bbffcc3aec
There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
This is an extensive PR attempting to fix these issues.
1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future.
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>
Signed-off-by: Andrew Thornton <art27@cantab.net>
|
||
|---|---|---|
| .gitea | ||
| .github | ||
| assets | ||
| build | ||
| cmd | ||
| contrib | ||
| custom/conf | ||
| docker | ||
| docs | ||
| integrations | ||
| models | ||
| modules | ||
| options | ||
| public | ||
| routers | ||
| services | ||
| snap | ||
| templates | ||
| tools | ||
| vendor | ||
| web_src | ||
| .air.toml | ||
| .changelog.yml | ||
| .drone.yml | ||
| .editorconfig | ||
| .eslintrc | ||
| .gitattributes | ||
| .gitignore | ||
| .golangci.yml | ||
| .ignore | ||
| .lgtm | ||
| .npmrc | ||
| .revive.toml | ||
| .stylelintrc | ||
| BSDmakefile | ||
| build.go | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| DCO | ||
| Dockerfile | ||
| Dockerfile.rootless | ||
| go.mod | ||
| go.sum | ||
| jest.config.js | ||
| LICENSE | ||
| main.go | ||
| MAINTAINERS | ||
| Makefile | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| README_ZH.md | ||
| SECURITY.md | ||
| webpack.config.js | ||
Gitea - Git with a cup of tea
View the chinese version of this document
Purpose
The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. Using Go, this can be done with an independent binary distribution across all platforms which Go supports, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. Want to try it before doing anything else? Do it with the online demo! This project has been forked from Gogs since 2016.11 but changed a lot.
Building
From the root of the source tree, run:
TAGS="bindata" make build
or if sqlite support is required:
TAGS="bindata sqlite sqlite_unlock_notify" make build
The build target is split into two sub-targets:
make backendwhich requires Go 1.16 or greater.make frontendwhich requires Node.js 12.17 or greater and Internet connectivity to download npm dependencies.
When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js and Internet connectivity.
Parallelism (make -j <num>) is not supported.
More info: https://docs.gitea.io/en-us/install-from-source/
Using
./gitea web
NOTE: If you're interested in using our APIs, we have experimental support with documentation.
Contributing
Expected workflow is: Fork -> Patch -> Push -> Pull Request
NOTES:
- YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.
- If you have found a vulnerability in the project, please write privately to security@gitea.io. Thanks!
Translating
Translations are done through Crowdin. If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.
You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope fo fill it as questions pop up.
https://docs.gitea.io/en-us/translation-guidelines/
Further information
For more information and instructions about how to install Gitea, please look at our documentation. If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.
We maintain a list of Gitea-related projects at gitea/awesome-gitea.
The hugo-based documentation theme is hosted at gitea/theme.
The official Gitea CLI is developed at gitea/tea.
Authors
Backers
Thank you to all our backers! 🙏 [Become a backer]
Sponsors
Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]
FAQ
How do you pronounce Gitea?
Gitea is pronounced /ɡɪ’ti:/ as in "gi-tea" with a hard g.
Why is this not hosted on a Gitea instance?
We're working on it.
License
This project is licensed under the MIT License. See the LICENSE file for the full license text.
Screenshots
Looking for an overview of the interface? Check it out!
 |
 |
 |
|---|---|---|
 |
 |
 |
 |
 |
 |
 |
 |
 |