Commit Graph

984 Commits

Author SHA1 Message Date
Conrad Hoffmann 5e5b7b77f0 gitsrht-dispatch: fix config item in error message
Signed-off-by: Conrad Hoffmann <ch@bitfehler.net>
2023-08-16 11:18:21 +02:00
Thorben Günther e1244429d4 api/acls: Error out early
This simplifies the database query and is more consistent with how
tracker and list acl queries behave.
2023-07-07 10:10:38 +02:00
Thorben Günther 31832f94c4 blueprints/manage.py: Fix description in repository creation
Right now the description gets set to an empty string if no input is
specified instead of "null". In comparison updating a repository handles
it correctly [1].

[1]: f3df3ac3f1/item/gitsrht/blueprints/manage.py (L120)
2023-06-22 10:41:02 +02:00
Jonne Ransijn f3df3ac3f1 prevent XSS attacks from raw blobs 2023-06-01 12:42:40 +02:00
Jonne Ransijn b52b348696 Allow rendering of images from blob
Adds a `Content-Type` header to image files.
This allows images to be rendered by the browser.
In particular, it allows SVGs to be used in READMEs.

I have restricted this feature to only work on image files for now,
but it might make sense to send this header for other file types as
well if we can reasonably assume that the browser is able to render
it, such as PDFs and XML documents.
2023-06-01 12:42:37 +02:00
Conrad Hoffmann a39556963c gitsrht_periodic: don't overwrite metrics group
Currently, gitsrht_periodic pushes metrics to the pushgateway using only
job="git.sr.ht" as a grouping key. This will overwrite _any_ metrics
that have been pushed using the same key. This includes for example the
certificate expiration.

A discussion could be had about using more specific grouping keys for
the various different jobs, but for now I think it is most sensible to
simply use `_pushadd` instead of `_push` to preserve other metrics
pushed with the same key by other jobs. This is also the behavior when
using a plain `curl` to push data, as curl will default to POST. The
`_push` method behavior is that of PUT request instead.

Here is the relevant section of the Python client README:

https://github.com/prometheus/client_python#exporting-to-a-pushgateway

And here is more detailed explanation of the POST vs. PUT semantics:

https://github.com/prometheus/pushgateway#api
2023-06-01 12:41:52 +02:00
Axel Karjalainen 7fb5c45da8 Add name to enum to prevent crash
The SQLAlchemy documentation doesn't state that the `name`
keyword-argument is required but on my setup without this patch
git.sr.ht crashes immediately on start.
2023-06-01 12:41:42 +02:00
Adnan Maolood 24eb656eb7 Move go.mod to root
Also update go.mod to Go 1.16.
2023-06-01 12:26:45 +02:00
Drew DeVault d42cbe4fe9 .builds/alpine.yml: use absolute path for doas 2023-04-19 09:20:44 +02:00
Adnan Maolood a8ae4727f2 gitsrht-update-hook: Use repository visbility for builds 2023-04-19 09:06:47 +02:00
Umar Getagazov 012e5ec38b repo.patch: fix empty output
Fixes f2c8bab45d
2023-04-12 10:30:52 +02:00
Drew DeVault cba1e4ca92 log.html: fix exception on zero commits 2023-04-11 12:07:09 +02:00
Drew DeVault f2c8bab45d repo.patch: fix command injection 2023-04-03 16:54:09 +02:00
Drew DeVault 3dcb94204f archive: fix command injection 2023-04-01 15:07:15 +02:00
Drew DeVault b063dbda6e gitsrht-periodic: fix non-integer randrange use 2023-03-22 20:21:45 +01:00
Drew DeVault b6b184c740 gitsrht-periodic: drop unsupported timer
This uses an unstable/undocumented part of the Prometheus Python
interface.
2023-03-22 20:12:02 +01:00
Drew DeVault c5c1cb9eea Upgrade to Alpine 3.17 2023-03-22 11:13:22 +01:00
Umar Getagazov 3039891a15 api: prevent repos with ACL from being duplicated
Only join with access entries if the second condition of the OR
condition in the WHERE clause (i.e. `repo.visibility = 'PUBLIC') is
false, which prevents WHERE from short-circuiting for every row.
2023-03-13 13:01:48 +01:00
Drew DeVault a0e9ae716e blueprints/manage.py: fix incorrect route name 2023-02-22 09:51:08 +01:00
Arsen Arsenović 58f956ab09 utils.html: Add a permalink breadcrumb 2023-02-22 09:25:53 +01:00
David Florness 1f83634d68 Replace meta.sr.ht's /oauth endpoint with /oauth2 in comment
While there is a link to /oauth2 on the /oauth page, landing on /oauth2 right
away makes it obvious to server admins that /oauth2 is where they should be.

Discussion: <https://lists.sr.ht/~sircmpwn/sr.ht-discuss/%3C877cwnhpni.fsf%40florness.com%3E>
Signed-off-by: David Florness <david@florness.com>
2023-02-20 10:55:20 +01:00
Paul Wise e74ae7acf1 Add repo description to summary page title
Makes it easier to find repos in the history of browsers that save titles.

Potentially makes web search engine results more useful.
2023-02-13 10:31:05 +01:00
Arsen Arsenović 59b98e2e44 commit.html: Add button to download .tar.gz 2023-01-26 10:18:01 +01:00
Vlad-Stefan Harbuz 0100a8a30b add license nav item to repo subpages
Fixes: https://todo.sr.ht/~sircmpwn/git.sr.ht/374
Signed-off-by: Vlad-Stefan Harbuz <vlad@vladh.net>
2023-01-26 10:16:39 +01:00
Adnan Maolood be2eda013d api: Upgrade go-git 2022-12-19 13:14:15 +01:00
Conrad Hoffmann f48457a097 Revert "Fix text-decoration for <del> tag"
This reverts commit 390e609e53.

