Fix regression of https://codeberg.org/forgejo/forgejo/pulls/5589 & https://codeberg.org/forgejo/forgejo/pulls/7006.
Both added invisible input fields with `required` attribute into the forms used for creating issues and adding comments via `combomarkdowneditor.tmpl`. These fields were not related to the form and were only used for the modal dialogs.
* When JS is on, modals are moved out of the form to the bottom of the page by JS that handles modals
* When JS is off, the forms are stuck with invisible inputs preventing form submission
* Another side effect is that request data contains these unwanted fields
This was fixed by adding attribute `disabled` to unwanted inputs. Then JS removes it on initialization. Thanks to @Beowulf for helping with choosing the approach!
When a field is `disabled`, the browser doesn't consider it in form validation and doesn't even include it in the request data.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9614
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
The codeowner features computes the mergebase (I'm not exactly sure why, because this should be stored in the database in `merge_base` column, but if there's no harm to compute it again as that will always be the correct answer) in order to get the changed files between the merge base and the head commit. To do this a function was used that adds a remote... my best reasoning is that this was done because the only function that that was exported on the repository struct had this requirement. Add a new function that *simply* computes the merge base without requiring a remote.
The main benefit of not using a remote is that within Codeberg we are frequently seeing `config.lock` being lingered around (see forgejo/forgejo#1946) so its best to avoid modifying the config when possible - in this case it was completely unnecessary.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9610
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This patch contains two fixes/enhancements to two functions that were updating all columns of the `access_token` and `repository` table when they were only updating a select few columns. Within Codeberg we saw these two queries quite often when something problematic with the database was going on, likely because of this all columns update pattern. `UpdateAccessToken` is removed and a new function `UpdateLastUsed` was added, for `updateRepoRunsNumbers` we can simply add which columns we want to have updated in that query.
It's likely there are more of such queries, but these were the ones being executed often.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9572
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| registry.redict.io/redict | service | patch | `7.3.5-scratch` -> `7.3.6-scratch` |
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMzUuNSIsInVwZGF0ZWRJblZlciI6IjQxLjEzNS41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9576
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Fixes#9433.
```
$ ./gitea admin user create --username blah --must-change-password false
Hint: boolean false must be specified as a single arg, eg. '--restricted=false', not '--restricted false'
Command error: unexpected arguments: false
```
**Breaking**: CLI sub-commands that only have flags would previously ignore anything that might be considered an "extra" argument, and would proceed without any errors.
I've manually tested this change on the single `admin user create` command with positive (ensuring cmd still works) and negative (ensuring errors are reported) test cases.
I've attempted to ensure the change is applied only to commands which don't use the CLI `Args()` and avoided touching them, including:
- `admin user must-change-password` takes a list of users
- `doctor recreate-tables` takes a list of tables
- `embedded [list/view/extract]` use a pattern of resources to operate upon
- git repo hook subcommands, and the ssh serv command, use arguments and have been omitted from the change
## Checklist
The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).
### Tests
- I added test coverage for Go changes...
- [ ] in their respective `*_test.go` for unit tests.
- [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
### Documentation
- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
### Release notes
- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [x] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9458
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.24.7` -> `1.24.8` |
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMzUuNSIsInVwZGF0ZWRJblZlciI6IjQxLjEzNS41IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9559
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
This PR fixes an issue where forked `.profile` repositories were unexpectedly displaying profile content on user profile pages. The fix ensures that only regular `.profile` repositories (not forks) are used to populate user profiles.
Fixes#9235
### Problem
When a user forked a repository named `.profile` without having created their own `.profile` repository, the content from the forked repository was unexpectedly displayed on their public profile page. This could lead to users' profiles displaying content they did not intentionally create for that purpose.
This issue was particularly problematic on instances where users had repository creation limits (-1) and would inappropriately use forked `.profile` repositories to obtain profile customization.
### Solution
Modified the `FindUserProfileReadme()` function in `routers/web/shared/user/header.go` to check if the `.profile` repository is a fork (`profileDbRepo.IsFork`) and return early if it is, preventing forked repositories from being used for profile content.
**For existing users:**
- Users with forked `.profile` repositories will no longer see unexpected profile content
- No action required unless they want to keep the content
**For users who want to use forked content:**
- Can convert the fork to a regular repository in Repository Settings → "Danger Zone" → "Convert fork"
- This preserves the content while making it available for profile display
### Testing
- I added test coverage for Go changes...
- [ ] in their respective `*_test.go` for unit tests.
- [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
- [ ] in `web_src/js/*.test.js` if it can be unit tested.
