPI plugin executes last, as it returns 401 if negotiation fails or should continue, which would prevent other authentication methods to execute at all.

@lafriks
Copy link
Member

lafriks commented Oct 16, 2019

I was looking at the code and imho it would be way better if sspi would have been added as authorization source just like others currently are instead of app.ini settings

@quasoft
Copy link
Contributor Author

quasoft commented Oct 17, 2019

@lafriks
To be honest I had only a very quick look at login sources and left with the impression that they (LDAP, SMTP, PAM, OAuth2) are only used for interactive login with username and password.

SPNEGO with SSPI does not require the user to enter any credentials, and uses only authentication data automatically populated by the browser to the Authroization header, so I felt single sign-on authentication would fit better at the middleware level. That's why I made it similar to reverse proxy authentication and basic authorization, which too rely only on headers present in the request to authenticate the user.

But I will definitely take a more detailed look at how login sources work. If I manage to integrate SSPI/SPNEGO as part of those sources, I will make a second pull request for this variant too.

@quasoft
Copy link
Contributor Author

quasoft commented Oct 17, 2019

@lafriks As for settings only, those probably can be stored in the authentication sources DB table instead of in the app.ini file.

@lafriks
Copy link
Member

lafriks commented Oct 18, 2019

My primary idea was that it could be enabled in auth sources, functionality can still happen in middleware

@quasoft
Copy link
Contributor Author

quasoft commented Oct 22, 2019

Made a few more changes:

  1. Moved SSPI activation and configuration from ini file to "Site Administration -> Authentication Sources" (as suggested by @lafriks):
    SSPILoginSource
  2. Removed option for enabling SSPI from installer page.
  3. Removed the Dropdown menu for temporary disabling of single sign-on and the cookie that stored the setting (suggested to remove cookie by @guillep2k ).
  4. Added an "SSPI" button (tab) to the standard login page:
    StandardLoginWithSSPI
  5. Changed the SSPI auth method to not try to perform authentication on public pages (eg. /user/login) or public resources (eg. /favicon.png)
  6. Changed the SSPI auth method to include the template for the /user/login page when returning 401 status code. Thus the browser can display the standard login page of Gitea if negotiation by SPNEGO fails.

@quasoft
Copy link
Contributor Author

quasoft commented Oct 26, 2019

Can anyone advise on the golangci-lint error?

@guillep2k
Copy link
Member

@quasoft It looks like a bogus CI error. Try updating the branch to trigger the CI check again.

@guillep2k
Copy link
Member

I' ve updated the branch for you (you'll have to git pull before pushing again), but the problem is still there. Two things come to my mind:

  • Gitea currently needs go version 1.13; make sure you've used that on your copy.
  • Gitea's CI runs under Linux. If you have any components that are Windows-only, you need to use build tags to leave them out of the build on other platforms. See auth/pam module for an example.

@quasoft
Copy link
Contributor Author

quasoft commented Oct 26, 2019

Thanks, will check again for Windows-only components.

@codecov-io
Copy link

codecov-io commented Oct 26, 2019

Codecov Report

Merging #8463 into master will decrease coverage by <.01%.
The diff coverage is 38.4%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #8463      +/-   ##
==========================================
- Coverage   41.12%   41.11%   -0.01%     
==========================================
  Files         547      552       +5     
  Lines       71622    71829     +207     
==========================================
+ Hits        29454    29532      +78     
- Misses      38442    38569     +127     
- Partials     3726     3728       +2
Impacted Files Coverage Δ
modules/auth/auth_form.go 100% <ø> (ø) ⬆️
routers/repo/http.go 35.38% <100%> (ø) ⬆️
routers/init.go 68.67% <100%> (+1.17%) ⬆️
modules/auth/auth.go 67.92% <100%> (+18.3%) ⬆️
routers/user/auth.go 12.03% <100%> (+0.15%) ⬆️
routers/admin/auths.go 30.71% <23.52%> (-1.52%) ⬇️
models/login_source.go 25.76% <23.52%> (-0.07%) ⬇️
modules/auth/sso/sso.go 28.12% <28.12%> (ø)
modules/auth/sso/basic.go 43.66% <43.66%> (ø)
modules/auth/sso/oauth2.go 60% <60%> (ø)
... and 11 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eb1b225...359cd8e. Read the comment docs.

