a
a
a
a
a b
a b
a b
a b
a.
a.
a (b) [$c$] {$d$}
a (b) [$c$] {$d$}
a` + nl,
+ `a` + nl,
},
{
"$$a$$ test",
- `a test
a test
test a
test a
foo x=\$ bar
foo x=\$ bar
\text{$b$}
\text{$b$}
+ `
\alpha
`,
@@ -122,7 +122,7 @@ func TestMathRenderBlockIndent(t *testing.T) {
\alpha
\]
`,
- `
+ `
\alpha
`,
@@ -137,7 +137,7 @@ a
d
\]
`,
- `
+ `
a
b
c
@@ -154,7 +154,7 @@ c
c
\]
`,
- `
+ `
a
b
c
@@ -165,7 +165,7 @@ c
"indent-0-oneline",
`$$ x $$
foo`,
- ` x
+ ` x
foo
`,
},
@@ -173,7 +173,7 @@ foo`,
"indent-3-oneline",
` $$ x $$
foo`,
- ` x
+ ` x
foo
`,
},
@@ -188,10 +188,10 @@ foo`,
> \]
`,
`
-
+
a
-
+
b
@@ -207,7 +207,7 @@ b
2. b`,
`
- a
-
+
x
diff --git a/modules/markup/markdown/math/block_renderer.go b/modules/markup/markdown/math/block_renderer.go
index a770efa01c7e5..c29f061882180 100644
--- a/modules/markup/markdown/math/block_renderer.go
+++ b/modules/markup/markdown/math/block_renderer.go
@@ -12,6 +12,17 @@ import (
"github.com/yuin/goldmark/util"
)
+// Block render output:
+// ...
+//
+// Keep in mind that there is another "code block" render in "func (r *GlodmarkRender) highlightingRenderer"
+// "highlightingRenderer" outputs the math block with extra "chroma" class:
+// ...
+//
+// Special classes:
+// * "is-loading": show a loading indicator
+// * "display": used by JS to decide to render as a block, otherwise render as inline
+
// BlockRenderer represents a renderer for math Blocks
type BlockRenderer struct {
renderInternal *internal.RenderInternal
@@ -38,7 +49,7 @@ func (r *BlockRenderer) writeLines(w util.BufWriter, source []byte, n gast.Node)
func (r *BlockRenderer) renderBlock(w util.BufWriter, source []byte, node gast.Node, entering bool) (gast.WalkStatus, error) {
n := node.(*Block)
if entering {
- code := giteaUtil.Iif(n.Inline, "", ``) + ``
+ code := giteaUtil.Iif(n.Inline, "", ``) + ``
_ = r.renderInternal.FormatWithSafeAttrs(w, code)
r.writeLines(w, source, n)
} else {
diff --git a/modules/markup/markdown/math/inline_renderer.go b/modules/markup/markdown/math/inline_renderer.go
index 0cff4f1e74e11..4e0531cf40489 100644
--- a/modules/markup/markdown/math/inline_renderer.go
+++ b/modules/markup/markdown/math/inline_renderer.go
@@ -13,6 +13,9 @@ import (
"github.com/yuin/goldmark/util"
)
+// Inline render output:
+// ...
+
// InlineRenderer is an inline renderer
type InlineRenderer struct {
renderInternal *internal.RenderInternal
@@ -25,11 +28,7 @@ func NewInlineRenderer(renderInternal *internal.RenderInternal) renderer.NodeRen
func (r *InlineRenderer) renderInline(w util.BufWriter, source []byte, n ast.Node, entering bool) (ast.WalkStatus, error) {
if entering {
- extraClass := ""
- if _, ok := n.(*InlineBlock); ok {
- extraClass = "display "
- }
- _ = r.renderInternal.FormatWithSafeAttrs(w, ``, extraClass)
+ _ = r.renderInternal.FormatWithSafeAttrs(w, ``)
for c := n.FirstChild(); c != nil; c = c.NextSibling() {
segment := c.(*ast.Text).Segment
value := util.EscapeHTML(segment.Value(source))
diff --git a/modules/ssh/ssh.go b/modules/ssh/ssh.go
index f8e4f569b87f4..6d0695ee163fc 100644
--- a/modules/ssh/ssh.go
+++ b/modules/ssh/ssh.go
@@ -13,10 +13,12 @@ import (
"errors"
"fmt"
"io"
+ "maps"
"net"
"os"
"os/exec"
"path/filepath"
+ "reflect"
"strconv"
"strings"
"sync"
@@ -33,9 +35,22 @@ import (
gossh "golang.org/x/crypto/ssh"
)
-type contextKey string
-
-const giteaKeyID = contextKey("gitea-key-id")
+// The ssh auth overall works like this:
+// NewServerConn:
+// serverHandshake+serverAuthenticate:
+// PublicKeyCallback:
+// PublicKeyHandler (our code):
+// reset(ctx.Permissions) and set ctx.Permissions.giteaKeyID = keyID
+// pubKey.Verify
+// return ctx.Permissions // only reaches here, the pub key is really authenticated
+// set conn.Permissions from serverAuthenticate
+// sessionHandler(conn)
+//
+// Then sessionHandler should only use the "verified keyID" from the original ssh conn, but not the ctx one.
