Merge remote-tracking branch 'giteaofficial/main'

* giteaofficial/main: (42 commits)
  Link issue and pull requests status change in UI notifications directly to their event in the timelined view. (go-gitea#22627)
  fix permission check for creating comment while mail (go-gitea#22524)
  Fix error on account activation with wrong passwd (go-gitea#22609)
  Fixes accessibility of empty repository commit status (go-gitea#22632)
  Use `--index-url` in PyPi description (go-gitea#22620)
  Show migration validation error (go-gitea#22619)
  Allow issue templates to not render title (go-gitea#22589)
  Fix `delete_repo` in template (go-gitea#22606)
  set org visibility class to basic in header (go-gitea#22605)
  Add API endpoint to get latest release (go-gitea#21267)
  Add ARIA support for Fomantic UI checkboxes (go-gitea#22599)
  Webhooks: for issue close/reopen action, add commit ID that caused it (go-gitea#22583)
  Add templates to customize text when creating and migrating repositories
  Prevent duplicate labels when importing more than 99 (go-gitea#22591)
  Remove address from DCO (go-gitea#22595)
  Allow setting `redirect_to` cookie on OAuth login (go-gitea#22594)
  Project links should use parent link methods (go-gitea#22587)
  link update in README files (go-gitea#22582)
  Frontport 1.18.2 and 1.18.3 Changelogs (go-gitea#22580)
  Fix incorrect Redis URL snippets in the example app.ini (go-gitea#22573)
  ...

.drone.yml

@@ -555,7 +555,7 @@ steps:
 
   # TODO: We should probably build all dependencies into a test image
   - name: test-e2e
-    image: mcr.microsoft.com/playwright:v1.29.0-focal
+    image: mcr.microsoft.com/playwright:v1.29.2-focal
     commands:
       - curl -sLO https://go.dev/dl/go1.19.linux-amd64.tar.gz && tar -C /usr/local -xzf go1.19.linux-amd64.tar.gz
       - groupadd --gid 1001 gitea && useradd -m --gid 1001 --uid 1001 gitea

.eslintrc.yaml

@@ -84,6 +84,7 @@ rules:
   id-length: [0]
   id-match: [0]
   implicit-arrow-linebreak: [0]
+  import/consistent-type-specifier-style: [0]
   import/default: [0]
   import/dynamic-import-chunkname: [0]
   import/export: [2]
@@ -103,6 +104,7 @@ rules:
   import/no-default-export: [0]
   import/no-deprecated: [0]
   import/no-dynamic-require: [0]
+  import/no-empty-named-blocks: [2]
   import/no-extraneous-dependencies: [2]
   import/no-import-module-exports: [0]
   import/no-internal-modules: [0]

.gitpod.yml

@@ -7,10 +7,6 @@ tasks:
     command: |
       gp sync-done setup
       exit 0
-  - name: Run frontend
-    command: |
-      gp sync-await setup
-      make watch-frontend
   - name: Run backend
     command: |
       gp sync-await setup
@@ -19,9 +15,15 @@ tasks:
       echo -e "\n[database]\nDB_TYPE = sqlite3\nPATH = $GITPOD_REPO_ROOT/data/gitea.db" >> custom/conf/app.ini
       export TAGS="sqlite sqlite_unlock_notify"
       make watch-backend
+  - name: Run frontend
+    command: |
+      gp sync-await setup
+      make watch-frontend
+    openMode: split-right
   - name: Run docs
     before: sudo bash -c "$(grep 'https://github.com/gohugoio/hugo/releases/download' Makefile | tr -d '\')" # install hugo
     command: cd docs && make clean update && hugo server -D -F --baseUrl $(gp url 1313) --liveReloadPort=443 --appendPort=false --bind=0.0.0.0
+    openMode: split-right
 
 vscode:
   extensions:

CHANGELOG.md

@@ -4,6 +4,25 @@ This changelog goes through all the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.io).
 