@lafriks
Copy link
Member

lafriks commented Oct 26, 2019

Looks very nice, thanks. Will review it next week, quite a big pr to review :)

modules/auth/sso/sso.go Show resolved Hide resolved
modules/auth/sso/sso.go Show resolved Hide resolved
modules/auth/sso/sspi_windows.go Outdated Show resolved Hide resolved
options/locale/locale_en-US.ini Outdated Show resolved Hide resolved
options/locale/locale_en-US.ini Outdated Show resolved Hide resolved
options/locale/locale_en-US.ini Outdated Show resolved Hide resolved
modules/context/context.go Outdated Show resolved Hide resolved
models/login_source.go Show resolved Hide resolved
modules/auth/sso/reverseproxy.go Outdated Show resolved Hide resolved
modules/auth/sso/sspi_windows.go Outdated Show resolved Hide resolved
modules/auth/sso/sspi_windows.go Show resolved Hide resolved
options/locale/locale_en-US.ini Outdated Show resolved Hide resolved
templates/base/head_navbar.tmpl Outdated Show resolved Hide resolved
@lafriks
Copy link
Member

lafriks commented Oct 28, 2019

Small nit changes needed but otherwise LG-TM. Great work! Some parts was a bit hard to review because of lot of refactoring but I look how code is now structured. Thanks!

@quasoft
Copy link
Contributor Author

quasoft commented Nov 22, 2019

Rebased and rebuilt public/js files.

routers/admin/auths.go Outdated Show resolved Hide resolved
Copy link
Member

@guillep2k guillep2k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work!! 🎉

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Nov 22, 2019
@quasoft
Copy link
Contributor Author

quasoft commented Nov 22, 2019

Thank you too for the time spend on this feature!

Working on this PR was very motivating and a great experience. Thanks!

@lafriks lafriks merged commit 7b4d2f7 into go-gitea:master Nov 22, 2019
@lafriks
Copy link
Member

lafriks commented Nov 22, 2019

Thanks for your PR! ;)