+// Otherwise, if a user provides 2 keys A (a correct one) and B (public key matches but no private key),
+// then only A succeeds to authenticate, sessionHandler will see B's keyID
+
+const giteaPermissionExtensionKeyID = "gitea-perm-ext-key-id"
func getExitStatusFromError(err error) int {
if err == nil {
@@ -61,8 +76,32 @@ func getExitStatusFromError(err error) int {
return waitStatus.ExitStatus()
}
+// sessionPartial is the private struct from "gliderlabs/ssh/session.go"
+// We need to read the original "conn" field from "ssh.Session interface" which contains the "*session pointer"
+// https://github.com/gliderlabs/ssh/blob/d137aad99cd6f2d9495bfd98c755bec4e5dffb8c/session.go#L109-L113
+// If upstream fixes the problem and/or changes the struct, we need to follow.
+// If the struct mismatches, the builtin ssh server will fail during integration tests.
+type sessionPartial struct {
+ sync.Mutex
+ gossh.Channel
+ conn *gossh.ServerConn
+}
+
+func ptr[T any](intf any) *T {
+ // https://pkg.go.dev/unsafe#Pointer
+ // (1) Conversion of a *T1 to Pointer to *T2.
+ // Provided that T2 is no larger than T1 and that the two share an equivalent memory layout,
+ // this conversion allows reinterpreting data of one type as data of another type.
+ v := reflect.ValueOf(intf)
+ p := v.UnsafePointer()
+ return (*T)(p)
+}
+
func sessionHandler(session ssh.Session) {
- keyID := fmt.Sprintf("%d", session.Context().Value(giteaKeyID).(int64))
+ // here can't use session.Permissions() because it only uses the value from ctx, which might not be the authenticated one.
+ // so we must use the original ssh conn, which always contains the correct (verified) keyID.
+ sshConn := ptr[sessionPartial](session)
+ keyID := sshConn.conn.Permissions.Extensions[giteaPermissionExtensionKeyID]
command := session.RawCommand()
@@ -164,6 +203,23 @@ func sessionHandler(session ssh.Session) {
}
func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
+ // The publicKeyHandler (PublicKeyCallback) only helps to provide the candidate keys to authenticate,
+ // It does NOT really verify here, so we could only record the related information here.
+ // After authentication (Verify), the "Permissions" will be assigned to the ssh conn,
+ // then we can use it in the "session handler"
+
+ // first, reset the ctx permissions (just like https://github.com/gliderlabs/ssh/pull/243 does)
+ // it shouldn't be reused across different ssh conn (sessions), each pub key should have its own "Permissions"
+ oldCtxPerm := ctx.Permissions().Permissions
+ ctx.Permissions().Permissions = &gossh.Permissions{}
+ ctx.Permissions().Permissions.CriticalOptions = maps.Clone(oldCtxPerm.CriticalOptions)
+
+ setPermExt := func(keyID int64) {
+ ctx.Permissions().Permissions.Extensions = map[string]string{
+ giteaPermissionExtensionKeyID: fmt.Sprint(keyID),
+ }
+ }
+
if log.IsDebug() { // <- FingerprintSHA256 is kinda expensive so only calculate it if necessary
log.Debug("Handle Public Key: Fingerprint: %s from %s", gossh.FingerprintSHA256(key), ctx.RemoteAddr())
}
@@ -238,8 +294,7 @@ func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
if log.IsDebug() { // <- FingerprintSHA256 is kinda expensive so only calculate it if necessary
log.Debug("Successfully authenticated: %s Certificate Fingerprint: %s Principal: %s", ctx.RemoteAddr(), gossh.FingerprintSHA256(key), principal)
}
- ctx.SetValue(giteaKeyID, pkey.ID)
-
+ setPermExt(pkey.ID)
return true
}
@@ -266,8 +321,7 @@ func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