The approach was too heavy-handed. It messes with folks who use <del> in
their README. The commit that introduced the issue that the reverted
commit was trying to address has itself been reverted.
2022-12-19 13:14:10 +01:00
Conrad Hoffmann 09128ad3ad Revert "Change markup for diff insert/delete lines"
This reverts commit b75d2f0e03.

This commit has some issues:

- It uses <ins>/<del> not for the content that was actually
  added/removed (i.e. the diff), but for the line stats. I don't think
  that helps accessibility, it might actually make it worse.
- It adds some CSS to apply text decoration to <ins>/<del>, but only
  inside the `diff` class. However, the elements never occur inside the
  `diff` class (see first item). The CSS is never used.
- Instead, the place where it was used (line stats) got unintended text
  decoration applied, causing a follow-up commit which fixed this the
  wrong way, causing yet more issues (fixed in next commit).

I think the one place where it would make sense to apply <ins>/<del> is
the diff itself, but that might be a more serious operation.
2022-12-19 13:14:08 +01:00
Adnan Maolood 03671cc4a4 api/graph: Avoid race condition when cloning repos 2022-11-10 11:23:39 +01:00
Adnan Maolood fe9d0d9ab3 api/graph: Ensure files are closed after creation 2022-11-10 11:23:38 +01:00
Drew DeVault cd790c9bed Revert "Resolve name and email from mailmap"
This patch has an oversight, sent backtrace to Seb for review.

This reverts commit 2369d4aa22.
2022-11-07 13:16:54 +01:00
Conrad Hoffmann d9d750669d api: rename accessControlList() to acls()
To be consistent with other services (e.g. todo.sr.ht).
2022-11-07 12:18:53 +01:00
Conrad Hoffmann b626d9177f api: expose current user's repository access level
For a given repository, the `access` attribute contains the AccessMode
that applies to the current user.
2022-11-07 12:18:47 +01:00
Thorben Günther e02b460f84 api: Rename user webhook mutations
Conform with terminology of other services.
Make deleteUserWebhook non-nullable.
2022-11-07 12:18:24 +01:00
Sebastian 2369d4aa22 Resolve name and email from mailmap
The mailmap file is consulted to obtain the canonical name/email of an
author or committer of a commit, or a tagger of a tag.

Signed-off-by: Sebastian <sebastian@sebsite.pw>
2022-11-07 12:18:17 +01:00
Drew DeVault 4436def286 Implement user account deletion 2022-11-01 14:01:38 +01:00
Vlad-Stefan Harbuz 9d26151dfe licenses: check that LICENSES/ is directory
Signed-off-by: Vlad-Stefan Harbuz <vlad@vladh.net>
2022-10-28 10:45:17 +02:00
Adnan Maolood 1272ef2588 gitsrht: Use canonical user IDs
Update user IDs across git.sr.ht to match those of meta.sr.ht.
2022-10-26 10:42:56 +02:00
Drew DeVault ce1c1d8094 API: upgrade gqlgen 2022-10-20 14:45:25 +02:00
Adnan Maolood 4ac215ac08 schema.sql: Add missing types 2022-10-10 11:23:27 +02:00
Vlad-Stefan Harbuz a00fc083e4 add REUSE-based licenses to repo page
Signed-off-by: Vlad-Stefan Harbuz <vlad@vladh.net>
2022-10-10 11:23:24 +02:00
Thorben Günther 0797e15451 Fix flask send_file arguments
The deprecated attachment_filename was removed in a recent flask release
and is superseded by download_name [1].

[1]: https://github.com/pallets/flask/pull/4667
2022-09-29 10:52:48 +02:00
Drew DeVault df41ac86f0 Add schema.sql 2022-08-16 14:01:46 +02:00
Vlad-Stefan Harbuz 2d3175c5e4 add whitespace back to pre, body on blob page
This is a partial revert of fd8cca2e. It fixes a bug where, for example, viewing
a README file on a blob page results in no bottom margin for <pre>s at all, and
no bottom padding on the body. Adding bottom padding to the body also improves
the experience on mobile.

Signed-off-by: Vlad-Stefan Harbuz <vlad@vladh.net>
2022-08-15 12:17:14 +02:00
Adnan Maolood 9f9c12995d gitsrht: Rename RepoVisibility to Visibility
Rename RepoVisibility to Visibility so that gitsrht-initdb will name the
type 'visibility' instead of 'repovisibility'.
2022-08-15 12:17:04 +02:00
Adnan Maolood 30f949522f gitsrht/templates: Surface validation errors
Surface validation errors which are not attached to a given field.
2022-08-15 12:16:52 +02:00
Thorben Günther 483a560411 api/webhooks: Add missing default case 2022-07-06 10:30:55 +02:00
Adnan Maolood 4558b995c2 Update core-go 2022-05-30 14:19:01 +02:00
Kunal Sareen 390e609e53 Fix text-decoration for <del> tag
Browsers usually render a <del> tag with a strike-through. However,
strike-through makes the number of deletions in a file unreadable as
well as the number of additions is rendered with an underline. This
commit fixes the issue by using underline for the <del> tag.
2022-05-30 13:37:47 +02:00
Adnan Maolood b54049b3d9 api/graph: Fix webhook delivery name 2022-05-30 13:37:43 +02:00
Joram Schrijver 470f1029fc Fix send-email helper details color in dark mode
The collapsed summary color was low contrast, and the expanded summary
color was almost invisible (black on dark gray). There currently is no
uncolored text inside a details tag, but such text would also have been
black.
2022-04-28 11:25:19 +02:00