There are multiple places where Gitea does not properly escape URLs that it is building and there are multiple places where it builds urls when there is already a simpler function available to use this.
This is an extensive PR attempting to fix these issues.
1. The first commit in this PR looks through all href, src and links in the Gitea codebase and has attempted to catch all the places where there is potentially incomplete escaping.
2. Whilst doing this we will prefer to use functions that create URLs over recreating them by hand.
3. All uses of strings should be directly escaped - even if they are not currently expected to contain escaping characters. The main benefit to doing this will be that we can consider relaxing the constraints on user names and reponames in future.
4. The next commit looks at escaping in the wiki and re-considers the urls that are used there. Using the improved escaping here wiki files containing '/'. (This implementation will currently still place all of the wiki files the root directory of the repo but this would not be difficult to change.)
5. The title generation in feeds is now properly escaped.
6. EscapePound is no longer needed - urls should be PathEscaped / QueryEscaped as necessary but then re-escaped with Escape when creating html with locales Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
* Remove swipe-bar z-index
Fixes position of swipe-bar so it does not overlay other UI components when scrolling.
Signed-off-by: Mario Lubenka <[email protected]>
* Unique names for image tabs in pull request
Define unique names for image tabs in pull requests, in order to toggle tabs correctly when multiple are displayed on one page.
Signed-off-by: Mario Lubenka <[email protected]>
Co-authored-by: Lauris BH <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
Co-authored-by: wxiaoguang <[email protected]>
* Added type sniffer.
* Switched content detection from base to typesniffer.
* Added GuessContentType to Blob.
* Moved image info logic to client.
Added support for SVG images in diff.
* Restore old blocked svg behaviour.
* Added missing image formats.
* Execute image diff only when container is visible.
* add margin to spinner
* improve BIN tag on image diffs
* Default to render view.
* Show image diff on incomplete diff.
Co-authored-by: silverwind <[email protected]>
Co-authored-by: Lunny Xiao <[email protected]>
Co-authored-by: Lauris BH <[email protected]>
* Enforce tab indendation in templates
This adds editorconfig-checker [1] to lint the template files so they
conform the editorconfig files. I fixed all current identation issues
using the fix mode of eclint [2] and some manual corrections.
We can extend this linting to other files later, for now I'd like this
PR to focus on HTML template files only.
[1] https://github.com/editorconfig-checker/editorconfig-checker
[2] https://github.com/jedmao/eclint
* fix indendation
Co-authored-by: zeripath <[email protected]>
Co-authored-by: techknowlogick <[email protected]>
* Search and Diff CSS enhancements
- Use flexbox for language stats
- Improve labels and code boxes on repo and code search
- Use flexbox on diff header and improve suppressed diff text
- Add dedicated color for diff expander
* more diff tweaks, less vertical padding on header
* more minor tweaks
* always show fold icon, image diff improvments
* remove margin
Co-authored-by: Lunny Xiao <[email protected]>
Co-authored-by: techknowlogick <[email protected]>
* Resolve error when comparing images
Signed-off-by: Mario Lubenka <[email protected]>
* Check blob existence instead of git-ls when checking if file exists
Signed-off-by: Mario Lubenka <[email protected]>
* Show file metadata also when a file was newly added
Signed-off-by: Mario Lubenka <[email protected]>
* Fixes error in commit view
Signed-off-by: Mario Lubenka <[email protected]>
* Excludes assigning path and image infos for compare routers to service package
Signed-off-by: Mario Lubenka <[email protected]>
* Removes nil default and fixes import order
Signed-off-by: Mario Lubenka <[email protected]>
* Adds missing comments
Signed-off-by: Mario Lubenka <[email protected]>
* Moves methods for assigning compare data to context into repo router package
Signed-off-by: Mario Lubenka <[email protected]>
* Show image compare for deleted images as well. Simplify check if image should be displayed
Signed-off-by: Mario Lubenka <[email protected]>
* Adds side-by-side diff for images
Signed-off-by: Mario Lubenka <[email protected]>
* Explain blank imports
Signed-off-by: Mario Lubenka <[email protected]>
* Use complete word for width and height labels on image compare
Signed-off-by: Mario Lubenka <[email protected]>
* Update index.css from master
Signed-off-by: Mario Lubenka <[email protected]>
* Moves ImageInfo to git commit file
Signed-off-by: Mario Lubenka <[email protected]>
* Assign ImageInfo function for template and sets correct target for BeforeSourcePath
Signed-off-by: Mario Lubenka <[email protected]>
* Adds missing comment
Signed-off-by: Mario Lubenka <[email protected]>
* Return error if ImageInfo failed
Signed-off-by: Mario Lubenka <[email protected]>
* Avoid template panic when ImageInfo failed for some reason
Signed-off-by: Mario Lubenka <[email protected]>
* Show file size on image diff
Signed-off-by: Mario Lubenka <[email protected]>
* Removes unused helper function
Signed-off-by: Mario Lubenka <[email protected]>
* Reverts copyright year change
Signed-off-by: Mario Lubenka <[email protected]>
* Close file reader
Signed-off-by: Mario Lubenka <[email protected]>
* Update commit.go
Sets correct data key
* Moves reader.Close() up a few lines
* Updates index.css
* Updates CSS file
Signed-off-by: Mario Lubenka <[email protected]>
* Transfers adjustments for image compare to compare.go file
Signed-off-by: Mario Lubenka <[email protected]>
* Adjusts variable name
Signed-off-by: Mario Lubenka <[email protected]>
* Apply lesshint recommendations
Signed-off-by: Mario Lubenka <[email protected]>
* Do not show old image on image compare if it is not in index of base commit
Signed-off-by: Mario Lubenka <[email protected]>
* Change file size text
Signed-off-by: Mario Lubenka <[email protected]>
zeripathandGitHub