@quasoft quasoft deleted the sspi branch November 23, 2019 08:24
@lafriks lafriks added type/feature Completely new functionality. Can only be merged if feature freeze is not active. and removed type/enhancement An improvement of existing functionality labels Jan 8, 2020
aswild added a commit to aswild/gitea that referenced this pull request Jan 23, 2020
* BREAKING
  * Remove unused endpoints (go-gitea#9538)
  * Prefix all user-generated IDs in markup (go-gitea#9477)
  * Enforce Gitea environment for pushes (go-gitea#8982)
  * Hide some user information via API if user have no enough permission (go-gitea#8655)
  * Move startpage/homepage translation to crowdin (go-gitea#8596)
* FEATURES
  * Webhooks should only show sender if it makes sense (go-gitea#9601)
  * Provide Default messages for merges (go-gitea#9393)
  * Add description to labels on create issue (go-gitea#9392)
  * Graceful Queues: Issue Indexing and Tasks (go-gitea#9363)
  * Default NO_REPLY_ADDRESS to DOMAIN (go-gitea#9325)
  * Allow FCGI over unix sockets (go-gitea#9298)
  * Graceful: Xorm, RepoIndexer, Cron and Others (go-gitea#9282)
  * Add API for Reactions (go-gitea#9220)
  * Graceful: Cancel Process on monitor pages & HammerTime (go-gitea#9213)
  * Graceful: Allow graceful restart for unix sockets (go-gitea#9113)
  * Graceful: Allow graceful restart for fcgi (go-gitea#9112)
  * Sign protected branches (go-gitea#8993)
  * Add Graceful shutdown for Windows and hooks for shutdown of goroutines (go-gitea#8964)
  * Add Gitea icon to Emojis (go-gitea#8950)
  * Expand/Collapse Files and Blob Excerpt while Reviewing/Comparing code (go-gitea#8924)
  * Allow Custom Reactions (go-gitea#8886)
  * Close/reopen issues by keywords in titles and comments (go-gitea#8866)
  * Allow incompletely specified Time Formats (go-gitea#8816)
  * Prevent upload (overwrite) of lfs locked file (go-gitea#8769)
  * Template Repositories (go-gitea#8768)
  * Add /milestones endpoint (go-gitea#8733)
  * Make repository management section handle lfs locks (go-gitea#8726)
  * Respect LFS File Lock on UI (go-gitea#8719)
  * Add team option to grant rights for all organization repositories (go-gitea#8688)
  * Enabling and disabling the commit button to prevent empty commits (web editor) (go-gitea#8590)
  * Add setting to disable BASIC authentication (go-gitea#8586)
  * Expose db.SetMaxOpenConns and allow non MySQL dbs to set conn pool params (go-gitea#8528)
  * Allow Protected Branches to Whitelist Deploy Keys (go-gitea#8483)
  * Push to create repo (go-gitea#8419)
  * Sign merges, CRUD, Wiki and Repository initialisation with gpg key (go-gitea#7631)
  * Add basic repository lfs management (go-gitea#7199)
* BUGFIXES
  * Disable remove button on repository teams when have access to all (go-gitea#9640)
  * Clean up old references on branch delete (go-gitea#9614)
  * Hide public repos owned by private orgs (go-gitea#9609)
  * Fix access issues on milestone and issue overview pages. (go-gitea#9603)
  * Fix error logged when repos qs is empty (go-gitea#9591)
  * Dont trigger notification twice on issue assignee change (go-gitea#9582)
  * Fix mirror pushed commit actions (go-gitea#9572)
  * Allow only specific columns to be updated on issue via API (go-gitea#9189) (go-gitea#9539)
  * Fix default avatar for ghost user (go-gitea#9536)
  * Fix download of release attachments with same name (go-gitea#9529)
  * Resolve deprecated INI conversion (go-gitea#9525)
  * Ignore empty avatars during database migration (go-gitea#9520)
  * Fix deleted branch isn't removed when push the branch again (go-gitea#9516)
  * Fix repository issues pagination bug when there are more than one label filter (go-gitea#9512)
  * Fix SetExpr failed (go-gitea#9506)
  * Remove obsolete file private/push_update.go (go-gitea#9503)
  * When recreating hooks, delete them first so they are recreated with the umask (go-gitea#9502)
  * Properly enforce gitea environment for pushes (go-gitea#9501)
  * Fix datarace on repo indexer queue (go-gitea#9490)
  * Add call to load repo prior to redirect in add/remove dependency code (go-gitea#9484)