if log.IsDebug() { // <- FingerprintSHA256 is kinda expensive so only calculate it if necessary
log.Debug("Successfully authenticated: %s Public Key Fingerprint: %s", ctx.RemoteAddr(), gossh.FingerprintSHA256(key))
}
- ctx.SetValue(giteaKeyID, pkey.ID)
-
+ setPermExt(pkey.ID)
return true
}
diff --git a/services/feed/notifier.go b/services/feed/notifier.go
index a8820aeb777a7..d941027c35276 100644
--- a/services/feed/notifier.go
+++ b/services/feed/notifier.go
@@ -417,6 +417,12 @@ func (a *actionNotifier) SyncPushCommits(ctx context.Context, pusher *user_model
}
func (a *actionNotifier) SyncCreateRef(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, refFullName git.RefName, refID string) {
+ // ignore pull sync message for pull requests refs
+ // TODO: it's better to have a UI to let users chose
+ if refFullName.IsPull() {
+ return
+ }
+
if err := activities_model.NotifyWatchers(ctx, &activities_model.Action{
ActUserID: repo.OwnerID,
ActUser: repo.MustOwner(ctx),
@@ -431,6 +437,12 @@ func (a *actionNotifier) SyncCreateRef(ctx context.Context, doer *user_model.Use
}
func (a *actionNotifier) SyncDeleteRef(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, refFullName git.RefName) {
+ // ignore pull sync message for pull requests refs
+ // TODO: it's better to have a UI to let users chose
+ if refFullName.IsPull() {
+ return
+ }
+
if err := activities_model.NotifyWatchers(ctx, &activities_model.Action{
ActUserID: repo.OwnerID,
ActUser: repo.MustOwner(ctx),
diff --git a/templates/repo/view_list.tmpl b/templates/repo/view_list.tmpl
index ea61c3736ae5f..0fdb45e574c8e 100644
--- a/templates/repo/view_list.tmpl
+++ b/templates/repo/view_list.tmpl
@@ -1,6 +1,6 @@
{{/* use grid layout, still use the old ID because there are many other CSS styles depending on this ID */}}
-
+
{{template "repo/latest_commit" .}}
{{if and .LatestCommit .LatestCommit.Committer}}{{DateUtils.TimeSince .LatestCommit.Committer.When}}{{end}}
diff --git a/web_src/css/repo/clone.css b/web_src/css/repo/clone.css
index 15709a78f652e..3f6a1323fea26 100644
--- a/web_src/css/repo/clone.css
+++ b/web_src/css/repo/clone.css
@@ -1,11 +1,14 @@
/* only used by "repo/empty.tmpl" */
.clone-buttons-combo {
+ display: flex;
+ align-items: center;
flex: 1;
}
.clone-buttons-combo input {
border-left: none !important;
border-radius: 0 !important;
+ height: 30px;
}
/* used by the clone-panel popup */
diff --git a/web_src/css/repo/home-file-list.css b/web_src/css/repo/home-file-list.css
index eab2124d6f489..ecb26fa6629a4 100644
--- a/web_src/css/repo/home-file-list.css
+++ b/web_src/css/repo/home-file-list.css
@@ -44,6 +44,10 @@
padding: 6px 10px;
}
+#repo-files-table .repo-file-last-commit {
+ background: var(--color-box-header);
+}
+
#repo-files-table .repo-file-cell.name {
max-width: 300px;
white-space: nowrap;
@@ -59,6 +63,7 @@
}
#repo-files-table .repo-file-cell.age {
+ text-align: right;
white-space: nowrap;
color: var(--color-text-light-1);
}
diff --git a/web_src/js/markup/math.ts b/web_src/js/markup/math.ts
index 6a1ca2f2e3836..22a4de38e9807 100644
--- a/web_src/js/markup/math.ts
+++ b/web_src/js/markup/math.ts
@@ -1,9 +1,8 @@
import {displayError} from './common.ts';
function targetElement(el: Element) {
- // The target element is either the current element if it has the
- // `is-loading` class or the pre that contains it
- return el.classList.contains('is-loading') ? el : el.closest('pre');
+ // The target element is either the parent "code block with loading indicator", or itself
+ return el.closest('.code-block.is-loading') ?? el;
}
export async function renderMath(): Promise {