There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
This is an extensive PR attempting to fix these issues.
1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future.
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <art27@cantab.net>
Signed-off-by: Andrew Thornton <art27@cantab.net>
Replaces #16262
Replaces #16250
Replaces #14833
This PR first implements a `git check-attr` pipe reader - using `git check-attr --stdin -z --cached` - taking account of the change in the output format in git 1.8.5 and creates a helper function to read a tree into a temporary index file for that pipe reader.
It then wires this in to the language stats helper and into the git diff generation.
Files which are marked generated will be folded by default.
Fixes#14786Fixes#12653
Gitea has relied on some slow JS code to match up added and deleted lines on the
diff pages. This can cause a considerable slow down on large diff pages.
This PR makes a small change meaning that the matching up can occur much more simply.
Partial fix#1351
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Added type sniffer.
* Switched content detection from base to typesniffer.
* Added GuessContentType to Blob.
* Moved image info logic to client.
Added support for SVG images in diff.
* Restore old blocked svg behaviour.
* Added missing image formats.
* Execute image diff only when container is visible.
* add margin to spinner
* improve BIN tag on image diffs
* Default to render view.
* Show image diff on incomplete diff.
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix and restyle menu on code line
* fix multiline and more tweaks
* move to separate files
* remove has-context-menu class
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* creates and implements generic markup less class
* How to give custom CSS to externally rendered html
* Clarifies sources of CSS styling of markup
* further clarification of sources of markup styling
* rename _markdown to _markup
* remove defunct import
* fix orphaned reference
* Update docs/content/doc/advanced/external-renderers.en-us.md
* more renames markdown -> markup
* do not suggest less customization
* add back tokens
* fix class whitespace, remove useless if-clause
* remove unused csv-data rules
* use named exports and rename functions
* sort imports
Co-authored-by: HarvsG <11440490+HarvsG@users.noreply.github.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: silverwind <me@silverwind.io>
* 7184- message if line too long
* Update options/locale/locale_en-US.ini
Co-authored-by: silverwind <me@silverwind.io>
* add flag on missing cases
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Andrew Thornton <art27@cantab.net>
More recent versions of git have increased support for detection of renames meaning
that a rename with diff changes is now supported.
Although ParsePatch supports this - our templates do not and the simplest solution
is simply to show the diff.
Fix#15335
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
Implements request #14320 The rendering of CSV files does match the diff style.
* Moved CSV logic into base package.
* Added method to create a tabular diff.
* Added CSV compare context.
* Added CSV diff template.
* Use new table style in CSV markup.
* Added file size limit for CSV rendering.
* Display CSV parser errors in diff.
* Lazy read single file.
* Lazy read rows for full diff.
* Added unit tests for various CSV changes.
* Make fileheader sticky #12552
* Remove sticky filenames when width is 480px or less
On mobile phone sticky filename is hidden due to the combination
of many possible widths and lengths.
* Fix text color for .markdown-info
* Fix visual of sticky diff box on 480px or less
- Hide arrow for select buttons.
- Fix changes, additions and deletions.
With flexbox they look very broken.
This commit hides some words to, so the result is:
"123 changed files 987 additions 456 deletions"
- center text in buttons
Co-authored-by: zeripath <art27@cantab.net>
* Implemented "Reference in new issue"
* Fixed menu style on "pulls/x/files" because "button" has a style.
* Added context menu for PR file comments.
* Use only a single modal for every comment.
* Use current repository as default. Added search filter.
* Added suggested changes.
* Fixed assignment.
Co-authored-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>
Fixed#8861
* use ajax on PR review page
* handle review comments
* extract duplicate code
FetchCodeCommentsByLine was initially more or less copied from fetchCodeCommentsByReview. Now they both use a common findCodeComments function instead
* use the Engine that was passed into the method
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
* Search and Diff CSS enhancements
- Use flexbox for language stats
- Improve labels and code boxes on repo and code search
- Use flexbox on diff header and improve suppressed diff text
- Add dedicated color for diff expander
* more diff tweaks, less vertical padding on header
* more minor tweaks
* always show fold icon, image diff improvments
* remove margin
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Diff stat improvements
- Combine number to just total number of changes
- Add tooltip over stats bar
- Increase contrast on file name
- Refactor classes and CSS to be more reusable
* misc tweaks
* make count bold
* Move diff split code into own template file
Separate split diff view same as unified already is. Mainly because I'm working on a separate PR with this change and merge conflicts for each change to box.tmpl are annoying and I'm worried about breaking something subtle while trying to resolve them.
* Fix error
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Indentation-related rules are disabled because indent templates with
tabs but our lint rules expect spaces.
