Files
gitocean/templates/repo/release/new.tmpl
T
GustedandGusted a4642af51a feat: replace cross origin protection (#9830)
Replace the anti-CSRF token with a [cross origin protection by Go](https://go.dev/doc/go1.25#nethttppkgnethttp) that uses a stateless way of verifying if a request was cross origin or not. This allows is to remove al lot of code and replace it with a few lines of code and we no longer have to hand roll this protection. The new protection uses indicators by the browser itself that indicate if the request is cross-origin, thus we no longer have to take care of ensuring the generated CSRF token is passed back to the server any request by the the browser will have send this indicator.

Resolves forgejo/forgejo#3538

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9830
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-29 22:43:22 +01:00

181 lines
7.9 KiB
Go HTML Template

{{template "base/head" .}}
<div role="main" aria-label="{{.Title}}" class="page-content repository new release">
{{template "repo/header" .}}
<div class="ui container">
<h2 class="ui dividing header">
{{if .PageIsEditRelease}}
{{ctx.Locale.Tr "repo.release.edit_release"}}
<div class="sub header">{{ctx.Locale.Tr "repo.release.edit_subheader"}}</div>
{{else}}
{{ctx.Locale.Tr "repo.release.new_release"}}
<div class="sub header">{{ctx.Locale.Tr "repo.release.new_subheader"}}</div>
{{end}}
</h2>
{{template "base/alert" .}}
<form class="ui form" action="{{.Link}}" method="post">
<div class="ui seven wide target">
<div class="inline field {{if .Err_TagName}}error{{end}}">
{{if .PageIsEditRelease}}
<b>{{.tag_name}}</b><span class="at">@</span><strong>{{.tag_target}}</strong>
{{else}}
<input id="tag-name" name="tag_name" value="{{.tag_name}}" aria-label="{{ctx.Locale.Tr "repo.release.tag_name"}}" placeholder="{{ctx.Locale.Tr "repo.release.tag_name"}}" autofocus required maxlength="255">
<input id="tag-name-editor" type="hidden" data-existing-tags="{{JsonUtils.EncodeToString .Tags}}" data-tag-helper="{{ctx.Locale.Tr "repo.release.tag_helper"}}" data-tag-helper-new="{{ctx.Locale.Tr "repo.release.tag_helper_new"}}" data-tag-helper-existing="{{ctx.Locale.Tr "repo.release.tag_helper_existing"}}">
<div id="tag-target-selector" class="tw-inline-block">
<span class="at">@</span>
<div class="ui selection dropdown">
<input type="hidden" name="tag_target" value="{{.tag_target}}">
{{svg "octicon-git-branch"}}
<div class="text">
{{ctx.Locale.Tr "repo.release.target"}} :
<strong id="repo-branch-current">{{.Repository.DefaultBranch}}</strong>
</div>
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
<div class="menu">
{{range .Branches}}
<div class="item" data-value="{{.}}">{{.}}</div>
{{end}}
</div>
</div>
</div>
<div>
<span id="tag-helper" class="help tw-mt-2 tw-pb-0">{{ctx.Locale.Tr "repo.release.tag_helper"}}</span>
</div>
{{end}}
</div>
</div>
<div class="eleven wide tw-pt-0">
<div class="field {{if .Err_Title}}error{{end}}">
<input id="release-title" name="title" aria-label="{{ctx.Locale.Tr "repo.release.title"}}" placeholder="{{ctx.Locale.Tr "repo.release.title"}}" value="{{if .PageIsEditRelease}}{{.title}}{{else}}{{.tag_name}}{{end}}" autofocus maxlength="255">
</div>
<div class="field">
{{template "shared/combomarkdowneditor" (dict
"MarkdownPreviewUrl" (print .Repository.Link "/markup")
"MarkdownPreviewContext" .RepoLink
"TextareaName" "content"
"TextareaContent" .content
"TextareaPlaceholder" (ctx.Locale.Tr "repo.release.message")
"TextareaAriaLabel" (ctx.Locale.Tr "repo.release.message")
"DropzoneParentContainer" "form"
"EasyMDE" true
)}}
</div>
{{range .attachments}}
<div class="field flex-text-block" id="attachment-{{.ID}}">
<div class="flex-text-inline tw-flex-1">
<div class="flex-text-inline tw-shrink-0" title="{{ctx.Locale.Tr "repo.release.type_attachment"}}">
{{if .ExternalURL}}
{{svg "octicon-link-external" 16 "tw-mr-2"}}
{{else}}
{{svg "octicon-package" 16 "tw-mr-2"}}
{{end}}
</div>
