MokoGitea-Fork

Author	SHA1	Message	Date
jmiller	49f6380fa4	feat: add licensing API token scope (#697 ) Universal: Auto Version Bump / Version Bump (push) Successful in 17s Details PR RC Release / Build RC Release (pull_request) Successful in 3s Details Universal: PR Check / Branch Policy (pull_request) Failing after 2s Details Universal: PR Check / Validate PR (pull_request) Failing after 11s Details Universal: PR Check / Secret Scan (pull_request) Successful in 43s Details Universal: Build & Release / Promote to RC (pull_request) Has been skipped Details RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped Details Branch Cleanup / Delete merged branch (pull_request) Successful in 3s Details Universal: Build & Release / Build & Release Pipeline (pull_request) Failing after 1m13s Details Universal: Workflow Sync Trigger / Sync workflows to live repos (pull_request) Failing after 4m6s Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Universal: PR Check / Report Issues (pull_request) Has been cancelled Details Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
TheFox0x7	ee3c82f874	Enable addtional linters (#34085 ) enable mirror, usestdlibbars and perfsprint part of: https://github.com/go-gitea/gitea/issues/34083 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2025-04-01 10:14:01 +00:00
Guillaume	303af554c9	Improve "generate new access token" form (#33730 ) Fix: https://github.com/go-gitea/gitea/issues/33519 As discussed in [PR #33614](https://github.com/go-gitea/gitea/pull/33614), the ScopedAccessTokenSelector Vue component is not particularly useful. This PR removes the component and reverts to using HTML templates. It also introduces some (hopefully) useful refactoring. The Vue component was causing the UX bug reported in the linked issue. Required form fields are now properly working, as expected (see screenshot). ![Screenshot from 2025-02-25 22-00-28](https://github.com/user-attachments/assets/41167854-0718-48b0-a3ee-75ca3a7b8b20) --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2025-02-27 19:40:12 +00:00
KN4CK3R	c6c829fe3f	Enhanced auth token / remember me (#27606 ) Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.	2023-10-14 00:56:41 +00:00

4 Commits