- [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
**Tests:** Added comprehensive integration test `forked-profile-repo` that verifies:
- Original `.profile` repositories still work correctly
- Forked `.profile` repositories do not display profile content
- Forked repositories remain accessible via direct repository URLs
- Fork relationships are maintained correctly
### Documentation
- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.
Docs PR is here: https://codeberg.org/forgejo/docs/pulls/1525
### Release notes
- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [x] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.
Release Notes available at `release-notes/9235.md`
---
More at: https://codeberg.org/fedora/forgejo-deployment/issues/167
<!--start release-notes-assistant-->
## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Breaking bug fixes
- [PR](https://codeberg.org/forgejo/forgejo/pulls/9513): <!--number 9513 --><!--line 0 --><!--description Zml4ITogUHJldmVudCBmb3JrZWQgYC5wcm9maWxlYCByZXBvc2l0b3JpZXMgZnJvbSBkaXNwbGF5aW5nIHByb2ZpbGUgY29udGVudC4gV2hlbiBhIHVzZXIgZm9ya2VkIGEgcmVwb3NpdG9yeSBuYW1lZCBgLnByb2ZpbGVgIHdpdGhvdXQgaGF2aW5nIGNyZWF0ZWQgdGhlaXIgb3duIGAucHJvZmlsZWAgcmVwb3NpdG9yeSwgdGhlIGNvbnRlbnQgZnJvbSB0aGUgZm9ya2VkIHJlcG9zaXRvcnkgd2FzIHVuZXhwZWN0ZWRseSBkaXNwbGF5ZWQgb24gdGhlaXIgcHVibGljIHByb2ZpbGUgcGFnZS4gVGhpcyBjb3VsZCBsZWFkIHRvIHVzZXJzJyBwcm9maWxlcyBkaXNwbGF5aW5nIGNvbnRlbnQgdGhleSBkaWQgbm90IGludGVudGlvbmFsbHkgY3JlYXRlIGZvciB0aGF0IHB1cnBvc2UuIEZvcmtlZCBgLnByb2ZpbGVgIHJlcG9zaXRvcmllcyBhcmUgbm93IHRyZWF0ZWQgYXMgc3RhbmRhcmQgcmVwb3NpdG9yaWVzIGFuZCBkbyBub3QgcG9wdWxhdGUgdGhlIHVzZXIncyBwdWJsaWMgcHJvZmlsZSBwYWdlLiBVc2VycyB3aG8gd2lzaCB0byB1c2UgdGhlIGNvbnRlbnQgZnJvbSBhIGZvcmtlZCBgLnByb2ZpbGVgIHJlcG9zaXRvcnkgY2FuIGNvbnZlcnQgdGhlIGZvcmsgdG8gYSByZWd1bGFyIHJlcG9zaXRvcnkgaW4gdGhlICJEYW5nZXIgWm9uZSIgc2VjdGlvbiBvZiBSZXBvc2l0b3J5IHNldHRpbmdzLiBUaGlzIGlzc3VlIHdhcyBwYXJ0aWN1bGFybHkgcHJvYmxlbWF0aWMgb24gaW5zdGFuY2VzIHdoZXJlIHVzZXJzIGhhZCByZXBvc2l0b3J5IGNyZWF0aW9uIGxpbWl0cyAoLTEpIGFuZCB3b3VsZCBpbmFwcHJvcHJpYXRlbHkgdXNlIGZvcmtlZCBgLnByb2ZpbGVgIHJlcG9zaXRvcmllcyB0byBvYnRhaW4gcHJvZmlsZSBjdXN0b21pemF0aW9uLiA=-->fix!: Prevent forked `.profile` repositories from displaying profile content. When a user forked a repository named `.profile` without having created their own `.profile` repository, the content from the forked repository was unexpectedly displayed on their public profile page. This could lead to users' profiles displaying content they did not intentionally create for that purpose. Forked `.profile` repositories are now treated as standard repositories and do not populate the user's public profile page. Users who wish to use the content from a forked `.profile` repository can convert the fork to a regular repository in the "Danger Zone" section of Repository settings. This issue was particularly problematic on instances where users had repository creation limits (-1) and would inappropriately use forked `.profile` repositories to obtain profile customization.<!--description-->
<!--end release-notes-assistant-->
Co-authored-by: mfenniak <mfenniak@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9513
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Ryan Lerch <rlerch@redhat.com>
Co-committed-by: Ryan Lerch <rlerch@redhat.com>
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMzEuOSIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9539
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
0ko