<input name="attachment-edit-name-{{.UUID}}" placeholder="{{ctx.Locale.Tr "repo.release.asset_name"}}" class="attachment_edit" required value="{{.Name}}">
<input name="attachment-del-{{.UUID}}" type="hidden"
value="false">
{{if .ExternalURL}}
<input name="attachment-edit-exturl-{{.UUID}}" placeholder="{{ctx.Locale.Tr "repo.release.asset_external_url"}}" class="attachment_edit" required value="{{.ExternalURL}}">
{{else}}
<span class="ui text grey tw-whitespace-nowrap tw-ml-auto tw-pl-3">{{ctx.Locale.TrPluralString
.DownloadCount "release.n_downloads" (ctx.Locale.PrettyNumber .DownloadCount)}} · {{.Size | ctx.Locale.TrSize}}</span>
{{end}}
</div>
<a class="ui mini red button remove-rel-attach tw-ml-3" data-id="{{.ID}}" data-uuid="{{.UUID}}">
{{ctx.Locale.Tr "remove"}}
</a>
</div>
{{end}}
<div class="field flex-text-block tw-hidden" id="attachment-template">
<div class="flex-text-inline tw-flex-1">
<div class="flex-text-inline tw-shrink-0" title="{{ctx.Locale.Tr "repo.release.type_external_asset"}}">
{{svg "octicon-link-external" 16 "tw-mr-2"}}
</div>
<input name="attachment-template-new-name" placeholder="{{ctx.Locale.Tr "repo.release.asset_name"}}" class="attachment_edit">
<input name="attachment-template-new-exturl" placeholder="{{ctx.Locale.Tr "repo.release.asset_external_url"}}" class="attachment_edit">
</div>
<a class="ui mini red button remove-rel-attach tw-ml-3">
{{ctx.Locale.Tr "remove"}}
</a>
</div>
<button type="button" class="ui mini button tw-float-right tw-mb-4 tw-mt-2" id="add-external-link">
{{ctx.Locale.Tr "repo.release.add_external_asset"}}
</button>
{{if .IsAttachmentEnabled}}
<div class="field">
{{template "repo/upload" .}}
</div>
{{end}}
</div>
<div class="divider"></div>
<div class="ui">
<div>
<fieldset>
{{if not .PageIsEditRelease}}
<label>
<input type="checkbox" name="add_tag_msg">
{{ctx.Locale.Tr "repo.release.add_tag_msg"}}
</label>
{{else}}
<input type="hidden" name="add_tag_msg" value="false">
{{end}}
<label>
<input type="checkbox" name="prerelease" {{if .prerelease}}checked{{end}}>
{{ctx.Locale.Tr "repo.release.prerelease_desc"}}
<span class="help">{{ctx.Locale.Tr "repo.release.prerelease_helper"}}</span>
</label>
{{if not .DisableDownloadSourceArchives}}
<label>
<input type="checkbox" name="hide_archive_links" {{if .hide_archive_links}}checked{{end}}>
{{ctx.Locale.Tr "repo.release.hide_archive_links"}}
<span class="help">{{ctx.Locale.Tr "repo.release.hide_archive_links_helper"}}</span>
</label>
{{end}}
</fieldset>
<div class="divider tw-mt-0"></div>
<div class="tw-flex tw-justify-end button-row">
{{if .PageIsEditRelease}}
<a class="ui small button" href="{{.RepoLink}}/releases">
{{ctx.Locale.Tr "repo.release.cancel"}}
</a>
<a class="ui small red button delete-button" data-url="{{$.RepoLink}}/releases/delete" data-id="{{.ID}}" data-modal-id="delete-release">
{{ctx.Locale.Tr "repo.release.delete_release"}}
</a>
{{if .IsDraft}}
<button class="ui small button" type="submit" name="draft" value="{{ctx.Locale.Tr "repo.release.save_draft"}}">{{ctx.Locale.Tr "repo.release.save_draft"}}</button>
<button class="ui small primary button">
{{ctx.Locale.Tr "repo.release.publish"}}
</button>
{{else}}
<button class="ui small primary button">
{{ctx.Locale.Tr "repo.release.edit_release"}}
</button>
{{end}}
{{else}}
{{if not .tag_name}}
<button class="ui small button" name="tag_only" value="1">{{ctx.Locale.Tr "repo.release.add_tag"}}</button>
{{end}}
<button class="ui small button" name="draft" value="1">{{ctx.Locale.Tr "repo.release.save_draft"}}</button>
<button class="ui small primary button">
{{ctx.Locale.Tr "repo.release.publish"}}
</button>
{{end}}
</div>
</div>
</div>
</form>
</div>
</div>
{{if .PageIsEditRelease}}
<div class="ui g-modal-confirm delete modal" id="delete-release">
<div class="header">
{{svg "octicon-trash"}}
{{ctx.Locale.Tr "repo.release.deletion"}}
</div>
<div class="content">
<p>{{ctx.Locale.Tr "repo.release.deletion_desc"}}</p>
</div>
{{template "base/modal_actions_confirm" .}}
</div>
{{end}}
{{template "base/footer" .}}