ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-03 03:23:25 +09:00
Code Issues Projects Releases Wiki Activity

enhance(repo): check full repo name for dangerous operations (#39213)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Mitrahsoft
2026-09-02 17:07:04 +00:00
committed by GitHub
co-authored by wxiaoguang
parent f735df4dee
commit 8cf7330556
8 changed files with 67 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/web/repo/setting/setting.go
+5 -5
View File
@@ -790,7 +790,7 @@ func handleSettingsPostConvert(ctx *context.Context) {
form := web.GetForm[*forms.RepoSettingForm](ctx)
repo := ctx.Repo.Repository
if repo.Name != form.RepoName {
if repo.FullName() != form.RepoName {
ctx.JSONError(ctx.Tr("form.enterred_invalid_repo_name"))
return
}
@@ -824,7 +824,7 @@ func handleSettingsPostConvertFork(ctx *context.Context) {
ctx.ServerError("Convert Fork", err)
return
}
if repo.Name != form.RepoName {
if repo.FullName() != form.RepoName {
ctx.JSONError(ctx.Tr("form.enterred_invalid_repo_name"))
return
}
@@ -860,7 +860,7 @@ func handleSettingsPostTransfer(ctx *context.Context) {
form := web.GetForm[*forms.RepoSettingForm](ctx)
repo := ctx.Repo.Repository
if repo.Name != form.RepoName {
if repo.FullName() != form.RepoName {
ctx.JSONError(ctx.Tr("form.enterred_invalid_repo_name"))
return
}
@@ -951,7 +951,7 @@ func handleSettingsPostDelete(ctx *context.Context) {
form := web.GetForm[*forms.RepoSettingForm](ctx)
repo := ctx.Repo.Repository
if repo.Name != form.RepoName {
if repo.FullName() != form.RepoName {
ctx.JSONError(ctx.Tr("form.enterred_invalid_repo_name"))
return
}
@@ -977,7 +977,7 @@ func handleSettingsPostDeleteWiki(ctx *context.Context) {
}
form := web.GetForm[*forms.RepoSettingForm](ctx)
repo := ctx.Repo.Repository
if repo.Name != form.RepoName {
if repo.FullName() != form.RepoName {
ctx.JSONError(ctx.Tr("form.enterred_invalid_repo_name"))
return
}
services/forms/repo_form.go
+1 -1
View File
@@ -79,7 +79,7 @@ type MigrateRepoForm struct {
// RepoSettingForm form for changing repository settings
type RepoSettingForm struct {
middleware.FormDefaultValidator
RepoName string `binding:"Required;AlphaDashDot;MaxSize(100)"`
RepoName string `binding:"TrimSpace;Required;AlphaDashDot;MaxSize(100)"`
Description string `binding:"MaxSize(2048)"`
Website string `binding:"ValidUrl;MaxSize(1024)"`
Interval string
templates/repo/migrate/migrating.tmpl
+6 -21
View File
@@ -59,28 +59,13 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}/settings" method="post">
<input type="hidden" name="action" value="delete">
<div class="field">
<label>
{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}}
<span class="tw-text-red">{{.Repository.Name}}</span>
</label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required>
</div>
<div class="actions">
<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
</div>
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" (print .Repository.Link "/settings")
"RepoOperationAction" "delete"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_delete")
)}}
</div>
</div>
templates/repo/settings/dangerous_operation_form.tmpl
+22
View File
@@ -0,0 +1,22 @@
{{$repoFullName := .RepoFullName}}
{{$repoOperationLink := .RepoOperationLink}}
{{$repoOperationAction := .RepoOperationAction}}
{{$repoOperationText := .RepoOperationText}}
<form class="ui form form-fetch-action" action="{{$repoOperationLink}}" method="post">
<input type="hidden" name="action" value="{{$repoOperationAction}}">
<div class="field">
<label>{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}} <span class="tw-text-red">{{$repoFullName}}</span></label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required>
</div>
{{if eq $repoOperationAction "transfer"}}
<div class="required field">
<label>{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
<input name="new_owner_name" required>
</div>
{{end}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" $repoOperationText)}}
</form>
templates/repo/settings/options.tmpl
+30 -30
View File
@@ -909,11 +909,12 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="convert">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.convert_confirm"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "convert"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.convert_confirm")
)}}
</div>
</div>
{{end}}
@@ -926,11 +927,12 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="convert_fork">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.convert_fork_confirm"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "convert_fork"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.convert_fork_confirm")
)}}
</div>
</div>
{{end}}
@@ -945,16 +947,12 @@
{{ctx.Locale.Tr "repo.settings.transfer_notices_3"}} <br>
{{ctx.Locale.Tr "repo.settings.transfer_notices_4"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="transfer">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
<div class="required field">
<label for="new_owner_name">{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
<input id="new_owner_name" name="new_owner_name" required>
</div>
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.transfer_perform"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "transfer"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.transfer_perform")
)}}
</div>
</div>
@@ -970,11 +968,12 @@
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="delete">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.confirm_delete"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "delete"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_delete")
)}}
</div>
</div>
@@ -1036,11 +1035,12 @@
{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="delete-wiki">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.confirm_wiki_delete"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "delete-wiki"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_wiki_delete")
)}}
</div>
</div>
{{end}}
templates/repo/settings/repo_name_confirm_fields.tmpl
-10
View File
@@ -1,10 +0,0 @@
<div class="field">
<label>
{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}}
<span class="tw-text-red">{{.RepoName}}</span>
</label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required maxlength="100">
</div>
tests/integration/editor_test.go
+2 -2
View File
@@ -388,7 +388,7 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
// Archive the repository
req := NewRequestWithValues(t, "POST", "/"+path.Join(user, repo, "settings"),
map[string]string{
"repo_name": repo,
"repo_name": user + "/" + repo,
"action": "archive",
},
)
@@ -402,7 +402,7 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
// Unfork the repository
req = NewRequestWithValues(t, "POST", "/"+path.Join(user, repo, "settings"),
map[string]string{
"repo_name": repo,
"repo_name": user + "/" + repo,
"action": "convert_fork",
},
)
tests/integration/pull_create_test.go
+1 -1
View File
@@ -187,7 +187,7 @@ func testUIDeleteBranch(t *testing.T, session *TestSession, ownerName, repoName,
func testDeleteRepository(t *testing.T, session *TestSession, ownerName, repoName string) {
relURL := "/" + path.Join(ownerName, repoName, "settings")
req := NewRequestWithValues(t, "POST", relURL+"?action=delete", map[string]string{
"repo_name": repoName,
"repo_name": ownerName + "/" + repoName,
})
resp := session.MakeRequest(t, req, http.StatusOK)
assert.NotNil(t, test.ParseJSONRedirect(resp.Body.Bytes()).Redirect)