You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

KN4CK3R c6c829fe3f Enhanced auth token / remember me (#27606) ... Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.		1 year ago
..
actions	chore(actions): support cron schedule task (#26655)	2 years ago
activitypub	make writing main test easier (#27270)	2 years ago
analyze	Rename code_langauge.go to code_language.go (#26377)	2 years ago
assetfs	Use `Set[Type]` instead of `map[Type]bool/struct{}`. (#26804)	2 years ago
auth	Next round of `db.DefaultContext` refactor (#27089)	2 years ago
avatar	Remove nfnt/resize and oliamb/cutter (#25999)	2 years ago
base	Replace `interface{}` with `any` (#25686)	2 years ago
cache	improve unit test for caching (#26185)	2 years ago
charset	Replace `interface{}` with `any` (#25686)	2 years ago
container	Implement FSFE REUSE for golang files (#21840)	2 years ago
context	Enhanced auth token / remember me (#27606)	1 year ago
contexttest	Replace assert.Fail with assert.FailNow (#27578)	1 year ago
csv	Refactor locale number (#24134)	2 years ago
doctor	Penultimate round of `db.DefaultContext` refactor (#27414)	1 year ago
emoji	Update emoji set to Unicode 15 (#25595)	2 years ago
eventsource	More `db.DefaultContext` refactor (#27265)	1 year ago
generate	Handle base64 decoding correctly to avoid panic (#26483)	2 years ago
git	Replace assert.Fail with assert.FailNow (#27578)	1 year ago
gitgraph	More `db.DefaultContext` refactor (#27265)	1 year ago
graceful	Allow the use of alternative net.Listener implementations by downstreams (#25855)	2 years ago
hcaptcha	Consume hcaptcha and pwn deps (#22610)	2 years ago
highlight	Upgrade go dependencies (#25819)	2 years ago
hostmatcher	Implement FSFE REUSE for golang files (#21840)	2 years ago
html	Refactor backend SVG package and add tests (#26335)	2 years ago
httpcache	Less naked returns (#25713)	2 years ago
httplib	Less naked returns (#25713)	2 years ago
indexer	Replace assert.Fail with assert.FailNow (#27578)	1 year ago
issue/template	Replace `interface{}` with `any` (#25686)	2 years ago
json	Replace `interface{}` with `any` (#25686)	2 years ago
label	Make label templates have consistent behavior and priority (#23749)	2 years ago
lfs	Refactor lfs requests (#26783)	2 years ago
log	Reduce some allocations in type conversion (#26772)	2 years ago
markup	fix media description render for orgmode (#26895)	2 years ago
mcaptcha	Implement FSFE REUSE for golang files (#21840)	2 years ago
metrics	Reduce usage of `db.DefaultContext` (#27073)	2 years ago
migration	Replace `interface{}` with `any` (#25686)	2 years ago
nosql	Update tool dependencies, lock govulncheck and actionlint (#25655)	2 years ago
options	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
packages	Use docs.gitea.com instead of docs.gitea.io (#26739)	2 years ago
paginator	Use more specific test methods (#24265)	2 years ago
pprof	Implement FSFE REUSE for golang files (#21840)	2 years ago
private	Replace `interface{}` with `any` (#25686)	2 years ago
process	Replace assert.Fail with assert.FailNow (#27578)	1 year ago
proxy	Use proxy for pull mirror (#22771)	2 years ago
proxyprotocol	Implement FSFE REUSE for golang files (#21840)	2 years ago
public	Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974)	2 years ago
queue	Increase queue length (#27555)	1 year ago
recaptcha	Implement FSFE REUSE for golang files (#21840)	2 years ago
references	Replace 'userxx' with 'orgxx' in all test files when the user type is org (#27052)	2 years ago
regexplru	Upgrade go dependencies (#25819)	2 years ago
repository	Refactor system setting (#27000)	1 year ago
secret	Improve decryption failure message (#24573)	2 years ago
session	Next round of `db.DefaultContext` refactor (#27089)	2 years ago
setting	Enhanced auth token / remember me (#27606)	1 year ago
sitemap	Fix sitemap (#22272)	2 years ago
ssh	restrict certificate type for builtin SSH server (#26789)	2 years ago
storage	Fix object storage path handling (#27024)	2 years ago
structs	Restore warning commit status (#27504)	1 year ago
svg	Refactor backend SVG package and add tests (#26335)	2 years ago
sync	Implement FSFE REUSE for golang files (#21840)	2 years ago
system	make writing main test easier (#27270)	2 years ago
templates	Improve feed icons and feed merge text color (#27498)	1 year ago
test	Move web/api context related testing function into a separate package (#26859)	2 years ago
testlogger	Replace `interface{}` with `any` (#25686)	2 years ago
timeutil	Fix incorrect webhook time and use relative-time to display it (#24477)	2 years ago
translation	Replace `interface{}` with `any` (#25686)	2 years ago
turnstile	Add new captcha: cloudflare turnstile (#22369)	2 years ago
typesniffer	Detect ogg mime-type as audio or video (#26494)	2 years ago
updatechecker	Implement FSFE REUSE for golang files (#21840)	2 years ago
upload	Implement FSFE REUSE for golang files (#21840)	2 years ago
uri	Implement FSFE REUSE for golang files (#21840)	2 years ago
user	Implement FSFE REUSE for golang files (#21840)	2 years ago
util	Refactor lfs requests (#26783)	2 years ago
validation	Check blocklist for emails when adding them to account (#26812)	2 years ago
web	Remove some dead code (#27196)	2 years ago
webhook	New webhook trigger for receiving Pull Request review requests (#24481)	2 years ago