  * Wrap the code indexer (go-gitea#9476)
  * Use Req.URL.RequestURI() to cope with FCGI urls (go-gitea#9473)
  * Set default ssh.minimum_key_sizes (go-gitea#9466)
  * Fixed issue with paging in /repos/{owner}/{repo}/git/trees/{sha} api (go-gitea#9459)
  * Fix wrong notification on merge (go-gitea#9450)
  * Issue with Migration rule v111 (go-gitea#9449)
  * Trigger webhook when deleting a branch after merging a PR (go-gitea#9424)
  * Add migration to sanitize repository original_url (go-gitea#9423)
  * Use OriginalURL instead of CloneAddr in migration logging (go-gitea#9418)
  * Push update after branch is restored (go-gitea#9416)
  * Fix wrong migration (go-gitea#9381)
  * Fix show repositories filter (go-gitea#9234) (go-gitea#9379)
  * Fix Slack webhook payload title generation to work with Mattermost (go-gitea#9378)
  * Fix double webhook for new PR (go-gitea#9375)
  * AuthorizedKeysCommand should not query db directly (go-gitea#9371)
  * Fix missed change to GetManager() (go-gitea#9361)
  * Fix cache problem on dashboard (go-gitea#9358)
  * RepoIndexer: DefaultBranch needs to be prefixed by BranchPrefix (go-gitea#9356)
  * Fix protected branch using IssueID (go-gitea#9348)
  * Fix nondeterministic behavior (go-gitea#9341)
  * Fix PR/issue redirects when having external tracker (go-gitea#9339)
  * Remove release attachments which repository has been deleted (go-gitea#9334)
  * Fix issue indexer not triggered when migrating a repository (go-gitea#9332)
  * Add SyncTags to uploader interface (go-gitea#9326)
  * Fix bug that release attachment files not deleted when deleting repository (go-gitea#9322)
  * Only sync tags after all migration release batches are completed (go-gitea#9319)
  * File Edit: Author/Committer interchanged (go-gitea#9297)
  * prebuild CSS/JS before xgo release binaries (go-gitea#9293)
  * Log: Ensure FLAGS=none shows no flags (go-gitea#9287)
  * Make Diff Detail on Pull Request Changed File UI always on Top (go-gitea#9280)
  * Switch CSS minifier to cssnano (go-gitea#9260)
  * Fix latest docker image haven't include static files. (go-gitea#9252)
  * Don't link wiki revision to commit (go-gitea#9244)
  * Change review content column to type text in db (go-gitea#9229)
  * Fixed topic regex pattern and added search by topic links after save (go-gitea#9219)
  * Add language to user API responce (go-gitea#9215)
  * Correct tooltip message blocked by dependencies (go-gitea#9211)
  * Add SimpleMDE and Fix Image Paste for Issue/Comment Editor (go-gitea#9197)
  * Fix panic when diff (go-gitea#9187)
  * Fix go-gitea#9151 - smtp logger configuration sendTos should be an array (go-gitea#9154)
  * Fix max length check and limit in multiple repo forms (go-gitea#9148)
  * Always Show Password Field on Link Account Sign-in Page (go-gitea#9147)
  * Properly fix displaying virtual session provider in admin panel (go-gitea#9137)
  * Fix race condition on indexer (go-gitea#9136)
  * Fix team links in HTML rendering (go-gitea#9127)
  * Fix race condition in ReplaceSanitizer (go-gitea#9123)
  * Fix what information is shown about user in API (go-gitea#9115)
  * Fix nil context user for template repositories (go-gitea#9099)
  * Hide given credentials for migrated repos. (go-gitea#9097)
  * Fix reCAPTCHA API URL (go-gitea#9083)
  * Fix password checks on admin create/edit user (go-gitea#9076)
  * Update golang.org/x/crypto vendor to use acme v2 (go-gitea#9056)
  * Ensure Written is set in GZIP ProxyResponseWriter (go-gitea#9018)
  * Fix wrong system notice when repository is empty (go-gitea#9010)
  * Fix broken link to branch from issue list (go-gitea#9003)
  * Fix bug when pack js (go-gitea#8992)
  * New review approvals shouldn't require a message (go-gitea#8991)
  * Shadow password correctly for session config (go-gitea#8984)
  * Don't send notification on pending reviews (go-gitea#8943)
  * Fix Notify Create Ref Error on tag creation (go-gitea#8936)
  * Convert EOL to UNIX-style to render MD properly (go-gitea#8925)
  * Migrate temp_repo.go to use git.NewCommand  (go-gitea#8918)
  * Fix issue with user.fullname (go-gitea#8902)
