58 Commits (e15fe853350020cc9fbaf9f9ae6b39dc88942f39)

Author	SHA1	Message	Date
wxiaoguang	49dd906753	Use base32 for 2FA scratch token (#18384) ... * Use base32 for 2FA scratch token * rename Secure* to Crypto*, add comments	3 years ago
Lunny Xiao	67d73882f4	Fix update user bug (#18250)	3 years ago
Gusted	623c93ff46	Increase Salt randomness (#18179) ... - The current implementation of `RandomString` doesn't give you a most-possible unique randomness. It gives you 6*`length` instead of the possible 8*`length` bits(or as `length`x bytes) randomness. This is because `RandomString` is being limited to a max value of 63, this in order to represent the random byte as a letter/digit. - The recommendation of pbkdf2 is to use 64+ bit salt, which the `RandomString` doesn't give with a length of 10, instead of increasing 10 to a higher number, this patch adds a new function called `RandomBytes` which does give you the guarentee of 8*`length` randomness and thus corresponding of `length`x bytes randomness. - Use hexadecimal to store the bytes value in the database, as mentioned, it doesn't play nice in order to convert it to a string. This will always be a length of 32(with `length` being 16). - When we detect on `Authenticate`(source: db) that a user has the old format of salt, re-hash the password such that the user will have it's password hashed with increased salt. Thanks to @zeripath for working out the rouge edges from my first commit 😄. Co-authored-by: lafriks <lauris@nix.lv> Co-authored-by: zeripath <art27@cantab.net>	3 years ago
Lunny Xiao	de8e3948a5	Refactor auth package (#17962)	3 years ago
zeripath	8354670708	Prevent hang in git cat-file if repository is not a valid repository and other fixes (#17991) ... This PR contains multiple fixes. The most important of which is: * Prevent hang in git cat-file if the repository is not a valid repository Unfortunately it appears that if git cat-file is run in an invalid repository it will hang until stdin is closed. This will result in deadlocked /pulls pages and dangling git cat-file calls if a broken repository is tried to be reviewed or pulls exists for a broken repository. Fix #14734 Fix #9271 Fix #16113 Otherwise there are a few small other fixes included which this PR was initially intending to fix: * Fix panic on partial compares due to missing PullRequestWorkInProgressPrefixes * Fix links on pulls pages due to regression from #17551 - by making most /issues routes match /pulls too - Fix #17983 * Fix links on feeds pages due to another regression from #17551 but also fix issue with syncing tags - Fix #17943 * Add missing locale entries for oauth group claims * Prevent NPEs if ColorFormat is called on nil users, repos or teams.	3 years ago
a1012112796	ba57e30f13	fix 500 error while use a reserved name in org rename (#17878) ... fix #17876 Signed-off-by: a1012112796 <1012112796@qq.com>	3 years ago
Lunny Xiao	371ebce252	Fix database inconsistent when admin change user email (#17549)	3 years ago
Lunny Xiao	a666829a37	Move user related model into models/user (#17781) ... * Move user related model into models/user * Fix lint for windows * Fix windows lint * Fix windows lint * Move some tests in models * Merge	3 years ago