Also had to exclude a few files where using template variables in the JS
is causing syntax errors for the JS parser. I don't think there's a way
to solve this otherwise.
Co-authored-by: Lauris BH <lauris@nix.lv>
- Change code review '+' to SVG and increase size slightly
- Set placeholder color in both themes
- Set proper font for textareas
- Fix black code in arc-green
- Various arc-green fixes
- Introduce new .code-inner class that sets the CSS attributes on
rendered code lines like view,blame and diff.
- Rename .wrap class to .word-break to reflect what it actually does
- Remove .raw which was only used on webhook page
- Set white-space: pre-wrap except on blame where it can break the
layout
Fixes: https://github.com/go-gitea/gitea/issues/13406
- Add alpha variants for primary color
- Make timeline items solid background color
- Fix reaction styles recently regressed
- Fix diff header and make it flexbox
- Numerous smaller fixes for arc green
* [Enhancement] Allow admin to merge pr with protected file changes
As tilte, show protected message in diff page and merge box.
Signed-off-by: a1012112796 <1012112796@qq.com>
* remove unused ver
* Update options/locale/locale_en-US.ini
Co-authored-by: Cirno the Strongest <1447794+CirnoT@users.noreply.github.com>
* Add TrN
* Apply suggestions from code review
* fix lint
* Update options/locale/locale_en-US.ini
Co-authored-by: zeripath <art27@cantab.net>
* Apply suggestions from code review
* move pr proteced files check to TestPatch
* Call TestPatch when protected branches settings changed
* Apply review suggestion @CirnoT
* move to service @lunny
* slightly restructure routers/private/hook.go
Adds a lot of comments and simplifies the logic
Signed-off-by: Andrew Thornton <art27@cantab.net>
* placate lint
Signed-off-by: Andrew Thornton <art27@cantab.net>
* skip duplicate protected files check
* fix check logic
* slight refactor of TestPatch
Signed-off-by: Andrew Thornton <art27@cantab.net>
* When checking for protected files changes in TestPatch use the temporary repository
Signed-off-by: Andrew Thornton <art27@cantab.net>
* fix introduced issue with hook
Signed-off-by: Andrew Thornton <art27@cantab.net>
* Remove the check on PR index being greater than 0 as it unnecessary
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <matti@mdranta.net>
Co-authored-by: Cirno the Strongest <1447794+CirnoT@users.noreply.github.com>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
code-view class seems unecessary here as everything needed style wise comes from various diff classes. This allows comments and comment editor to be styled properly and fixes linked bug.
Fixes#13010
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
- replace font-awesome icons with octicons
- clean up js and css surrounding the code expansion and file folding
- fix hover color on arc-green
- tweak diff line number colors
Co-authored-by: zeripath <art27@cantab.net>
* Make copy/paste work for source code
Fix regression casued by #12047 so copy/paste works properly in all browsers.
Fixes#12184
Also while looking at this I saw a small display issue for blame view. I think #12023 was merged into original PR through an update branch before #12047 was merged and made one of the css ruules not apply anymore.
* use pseudo-element to prevent copying of comment + symbol even when not visually selected
* remove added newline here should not be necessary anymore
* make sure empty line is newline so there is something to select and copy
* Server-side syntax hilighting for all code
This PR does a few things:
* Remove all traces of highlight.js
* Use chroma library to provide fast syntax hilighting directly on the server
* Provide syntax hilighting for diffs
* Re-style both unified and split diffs views
* Add custom syntax hilighting styling for both regular and arc-green
Fixes#7729Fixes#10157Fixes#11825Fixes#7728Fixes#3872Fixes#3682
And perhaps gets closer to #9553
* fix line marker
* fix repo search
* Fix single line select
* properly load settings
* npm uninstall highlight.js
* review suggestion
* code review
* forgot to call function
* fix test
* Apply suggestions from code review
suggestions from @silverwind thanks
Co-authored-by: silverwind <me@silverwind.io>
* code review
* copy/paste error
* Use const for highlight size limit
* Update web_src/less/_repository.less
Co-authored-by: Lauris BH <lauris@nix.lv>
* update size limit to 1MB and other styling tweaks
* fix highlighting for certain diff sections
* fix test
* add worker back as suggested
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix sticky diff stats container
* Use pure CSS sticky instead of Fomantic's JS
* add border color to arc-green
* add slight padding on sides
* make linter happy
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Currently you can see a list of commit history for wiki pages but aren't able to view the commit diff itself. This adds the feature to view an individual commit to a wiki repo.