  * Add Close() method to gogitRepository (go-gitea#8901)
  * Enable punctuations ending mentions (go-gitea#8889)
  * Fix password complexity check on registration (go-gitea#8887)
  * Fix require external registration password (go-gitea#8885)
  * Fix edit content button on migrated issue content (go-gitea#8877)
  * Fix permission checks for close/reopen from commit (go-gitea#8875)
  * Fix API Bug (fail on empty assignees) (go-gitea#8873)
  * Stop using git count-objects and use raw directory size for repository (go-gitea#8848)
  * Fix count for commit graph last page (go-gitea#8843)
  * Fix to close opened io resources as soon as not needed (go-gitea#8839)
  * Improve notification (go-gitea#8835)
  * Fix new user form for non-local users (go-gitea#8826)
  * Fix: remove duplicated signed commit icons (go-gitea#8820)
  * Fix (open/closed) issue count when label excluded (go-gitea#8815)
  * Fix SSH2 conditional in key parsing code (go-gitea#8806)
  * Fix 500 when edit hook (go-gitea#8782)
  * On windows set core.longpaths true (go-gitea#8776)
  * Fix commit expand button to not go to commit link (go-gitea#8745)
  * Avoid re-issuing redundant cross-references. (go-gitea#8734)
  * Fix milestone close timestamp function (go-gitea#8728)
  * Move webhook codes from service to webhook notification (go-gitea#8712)
  * Show zero lines on the line counter if the file empty (go-gitea#8700)
  * Fix deadline on update issue or PR via API (go-gitea#8696)
  * make call createMilestoneComment on newIssue func (go-gitea#8678)
  * Send tag create and push webhook when release created on UI (go-gitea#8671)
  * Prevent chrome download page as html with alt + click (go-gitea#8669)
  * Fix 500 when getting user as unauthenticated user (go-gitea#8653)
  * Graceful fixes (go-gitea#8645)
  * Add SubURL to redirect path (go-gitea#8632) (go-gitea#8634)
  * Fix extra columns from `label` table (go-gitea#8633)
  * Add SubURL to redirect path for transferred/renamed repos (go-gitea#8632)
  * Fix bug when migrate from API (go-gitea#8631)
  * Allow to merge if file path contains " or \ (go-gitea#8629)
  * Prevent removal of non-empty emoji panel following selection of duplicate (go-gitea#8609)
  * Ensure default gpg settings not nil and found commits have reference to repo (go-gitea#8604)
  * Set webhook Content-Type for application/x-www-form-urlencoded (go-gitea#8599)
  * Fix go-gitea#8582 by handling empty repos (go-gitea#8587)
  * Fix of the diff statistics view on pull request's (go-gitea#8581)
  * Fix bug on pull requests when transfer head repository (go-gitea#8564)
  * Fix template error on account page (go-gitea#8562)
  * Allow externalID to be UUID (go-gitea#8551)
  * Fix ignored error on editorconfig api (go-gitea#8550)
  * Fix user avatar name (go-gitea#8547)
  * Ensure that GitRepo is set on Empty repositories (go-gitea#8539)
  * Add missed close in ServeBlobLFS (go-gitea#8527)
  * Fix migrate mirror 500 bug (go-gitea#8526)
  * Fix password complexity regex for special characters (on master) (go-gitea#8525)
* ENHANCEMENTS
  * Add a /user/login landing page option (go-gitea#9622)
  * Some more e-mail notification fixes (go-gitea#9596)
  * Add branch protection option to block merge on requested changes. (go-gitea#9592)
  * Add footer extra links template (go-gitea#9576)
  * Fix for a wrong URL in activity page of repository.  (go-gitea#9571)
  * Update default issue template (go-gitea#9568)
  * Change markdown rendering from blackfriday to goldmark  (go-gitea#9533)
  * Extend file create api with dates (go-gitea#9464)
  * Add ActionCommentPull action (go-gitea#9456)
  * Response for context on retry database connection (go-gitea#9444)
  * Refactor webhooks to reduce code duplication (go-gitea#9422)
  * update couchbase deps for new license (go-gitea#9419)
  * Add .ignore file for search tools (go-gitea#9417)
  * Remove unsued struct (go-gitea#9405)
  * Hide not allowed Reactions (go-gitea#9387)
  * Remove text from action-only webhooks (go-gitea#9377)
  * Move PushToBaseRepo from models to services/pull (go-gitea#9352)
  * Site admin could view org's members (go-gitea#9346)
