forgejo/models
Gusted 8d2dab94a6
[GITEA] rework long-term authentication
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit eff097448b)

[GITEA] rework long-term authentication (squash) add migration

Reminder: the migration is run via integration tests as explained
in the commit "[DB] run all Forgejo migrations in integration tests"

(cherry picked from commit 4accf7443c)
(cherry picked from commit 99d06e344ebc3b50bafb2ac4473dd95f057d1ddc)
(cherry picked from commit d8bc98a8f0)
(cherry picked from commit 6404845df9)
(cherry picked from commit 72bdd4f3b9)
(cherry picked from commit 4b01bb0ce8)
(cherry picked from commit c26ac31816)
2023-11-13 14:06:31 +01:00
..
actions [CLI] implement forgejo-cli 2023-11-13 11:52:15 +01:00
activities Add Index to action.user_id (#27403) (#27425) 2023-10-04 08:53:00 +02:00
admin Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
asymkey [GITEA] Make atomic ssh keys replacement robust 2023-11-13 14:06:31 +01:00
auth [GITEA] rework long-term authentication 2023-11-13 14:06:31 +01:00
avatars Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
db [GITEA] Add slow SQL query warning 2023-11-13 14:04:16 +01:00
dbfs Fix content holes in Actions task logs file (#25560) 2023-06-28 19:07:29 +02:00
fixtures [GITEA] Improve HTML title on repositories 2023-11-13 14:04:16 +01:00
forgejo/semver [UPGRADE] add sanity checks for [storage*] 2023-11-13 12:33:49 +01:00
forgejo_migrations [GITEA] rework long-term authentication 2023-11-13 14:06:31 +01:00
git Upgrade xorm to 1.3.4 (#27807) (#27813) 2023-10-27 14:17:27 +02:00
issues [GITEA] enable system users for comment.LoadPoster 2023-11-13 14:06:29 +01:00
migrations [GITEA] Drop sha256-simd in favor of stdlib 2023-11-13 14:06:31 +01:00
organization Another round of db.DefaultContext refactor (#27103) (#27262) 2023-09-25 19:24:35 +02:00
packages move repository deletion to service layer (#26948) 2023-09-08 04:51:15 +00:00
perm move repository deletion to service layer (#26948) 2023-09-08 04:51:15 +00:00
project More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
pull refactor some functions to support ctx as first parameter (#21878) 2022-12-03 10:48:26 +08:00
repo [GITEA] Use restricted sanitizer for repository description 2023-11-13 14:06:30 +01:00
secret Refactor secrets modification logic (#26873) 2023-09-05 15:21:02 +00:00
shared/types Display owner of a runner as a tooltip instead of static text (#24377) 2023-05-12 08:43:27 +00:00
system Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
unit Use Set[Type] instead of map[Type]bool/struct{}. (#26804) 2023-08-30 06:55:25 +00:00
unittest [TESTS] tests.AddFixtures helper loads additional per-test fixtures 2023-11-13 12:33:49 +01:00
user [GITEA] rework long-term authentication 2023-11-13 14:06:31 +01:00
webhook Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
error.go Sync branches into databases (#22743) 2023-06-29 10:03:20 +00:00
fixture_generation.go Fix yaml test (#27297) (#27303) 2023-09-27 15:05:35 +08:00
fixture_test.go Fix yaml test (#27297) (#27303) 2023-09-27 15:05:35 +08:00
main_test.go move repository deletion to service layer (#26948) 2023-09-08 04:51:15 +00:00
org.go refactor some functions to support ctx as first parameter (#21878) 2022-12-03 10:48:26 +08:00
org_team.go Use db.WithTx for AddTeamMember to avoid ctx abuse (#27095) 2023-09-16 12:54:23 +00:00
org_team_test.go Reduce usage of db.DefaultContext (#27073) 2023-09-14 17:09:32 +00:00
org_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
repo.go Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
repo_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
repo_transfer.go Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
repo_transfer_test.go Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00