Closes#8999
Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add a way to mark Conversation (code comment) resolved
mark Conversation is a way to mark a Conversation is stale
or be solved. when it's marked as stale, will be hided like
stale. all Pull Request writer , Offical Reviewers and poster
can add or remove Conversation resolved mark.
Signed-off-by: a1012112796 <1012112796@qq.com>
* fix lint
* Apply suggestions from code review
* Add ResolveDoer
* fix ui
Co-Authored-By: Lauris BH <lauris@nix.lv>
Co-Authored-By: 6543 <6543@obermui.de>
* change IsResolved to an function
Add permission check in UpdateResolveConversation
* Apply suggestions from code review
* change return error for permisson check
* add default message for deleted user
* get issue message from comment
* add migration for ``ResolveDoerID`` column
another change:
* block mark pending review as resolved because it's not necessary
Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
* change button color
* resolve button size
* fix code style
* remove unusefull code
Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: 6543 <6543@obermui.de>
Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
* fix commit view JS features, reimplement folding
File content folding was not working so I reimplemented it in a saner
way. Then I noticed the issue was actually because of missing JS
libraries (seen on the console of every commit with error
'SimpleMDE is not defined').
Fixed the libraries. I think the reimplementation is worth to keep.
* add .closest polyfill
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This PR ensures that once opened the diff stats detail box can be scrolled independently of the diff on the compare page.
Fixes#5532
Details:
* make diff-detail-box the main container
* move file diff at the same level as diff-stats
* make diff-view options sticy again
* make diff-stats scroll if to mouch
* rm useless css info
* less: mv diff-stats to own class
* use new css class
* cleanup less file
* diff-counter: margin-right: 15px;
* make CI work
* make numbers colorful
* add sign (-/+) to numbers
* Add Diff Download to Compare List
* Add&Change Text for Diff Options
* move button to seperate template
* add drop down menue with options
* Update: Compare
update Gogs, BitBucket, RhodeCode and remove gitea issue link
Co-Authored-By: Lauris BH <lauris@nix.lv>
* remove last things from TESTing
* Resolve error when comparing images
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Check blob existence instead of git-ls when checking if file exists
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Show file metadata also when a file was newly added
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Fixes error in commit view
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Excludes assigning path and image infos for compare routers to service package
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Removes nil default and fixes import order
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds missing comments
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Moves methods for assigning compare data to context into repo router package
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Show image compare for deleted images as well. Simplify check if image should be displayed
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds side-by-side diff for images
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Explain blank imports
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Use complete word for width and height labels on image compare
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Update index.css from master
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Moves ImageInfo to git commit file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Assign ImageInfo function for template and sets correct target for BeforeSourcePath
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adds missing comment
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Return error if ImageInfo failed
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Avoid template panic when ImageInfo failed for some reason
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Show file size on image diff
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Removes unused helper function
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Reverts copyright year change
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Close file reader
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Update commit.go
Sets correct data key
* Moves reader.Close() up a few lines
* Updates index.css
* Updates CSS file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Transfers adjustments for image compare to compare.go file
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Adjusts variable name
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Apply lesshint recommendations
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Do not show old image on image compare if it is not in index of base commit
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* Change file size text
Signed-off-by: Mario Lubenka <mario.lubenka@googlemail.com>
* fix extra newlines when copying from diff
See https://bugzilla.mozilla.org/show_bug.cgi?id=1273836
Basically, the <pre><code> seems to add a forced newline that is not
possible to get rid of via CSS, so I replaced it with just a <code>.
Secondly, .lines-type-marker also forced a newline in the copied text,
but that was possible to get rid of via user-select.
Safari still has a extraneous newline in the copied text of unknown
origin, but this should not block stop this PR.
* simplify .line-type-marker
* fix selector
* remove erronous ^^^
* Fix empty split diff
* Fix arc-theme-green
* fix add comment
* ensure line-num is copied too
* Update templates/repo/diff/box.tmpl
Co-Authored-By: zeripath <art27@cantab.net>
* attempt to fix safari via removing <code>
* remove useless whitespace at the end of 'class'
* remove inter-tag whitespace for code <td>s
* more inter-tag removal
* final inter-tag removal
* attempt to fix empty line copy
* move and comment getLineContent
* fix golint
* make background grey for missing added code
* Make diff line-marker non-selectable
* Move to use data-* as per @mrsdizzie
* fix missing line nums
* Add a minimum-width to force right-align of the line num
* Move line-type-marker into separate column
zeripath
Gusted
wxiaoguang
KN4CK3R
silverwind
6543
Loutro
vnkmpf
Jimmy Praet
mrsdizzie
Jimmy Praet
赵智超
Cirno the Strongest
guillep2k
John Olheiser
Benno
6543
Mario Lubenka