  * Sleep longer if request speed is over github limitation (go-gitea#9335)
  * Refactor comment (go-gitea#9330)
  * Refactor code indexer (go-gitea#9313)
  * Remove SavePatch and generate patches on the fly (go-gitea#9302)
  * Move some pull request functions from models to services (go-gitea#9266)
  * Update JS dependencies (go-gitea#9255)
  * Show label list on label set (go-gitea#9251)
  * Redirect issue if repo has configured external tracker. (go-gitea#9247)
  * Allow kbd tags (go-gitea#9245)
  * Remove unused comment actions (go-gitea#9222)
  * Fixed errors logging in dump.go (go-gitea#9218)
  * Expose release counter to repo API response (go-gitea#9214)
  * Make consistent links to repository in the Slack/Mattermost notificiations (go-gitea#9205)
  * Expose pull request counter to repo API response (go-gitea#9202)
  * Extend TrackedTimes API (go-gitea#9200)
  * Extend StopWatch API (go-gitea#9196)
  * Move code indexer related code to a new package (go-gitea#9191)
  * Docker: ask s6 to stop all service when gitea stop (go-gitea#9171)
  * Variable expansion in repository templates (go-gitea#9163)
  * Add avatar and issue labels to template repositories (go-gitea#9149)
  * Show single review comments in the PR conversation tab (go-gitea#9143)
  * Extract createComment (go-gitea#9125)
  * Move PushUpdateOptions from models to repofiles (go-gitea#9124)
  * Alternate syntax for cross references (go-gitea#9116)
  * Add USE_SERVICE_WORKER setting (go-gitea#9110)
  * Only show part of members on orgnization dashboard and add paging for orgnization members page (go-gitea#9092)
  * Explore page: Add topic param to pagination (go-gitea#9077) (go-gitea#9078)
  * Markdown: Sanitizier Configuration (go-gitea#9075)
  * Add password requirement info on error (go-gitea#9074)
  * Allow authors to use act keywords in PR content (go-gitea#9059)
  * Move modules/gzip to gitea.com/macaron/gzip (go-gitea#9058)
  * Branch protection: Possibility to not use whitelist but allow anyone with write access (go-gitea#9055)
  * Context menus for comments, add quote reply (go-gitea#9043)
  * Update branch API endpoint to show effective branch protection. (go-gitea#9031)
  * Move git graph from models to modules/graph (go-gitea#9027)
  * Move merge actions to notification (go-gitea#9024)
  * Move mirror sync actions to notification (go-gitea#9022)
  * Add retry for migration http/https requests (go-gitea#9019)
  * Rewrite delivery of issue and comment mails (go-gitea#9009)
  * Add review comments to mail notifications (go-gitea#8996)
  * Refactor pull request review (go-gitea#8954)
  * Githook highlighter (go-gitea#8932)
  * Add git hooks and webhooks to template repositories; move to services (go-gitea#8926)
  * Only view branch or tag if it match refType requested. (go-gitea#8899)
  * Drop Admin attribute based on LDAP when login (continue go-gitea#1743) (go-gitea#8849)
  * Add additional periods to activity page (go-gitea#8829)
  * Update go-org to optimize code (go-gitea#8824)
  * Move some actions to notification/action (go-gitea#8779)
  * Webhook support custom proxy (go-gitea#8760)
  * Fix API deadline removal (go-gitea#8759)
  * Mark review comment as invalidated when file is deleted (go-gitea#8751)
  * Move pull list code to a separate file (go-gitea#8748)
  * Move webhook to a standalone package under modules (go-gitea#8747)
  * Multi repo select on issue page (go-gitea#8741)
  * apply exclude label on milestone issue list (go-gitea#8739)
  * Move issue notifications and assignee man (go-gitea#8713)
  * Move issue change content from models to service (go-gitea#8711)
  * Move issue change status from models to service (go-gitea#8691)
  * Move more issue assignee code from models to issue service (go-gitea#8690)
  * Create PR on Current Repository by Default (go-gitea#8670)
  * Improve Open Graph Protocol (go-gitea#8637)
  * Batch hook pre- and post-receive calls (go-gitea#8602)
  * Improve webhooks (go-gitea#8583)
  * Move transfer repository and rename repository on a service package and start action notification (go-gitea#8573)
