ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

enhance(repo): check full repo name for dangerous operations (#39213)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Mitrahsoft
2026-09-02 17:07:04 +00:00
committed by GitHub
co-authored by wxiaoguang
parent f735df4dee
commit 8cf7330556
8 changed files with 67 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/repo/migrate/migrating.tmpl
+6 -21
View File
@@ -59,28 +59,13 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}/settings" method="post">
<input type="hidden" name="action" value="delete">
<div class="field">
<label>
{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}}
<span class="tw-text-red">{{.Repository.Name}}</span>
</label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required>
</div>
<div class="actions">
<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
<button class="ui red button">{{ctx.Locale.Tr "repo.settings.confirm_delete"}}</button>
</div>
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" (print .Repository.Link "/settings")
"RepoOperationAction" "delete"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_delete")
)}}
</div>
</div>
templates/repo/settings/dangerous_operation_form.tmpl
+22
View File
@@ -0,0 +1,22 @@
{{$repoFullName := .RepoFullName}}
{{$repoOperationLink := .RepoOperationLink}}
{{$repoOperationAction := .RepoOperationAction}}
{{$repoOperationText := .RepoOperationText}}
<form class="ui form form-fetch-action" action="{{$repoOperationLink}}" method="post">
<input type="hidden" name="action" value="{{$repoOperationAction}}">
<div class="field">
<label>{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}} <span class="tw-text-red">{{$repoFullName}}</span></label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required>
</div>
{{if eq $repoOperationAction "transfer"}}
<div class="required field">
<label>{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
<input name="new_owner_name" required>
</div>
{{end}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" $repoOperationText)}}
</form>
templates/repo/settings/options.tmpl
+30 -30
View File
@@ -909,11 +909,12 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.convert_notices_1"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="convert">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.convert_confirm"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "convert"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.convert_confirm")
)}}
</div>
</div>
{{end}}
@@ -926,11 +927,12 @@
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.convert_fork_notices_1"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="convert_fork">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.convert_fork_confirm"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "convert_fork"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.convert_fork_confirm")
)}}
</div>
</div>
{{end}}
@@ -945,16 +947,12 @@
{{ctx.Locale.Tr "repo.settings.transfer_notices_3"}} <br>
{{ctx.Locale.Tr "repo.settings.transfer_notices_4"}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="transfer">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
<div class="required field">
<label for="new_owner_name">{{ctx.Locale.Tr "repo.settings.transfer_owner"}}</label>
<input id="new_owner_name" name="new_owner_name" required>
</div>
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.transfer_perform"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "transfer"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.transfer_perform")
)}}
</div>
</div>
@@ -970,11 +968,12 @@
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="delete">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.confirm_delete"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "delete"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_delete")
)}}
</div>
</div>
@@ -1036,11 +1035,12 @@
{{ctx.Locale.Tr "repo.settings.delete_notices_1"}}<br>
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name}}
</div>
<form class="ui form form-fetch-action" action="{{.Link}}" method="post">
<input type="hidden" name="action" value="delete-wiki">
{{template "repo/settings/repo_name_confirm_fields" (dict "RepoName" .Repository.Name)}}
{{template "base/modal_actions_confirm" (dict "ModalButtonDangerText" (ctx.Locale.Tr "repo.settings.confirm_wiki_delete"))}}
</form>
{{template "repo/settings/dangerous_operation_form" (dict
"RepoFullName" .Repository.FullName
"RepoOperationLink" .Link
"RepoOperationAction" "delete-wiki"
"RepoOperationText" (ctx.Locale.Tr "repo.settings.confirm_wiki_delete")
)}}
</div>
</div>
{{end}}
templates/repo/settings/repo_name_confirm_fields.tmpl
-10
View File
@@ -1,10 +0,0 @@
<div class="field">
<label>
{{ctx.Locale.Tr "repo.settings.enter_repo_name_to_confirm"}}
<span class="tw-text-red">{{.RepoName}}</span>
</label>
</div>
<div class="required field">
<label>{{ctx.Locale.Tr "repo.repo_name"}}</label>
<input name="repo_name" required maxlength="100">
</div>