+## [1.18.3](https://github.com/go-gitea/gitea/releases/tag/v1.18.3) - 2023-01-23
+
+* SECURITY
+  * Prevent multiple `To` recipients (#22566) (#22569)
+* BUGFIXES
+  * Truncate commit summary on repo files table. (#22551) (#22552)
+  * Mute all links in issue timeline (#22534)
+
+## [1.18.2](https://github.com/go-gitea/gitea/releases/tag/v1.18.2) - 2023-01-19
+
+* BUGFIXES
+  * Fix issue not auto-closing when it includes a reference to a branch (#22514) (#22521)
+  * Fix invalid issue branch reference if not specified in template (#22513) (#22520)
+  * Fix 500 error viewing pull request when fork has pull requests disabled (#22512) (#22515)
+  * Reliable selection of admin user (#22509) (#22511)
+  * Set disable_gravatar/enable_federated_avatar when offline mode is true (#22479) (#22496)
+* BUILD
+  * cgo cross-compile for freebsd (#22397) (#22519)
+
 ## [1.18.1](https://github.com/go-gitea/gitea/releases/tag/v1.18.1) - 2023-01-17
 
 * API

DCO

@@ -2,8 +2,6 @@ Developer Certificate of Origin
 Version 1.1
 
 Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
 
 Everyone is permitted to copy and distribute verbatim copies of this
 license document, but changing it is not allowed.
@@ -33,4 +31,4 @@ By making a contribution to this project, I certify that:
     are public and that a record of the contribution (including all
     personal information I submit with it, including my sign-off) is
     maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
+    this project or the open source license(s) involved.

README.md

@@ -12,14 +12,14 @@
   <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
     <img src="https://img.shields.io/discord/322538954119184384.svg">
   </a>
-  <a href="https://codecov.io/gh/go-gitea/gitea" title="Codecov">
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
     <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
   </a>
   <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
     <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
   </a>
-  <a href="https://godoc.org/code.gitea.io/gitea" title="GoDoc">
-    <img src="https://godoc.org/code.gitea.io/gitea?status.svg">
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
   </a>
   <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
     <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
@@ -45,7 +45,7 @@
   <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
     <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
   </a>
-  <a href="https://www.bountysource.com/teams/gitea" title="Bountysource">
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
     <img src="https://img.shields.io/bountysource/team/gitea/activity">
   </a>
 </p>

README_ZH.md

@@ -12,14 +12,14 @@
   <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
     <img src="https://img.shields.io/discord/322538954119184384.svg">
   </a>
-  <a href="https://codecov.io/gh/go-gitea/gitea" title="Codecov">
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
     <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
   </a>
   <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
     <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
   </a>
-  <a href="https://godoc.org/code.gitea.io/gitea" title="GoDoc">
-    <img src="https://godoc.org/code.gitea.io/gitea?status.svg">
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
   </a>
   <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
     <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
@@ -45,7 +45,7 @@
   <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
     <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
   </a>
-  <a href="https://img.shields.io/bountysource/team/gitea" title="Bountysource">
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
     <img src="https://img.shields.io/bountysource/team/gitea/activity">
   </a>
 </p>

custom/conf/app.example.ini

@@ -1721,7 +1721,7 @@ ROUTER = console
 ;INTERVAL = 60
 ;;
 ;; For "redis" and "memcache", connection host address
-;; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
 ;; memcache: `127.0.0.1:11211`
 ;; twoqueue: `{"size":50000,"recent_ratio":0.25,"ghost_ratio":0.5}` or `50000`
 ;HOST =
@@ -1760,7 +1760,7 @@ ROUTER = console
 ;; Provider config options
 ;; memory: doesn't have any config yet
 ;; file: session file path, e.g. `data/sessions`
-;; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
+;; redis: `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`
 ;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
 ;PROVIDER_CONFIG = data/sessions ; Relative paths will be made absolute against _`AppWorkPath`_.
 ;;
@@ -2380,8 +2380,8 @@ ROUTER = console
 ;QUEUE_LENGTH = 1000
 ;;
 ;; Task queue connection string, available only when `QUEUE_TYPE` is `redis`.
-;; If there is a password of redis, use `addrs=127.0.0.1:6379 password=123 db=0`.
-;QUEUE_CONN_STR = "addrs=127.0.0.1:6379 db=0"
+;; If there is a password of redis, use `redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s`.
+;QUEUE_CONN_STR = "redis://127.0.0.1:6379/0?pool_size=100&idle_timeout=180s"
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

