You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

KN4CK3R c6c829fe3f Enhanced auth token / remember me (#27606) ... Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.		1 year ago
..
config	Refactor system setting (#27000)	1 year ago
actions.go	Make Actions tasks/jobs timeouts configurable by the user (#27400)	1 year ago
actions_test.go	Restrict `[actions].DEFAULT_ACTIONS_URL` to only `github` or `self` (#25581)	2 years ago
admin.go	Refactor the setting to make unit test easier (#22405)	2 years ago
api.go	Refactor the setting to make unit test easier (#22405)	2 years ago
asset_dynamic.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
asset_static.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
attachment.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
attachment_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
cache.go	Refactor the setting to make unit test easier (#22405)	2 years ago
camo.go	Refactor the setting to make unit test easier (#22405)	2 years ago
config.go	Refactor system setting (#27000)	1 year ago
config_env.go	Fix `environment-to-ini` inherited key bug (#27543)	1 year ago
config_env_test.go	Fix `environment-to-ini` inherited key bug (#27543)	1 year ago
config_provider.go	Remove redundant `len` check around loop (#27464)	1 year ago
config_provider_test.go	Fix INI parsing for value with trailing slash (#26995)	1 year ago
cors.go	Fix incorrect CORS default values (#24206)	2 years ago
cron.go	Replace `interface{}` with `any` (#25686)	2 years ago
cron_test.go	Rewrite queue (#24505)	2 years ago
database.go	Remove "CHARSET" config option for MySQL, always use "utf8mb4" (#25413)	2 years ago
database_sqlite.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
database_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
federation.go	Refactor the setting to make unit test easier (#22405)	2 years ago
git.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
git_test.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
highlight.go	Refactor the setting to make unit test easier (#22405)	2 years ago
i18n.go	Refactor the setting to make unit test easier (#22405)	2 years ago
incoming_email.go	Refactor the setting to make unit test easier (#22405)	2 years ago
indexer.go	Allow skipping forks and mirrors from being indexed (#23187)	2 years ago
indexer_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
lfs.go	Handle base64 decoding correctly to avoid panic (#26483)	1 year ago
lfs_test.go	Display deprecated warning in admin panel pages as well as in the log file (#26094)	2 years ago
log.go	Clarify the logger's MODE config option (#26267)	2 years ago
log_test.go	Replace `interface{}` with `any` (#25686)	2 years ago
mailer.go	Make mailer SMTP check have timed context (#24751)	2 years ago
mailer_test.go	Remove unnecessary code (#24610)	2 years ago
markup.go	Add .livemd as a markdown extension (#22730)	2 years ago
metrics.go	Refactor the setting to make unit test easier (#22405)	2 years ago
migrations.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mime_type_map.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mirror.go	Avoid polluting the config (#25345)	2 years ago
oauth2.go	Pre-register OAuth application for tea (#27509)	1 year ago
other.go	Refactor `setting.Other` and remove unused `SHOW_FOOTER_BRANDING` (#24270)	2 years ago
packages.go	Avoid creating directories when loading config (#25944)	2 years ago
packages_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
path.go	Update path related documents (#25417)	2 years ago
path_test.go	Refactor path & config system (#25330)	2 years ago
picture.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
project.go	Refactor the setting to make unit test easier (#22405)	2 years ago
proxy.go	Refactor the setting to make unit test easier (#22405)	2 years ago
queue.go	Increase queue length (#27555)	1 year ago
repository.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
repository_archive.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
repository_archive_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
security.go	Enhanced auth token / remember me (#27606)	1 year ago
server.go	Remove some dead code (#27196)	1 year ago
service.go	Add reverseproxy auth for API back with default disabled (#26703)	1 year ago
service_test.go	Fix allowed user types setting problem (#26200)	2 years ago
session.go	Use secure cookie for HTTPS sites (#26999)	1 year ago
setting.go	Make "install page" respect environment config (#25648)	2 years ago
setting_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
ssh.go	Expanded minimum RSA Keylength to 3072 (#26604)	1 year ago
storage.go	Fix storage path logic especially for relative paths (#26441)	1 year ago
storage_test.go	Fix storage path logic especially for relative paths (#26441)	1 year ago
task.go	handle deprecated settings (#22992)	2 years ago
time.go	Remove unused setting `time.FORMAT` (#24430)	2 years ago
ui.go	Rename the default themes to gitea-light, gitea-dark, gitea-auto (#27419)	1 year ago
webhook.go	Refactor the setting to make unit test easier (#22405)	2 years ago