Gusted and Gusted
691dd023ff
chore: unify the usage of CryptoRandomString ( #10110 )
...
- Similair spirit of forgejo/forgejo!7453 .
- Refactor the code in such a way that it always succeeds.
- To avoid doing mathematics if you use this function, define three security level (64, 128 and 256 bits) that correspond to a specific length which has that a security guarantee. I picked them as they fit the need for the existing usages of the code.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10110
Reviewed-by: Michael Kriese <michael.kriese@gmx.de >
Reviewed-by: Lucas <sclu1034@noreply.codeberg.org >
Co-authored-by: Gusted <postmaster@gusted.xyz >
Co-committed-by: Gusted <postmaster@gusted.xyz >
2025-11-15 13:24:53 +01:00
Gusted and Earl Warren
53df0bf9a4
chore(sec): unify usage of crypto/rand.Read ( #7453 )
...
- Unify the usage of [`crypto/rand.Read`](https://pkg.go.dev/crypto/rand#Read ) to `util.CryptoRandomBytes`.
- Refactor `util.CryptoRandomBytes` to never return an error. It is documented by Go, https://go.dev/issue/66821 , to always succeed. So if we still receive a error or if the returned bytes read is not equal to the expected bytes to be read we panic (just to be on the safe side).
- This simplifies a lot of code to no longer care about error handling.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7453
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org >
Co-authored-by: Gusted <postmaster@gusted.xyz >
Co-committed-by: Gusted <postmaster@gusted.xyz >
2025-04-04 03:31:37 +00:00
Gusted and Gusted
2457f5ff22
chore: branding import path ( #7337 )
...
- Massive replacement of changing `code.gitea.io/gitea` to `forgejo.org`.
- Resolves forgejo/discussions#258
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7337
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org >
Reviewed-by: Michael Kriese <michael.kriese@gmx.de >
Reviewed-by: Beowulf <beowulf@beocode.eu >
Reviewed-by: Panagiotis "Ivory" Vasilopoulos <git@n0toose.net >
Co-authored-by: Gusted <postmaster@gusted.xyz >
Co-committed-by: Gusted <postmaster@gusted.xyz >
2025-03-27 19:40:14 +00:00
TheFox0x7 and Earl Warren
4de909747b
Add testifylint to lint checks ( #4535 )
...
go-require lint is ignored for now
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/4535
Reviewed-by: Gusted <gusted@noreply.codeberg.org >
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com >
Co-committed-by: TheFox0x7 <thefox0x7@gmail.com >
2024-07-30 19:41:10 +00:00
wxiaoguang and Gusted
62d3e5255f
Port "Use general token signing secret"
...
Port of https://github.com/go-gitea/gitea/pull/29205
Use a clearly defined "signing secret" for token signing.
(cherry picked from commit 8be198cdef0a486f417663b1fd6878458d7e5d92)
2024-02-19 20:49:37 +01:00
Gusted and Earl Warren
464ae81a36
[GITEA] Refactor generation of JWT secret
...
- Remove non base64-ed version of JWT secret generation. Because all
occurences need the Base64 version.
(cherry picked from commit 6a6b5a31a8e38cb953fcca1c8847ea219234f10c)
(cherry picked from commit 066b8ca6b40a7342352983de35f1ca6683927426)
2024-02-05 16:54:44 +01:00
wxiaoguang and GitHub
ed1be4ca68
Handle base64 decoding correctly to avoid panic ( #26483 )
...
Fix the panic if the "base64 secret" is too long.
2023-08-14 10:30:16 +00:00
0f9f6567bb
Bump github.com/golang-jwt/jwt to v5 ( #25975 )
...
Bumping `github.com/golang-jwt/jwt` from v4 to v5.
`github.com/golang-jwt/jwt` v5 is bringing some breaking changes:
- standard `Valid()` method on claims is removed. It's replaced by
`ClaimsValidator` interface implementing `Validator()` method instead,
which is called after standard validation. Gitea doesn't seem to be
using this logic.
- `jwt.Token` has a field `Valid`, so it's checked in `ParseToken`
function in `services/auth/source/oauth2/token.go`
---------
Co-authored-by: Giteabot <teabot@gitea.io >
2023-07-19 09:57:10 +00:00
e81ccc406b
Implement FSFE REUSE for golang files ( #21840 )
...
Change all license headers to comply with REUSE specification.
Fix #16132
Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github>
Co-authored-by: John Olheiser <john.olheiser@gmail.com >
2022-11-27 18:20:29 +00:00
wxiaoguang and GitHub
49dd906753
Use base32 for 2FA scratch token ( #18384 )
...
* Use base32 for 2FA scratch token
* rename Secure* to Crypto*, add comments
2022-01-26 12:10:10 +08:00
35c3553870
Support webauthn ( #17957 )
...
Migrate from U2F to Webauthn
Co-authored-by: Andrew Thornton <art27@cantab.net >
Co-authored-by: 6543 <6543@obermui.de >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2022-01-14 16:03:31 +01:00
29a22ade82
switch to maintained lib ( #16532 )
...
Co-authored-by: 6543 <6543@obermui.de >
Co-authored-by: Andrew Thornton <art27@cantab.net >
2021-07-24 13:00:41 +02:00
KN4CK3R and GitHub
29695cd6d5
Add asymmetric JWT signing ( #16010 )
...
* Added asymmetric token signing.
* Load signing key from settings.
* Added optional kid parameter.
* Updated documentation.
* Add "kid" to token header.
2021-06-17 23:56:46 +02:00
1e6fa57acb
Use single shared random string generation function ( #15741 )
...
* Use single shared random string generation function
- Replace 3 functions that do the same with 1 shared one
- Use crypto/rand over math/rand for a stronger RNG
- Output only alphanumerical for URL compatibilty
Fixes : #15536
* use const string method
* Update modules/avatar/avatar.go
Co-authored-by: a1012112796 <1012112796@qq.com >
Co-authored-by: a1012112796 <1012112796@qq.com >
2021-05-10 07:45:17 +01:00
John Olheiser and GitHub
baadb51445
Add gitea-vet ( #10948 )
...
* Add copyright
Signed-off-by: jolheiser <john.olheiser@gmail.com >
* Add gitea-vet and fix non-compliance
Signed-off-by: jolheiser <john.olheiser@gmail.com >
* Combine tools.go into build.go and clean up
Signed-off-by: jolheiser <john.olheiser@gmail.com >
* Remove extra GO111MODULE=on
Signed-off-by: jolheiser <john.olheiser@gmail.com >
2020-04-05 07:20:50 +01:00
Jonas Franz and techknowlogick
e777c6bdc6
Integrate OAuth2 Provider ( #5378 )
2019-03-08 11:42:50 -05:00
Codruț Constantin Gușoi and Lauris BH
96c268c0fc
Implements generator cli for secrets ( #3531 )
...
Signed-off-by: Codruț Constantin Gușoi <codrut.gusoi@gmail.com >
2018-02-18 20:14:37 +02:00