docs/content/doc/features/comparison.en-us.md

@@ -74,7 +74,7 @@ _Symbols used in table:_
 | Granular user roles (Code, Issues, Wiki, …) | ✓                                                   | ✘    | ✘         | ✓         | ✓         | ✘         | ✘            |
 | Verified Committer                          | ⁄                                                   | ✘    | ?         | ✓         | ✓         | ✓         | ✘            |
 | GPG Signed Commits                          | ✓                                                   | ✘    | ✓         | ✓         | ✓         | ✓         | ✓            |
-| SSH Signed Commits                          | ✓                                                   | ✘    | ✓         | ✘         | ✘         | ?         | ?            |
+| SSH Signed Commits                          | ✓                                                   | ✘    | ✓         | ✓         | ✓         | ?         | ?            |
 | Reject unsigned commits                     | ✓                                                   | ✘    | ✓         | ✓         | ✓         | ✓         | ✓            |
 | Migrating repos from other services         | ✓                                                   | ✘    | ✓         | ✓         | ✓         | ✓         | ✓            |
 | Repository Activity page                    | ✓                                                   | ✘    | ✓         | ✓         | ✓         | ✓         | ✓            |

docs/content/doc/packages/pypi.en-us.md

@@ -77,6 +77,8 @@ For example:
 pip install --index-url https://testuser:password123@gitea.example.com/api/packages/testuser/pypi/simple --no-deps test_package
 ```
 
+You can use `--extra-index-url` instead of `--index-url` but that makes you vulnerable to dependency confusion attacks because `pip` checks the official PyPi repository for the package before it checks the specified custom repository. Read the `pip` docs for more information.
+
 ## Supported commands
 
 ```

models/fixtures/project.yml

@@ -24,3 +24,12 @@
   creator_id: 5
   board_type: 1
   type: 2
+
+-
+  id: 4
+  title: project on user2
+  owner_id: 2
+  is_closed: false
+  creator_id: 2
+  board_type: 1
+  type: 2

models/fixtures/project_board.yml

@@ -21,3 +21,11 @@
   creator_id: 2
   created_unix: 1588117528
   updated_unix: 1588117528
+
+-
+  id: 4
+  project_id: 4
+  title: Done
+  creator_id: 2
+  created_unix: 1588117528
+  updated_unix: 1588117528

models/issues/comment.go

@@ -175,6 +175,15 @@ func (t CommentType) String() string {
 	return commentStrings[t]
 }
 
+func AsCommentType(typeName string) CommentType {
+	for index, name := range commentStrings {
+		if typeName == name {
+			return CommentType(index)
+		}
+	}
+	return CommentTypeUnknown
+}
+
 // RoleDescriptor defines comment tag type
 type RoleDescriptor int
 

models/issues/comment_test.go

@@ -62,3 +62,10 @@ func TestFetchCodeComments(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, res, 1)
 }
+
+func TestAsCommentType(t *testing.T) {
+	assert.Equal(t, issues_model.CommentTypeUnknown, issues_model.AsCommentType(""))
+	assert.Equal(t, issues_model.CommentTypeUnknown, issues_model.AsCommentType("nonsense"))
+	assert.Equal(t, issues_model.CommentTypeComment, issues_model.AsCommentType("comment"))
+	assert.Equal(t, issues_model.CommentTypePRUnScheduledToAutoMerge, issues_model.AsCommentType("pull_cancel_scheduled_merge"))
+}

models/issues/issue.go

@@ -1098,7 +1098,7 @@ func GetIssueWithAttrsByID(id int64) (*Issue, error) {
 }
 
 // GetIssuesByIDs return issues with the given IDs.
-func GetIssuesByIDs(ctx context.Context, issueIDs []int64) ([]*Issue, error) {
+func GetIssuesByIDs(ctx context.Context, issueIDs []int64) (IssueList, error) {
 	issues := make([]*Issue, 0, 10)
 	return issues, db.GetEngine(ctx).In("id", issueIDs).Find(&issues)
 }

models/issues/issue_project.go

@@ -125,13 +125,17 @@ func ChangeProjectAssign(issue *Issue, doer *user_model.User, newProjectID int64
 func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.User, newProjectID int64) error {
 	oldProjectID := issue.projectID(ctx)
 