  * Implement/Fix PR review webhooks (go-gitea#8570)
  * Rewrite markdown rendering to blackfriday v2 and rewrite orgmode rendering to go-org (go-gitea#8560)
  * Move some repositories' operations to a standalone service package (go-gitea#8557)
  * Allow more than 255 characters for tokens in external_login_user table (go-gitea#8554)
  * Move issue label operations to issue service package (go-gitea#8553)
  * Adjust error reporting from merge failures and use LC_ALL=C for git (go-gitea#8548)
  * Mail assignee when issue/pull request is assigned (go-gitea#8546)
  * Allow committing / adding empty files using the web ui (go-gitea#8420) (go-gitea#8532)
  * Move sync mirror actions to mirror service package (go-gitea#8518)
  * Remove arrows on numeric inputs (go-gitea#8516)
  * Support inline rendering of CUSTOM_URL_SCHEMES (go-gitea#8496)
  * Recalculate repository access only for specific user (go-gitea#8481)
  * Add download button for rull request diff- and patch-file (go-gitea#8470)
  * Add single sign-on support via SSPI on Windows (go-gitea#8463)
  * Move change issue title from models to issue service package (go-gitea#8456)
  * Add included tag on  branch view (go-gitea#8449)
  * Make static resouces web browser cache time customized on app.ini (go-gitea#8442)
  * Enable Uploading/Removing Attachments When Editing an Issue/Comment (go-gitea#8426)
  * Add pagination to commit graph page (go-gitea#8360)
  * Use templates for issue e-mail subject and body (go-gitea#8329)
  * Move clearlabels from models to issue service (go-gitea#8326)
  * Move AddTestPullRequestTask to pull service package from models (go-gitea#8324)
  * Team permission to create repository in organization (go-gitea#8312)
  * Allows external rendering of other filetypes (go-gitea#8300)
  * Add 'Alt + click' feature to exclude labels (go-gitea#8199)
  * Configurable close and reopen keywords for PRs (go-gitea#8120)
  * Configurable URL for static resources (go-gitea#7911)
  * Unifies commit list in repository commit table and wiki revision page (go-gitea#7907)
  * Allow cross-repository dependencies on issues (go-gitea#7901)
  * Auto-subscribe user to repository when they commit/tag to it (go-gitea#7657)
  * Restore Graceful Restarting & Socket Activation (go-gitea#7274)
  * wiki - add 'write' 'preview' buttons to wiki edit like in issues (go-gitea#7241)
  * Change target branch for pull request (go-gitea#6488)
  * Display PR commits and diffs using base repo rather than forked (go-gitea#3648)
* SECURITY
  * Swagger hide search field (go-gitea#9554)
  * Add "search" to reserved usernames (go-gitea#9063)
  * Switch to fomantic-ui (go-gitea#9374)
  * Only serve attachments when linked to issue/release and if accessible by user (go-gitea#9340)
  * Hide credentials when submitting migration through API (go-gitea#9102)
* TESTING
  * Add debug option to serv to help debug problems (go-gitea#9492)
  * Fix the intermittent TestGPGGit failures (go-gitea#9360)
  * Testing: Update postgres sequences (go-gitea#9304)
  * Missed defer prepareTestEnv (go-gitea#9285)
  * Fix "data race" in testlogger (go-gitea#9159)
  * Yet another attempt to fix the intermittent failure of gpg git test (go-gitea#9146)
  * integrations: Fix Dropped Test Errors (go-gitea#9040)
  * services/mirror: fix dropped test errors (go-gitea#9007)
  * Fix intermittent GPG Git test failure (go-gitea#8968)
  * Update Github Migration Tests (go-gitea#8893) (go-gitea#8938)
  * Update heatmap fixtures to restore tests (go-gitea#8615)
* TRANSLATION
  * Fix placeholders in the error message (go-gitea#9060)
  * Fix spelling of admin.users.max_repo_creation (go-gitea#8934)
  * Improve german translation of homepage (go-gitea#8549)
* BUILD
  * Update gitea.com/macaron to 1.4.0 (go-gitea#9608)
  * Upgrade lato fonts to v16. (go-gitea#9498)
  * Update alpine to 3.11 (go-gitea#9440)
  * Upgrade blevesearch (go-gitea#9177)
  * Remove built js/css files from git (go-gitea#9114)
  * Move semantic.dropdown.custom.js to webpack (go-gitea#9064)
  * Check compiled files during build (go-gitea#9042)
  * Enable lazy-loading of gitgraph.js (go-gitea#9036)