+	if err := issue.LoadRepo(ctx); err != nil {
+		return err
+	}
+
 	// Only check if we add a new project and not remove it.
 	if newProjectID > 0 {
 		newProject, err := project_model.GetProjectByID(ctx, newProjectID)
 		if err != nil {
 			return err
 		}
-		if newProject.RepoID != issue.RepoID {
+		if newProject.RepoID != issue.RepoID && newProject.OwnerID != issue.Repo.OwnerID {
 			return fmt.Errorf("issue's repository is not the same as project's repository")
 		}
 	}
@@ -140,10 +144,6 @@ func addUpdateIssueProject(ctx context.Context, issue *Issue, doer *user_model.U
 		return err
 	}
 
-	if err := issue.LoadRepo(ctx); err != nil {
-		return err
-	}
-
 	if oldProjectID > 0 || newProjectID > 0 {
 		if _, err := CreateComment(ctx, &CreateCommentOptions{
 			Type:         CommentTypeProject,

models/organization/team.go

@@ -16,8 +16,6 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/builder"
 )
 
 // ___________
@@ -96,59 +94,6 @@ func init() {
 	db.RegisterModel(new(TeamInvite))
 }
 
-// SearchTeamOptions holds the search options
-type SearchTeamOptions struct {
-	db.ListOptions
-	UserID      int64
-	Keyword     string
-	OrgID       int64
-	IncludeDesc bool
-}
-
-func (opts *SearchTeamOptions) toCond() builder.Cond {
-	cond := builder.NewCond()
-
-	if len(opts.Keyword) > 0 {
-		lowerKeyword := strings.ToLower(opts.Keyword)
-		var keywordCond builder.Cond = builder.Like{"lower_name", lowerKeyword}
-		if opts.IncludeDesc {
-			keywordCond = keywordCond.Or(builder.Like{"LOWER(description)", lowerKeyword})
-		}
-		cond = cond.And(keywordCond)
-	}
-
-	if opts.OrgID > 0 {
-		cond = cond.And(builder.Eq{"`team`.org_id": opts.OrgID})
-	}
-
-	if opts.UserID > 0 {
-		cond = cond.And(builder.Eq{"team_user.uid": opts.UserID})
-	}
-
-	return cond
-}
-
-// SearchTeam search for teams. Caller is responsible to check permissions.
-func SearchTeam(opts *SearchTeamOptions) ([]*Team, int64, error) {
-	sess := db.GetEngine(db.DefaultContext)
-
-	opts.SetDefaultValues()
-	cond := opts.toCond()
-
-	if opts.UserID > 0 {
-		sess = sess.Join("INNER", "team_user", "team_user.team_id = team.id")
-	}
-	sess = db.SetSessionPagination(sess, opts)
-
-	teams := make([]*Team, 0, opts.PageSize)
-	count, err := sess.Where(cond).OrderBy("lower_name").FindAndCount(&teams)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	return teams, count, nil
-}
-
 // ColorFormat provides a basic color format for a Team
 func (t *Team) ColorFormat(s fmt.State) {
 	if t == nil {
@@ -335,16 +280,6 @@ func GetTeamNamesByID(teamIDs []int64) ([]string, error) {
 	return teamNames, err
 }
 
-// GetRepoTeams gets the list of teams that has access to the repository
-func GetRepoTeams(ctx context.Context, repo *repo_model.Repository) (teams []*Team, err error) {
-	return teams, db.GetEngine(ctx).
-		Join("INNER", "team_repo", "team_repo.team_id = team.id").
-		Where("team.org_id = ?", repo.OwnerID).
-		And("team_repo.repo_id=?", repo.ID).
-		OrderBy("CASE WHEN name LIKE '" + OwnerTeamName + "' THEN '' ELSE name END").
-		Find(&teams)
-}
-
 // IncrTeamRepoNum increases the number of repos for the given team by 1
 func IncrTeamRepoNum(ctx context.Context, teamID int64) error {
 	_, err := db.GetEngine(ctx).Incr("num_repos").ID(teamID).Update(new(Team))