  * Pack web_src/js/draw.js to public/js/index.js (go-gitea#8975)
  * Modernize js and use babel (go-gitea#8973)
  * Move index.js to web_src and use webpack to pack them (go-gitea#8598)
  * Restrict modules/graceful to non-windows build and shim IsChild (go-gitea#8537)
  * Upgrade gopkg.in/editorconfig/editorconfig-core-go.v1 (go-gitea#8501)
* DOCS
  * Swagger info corrections (go-gitea#9441) (go-gitea#9558)
  * Add ALLOW_ONLY_EXTERNAL_REGISTRATION to config cheat sheet (go-gitea#8986)
  * Rephrase comment about RuntimeDirectory option in systemd config (go-gitea#8912)
  * Explicitly indicate the socket unit to use the service unit "gitea.service" (go-gitea#8804)
  * Adjust the must-change-password help (go-gitea#8755)
  * Add notice to docs for migrating from more recent versions of Gogs (go-gitea#8724)
  * Add explicit info about customization of homepage (go-gitea#8694)
  * Change external asciidoctor tool to embedded mode (go-gitea#8677)
  * Add Docker fail2ban configuration (go-gitea#8642)
  * Correct some outdated statements in the contributing guidelines (go-gitea#8612)
  * Basic Design guidelines (describing different parts of the code) (go-gitea#8601)
  * Display Gitea logo in Readme (go-gitea#8592)
  * Fix building from source docs to ref AppWorkPath (go-gitea#8567)
  * Update the provided gitea.service to mention socket activation (go-gitea#8531)
  * Doc added how to setup email (go-gitea#8520)
* MISC
  * Add translatable Powered by Gitea text in footer (go-gitea#9600)
  * Add contrib/environment-to-ini (go-gitea#9519)
  * Remove unnecessary loading of settings in update hook (go-gitea#9496)
  * Update gitignore list (go-gitea#9437)
  * Update license list (go-gitea#9436)
  * Fix background reactions in the arc-green theme (go-gitea#9421)
  * Update and fix chardet import (go-gitea#9351)
  * Ensure LF on checkouts and in editors (go-gitea#9259)
  * Fixed topics margin (go-gitea#9248)
  * Add comment to exported function WindowsServiceName (make revive) (go-gitea#9241)
  * Remove empty lines on issues/pulls page (go-gitea#9232)
  * Fix Add Comment Button's "+" Position (go-gitea#9140)
  * Add first issue comment hashtag (go-gitea#9052)
  * Change some label colors (go-gitea#9051)
  * Fix double scroll in branch dropdown (go-gitea#9048)
  * Add comment highlight when target from url (go-gitea#9047)
  * Update display of reactions to issues and comments (go-gitea#9038)
  * Button tooltip formatting under Branches (go-gitea#9034)
  * Allow setting default branch via API (go-gitea#9030)
  * Update dashboard context for PR reviews (go-gitea#8995)
  * Show repository size in repo home page and settings (go-gitea#8940)
  * Allow to add and remove all repositories to/from team. (go-gitea#8867)
  * Show due date in dashboard issues list (go-gitea#8860)
  * Theme arc-green: reverse heatmap colors (go-gitea#8840)
  * Project files table style update (go-gitea#8757)
  * gitignore debugging file from vscode (go-gitea#8740)
  * Add API for Issue set Subscription (go-gitea#8729)
  * Make 100% width search bar (go-gitea#8710)
  * Update color theme for heatmap (go-gitea#8709)
  * Add margin to title_wip_desc (go-gitea#8705)
  * Improve visibility of "Pending" indicator (go-gitea#8685)
  * Improve accessibility of dropdown menus (go-gitea#8638)
  * Make /users/{username}/repos list private repos the current user has access to (go-gitea#8621)
  * Prevent .code-view from overriding font on icon fonts (go-gitea#8614)
  * Add id references on all issue events to allow internal linking (go-gitea#8608)
  * Upgrade xorm to v0.8.0 (go-gitea#8536)
  * Upgrade gopkg.in/ini.v1 (go-gitea#8500)
  * Update CodeMirror to version 5.49.0 (go-gitea#8381)
  * Wiki editor: enable side-by-side button (go-gitea#7242)
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
@delvh delvh removed the type/changelog Adds the changelog for a new Gitea version label Oct 7, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/feature Completely new functionality. Can only be merged if feature freeze is not active.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants