oss/forgejo
oss/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-09-30 19:22:08 +00:00
Code Wiki Activity

[v12.0/forgejo] fix: don't allow credentials in migrate/push mirror URL (#9078)

Browse source 
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9064

It is no longer possible to specify the user and password when providing a URL for migrating a repository, the fields dedicated to that purpose on the form must be used instead. This is to prevent that those credentials are displayed in the repository settings that are visible by the repository admins, in the case where the migration is a mirror.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9064): <!--number 9064 --><!--line 0 --><!--description ZG9uJ3QgYWxsb3cgY3JlZGVudGlhbHMgaW4gbWlncmF0ZS9wdXNoIG1pcnJvciBVUkw=-->don't allow credentials in migrate/push mirror URL<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9078
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
This commit is contained in:
forgejo-backport-action 2025-08-30 18:42:39 +02:00 • committed by Earl Warren
parent 5538ab29e3
commit 43664f79b9
12 changed files with 171 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

43
tests/integration/mirror_push_test.go
View file

@ -17,6 +17,7 @@ import (
"time"
asymkey_model "forgejo.org/models/asymkey"
auth_model "forgejo.org/models/auth"
"forgejo.org/models/db"
repo_model "forgejo.org/models/repo"
"forgejo.org/models/unit"
@ -26,7 +27,9 @@ import (
"forgejo.org/modules/gitrepo"
"forgejo.org/modules/optional"
"forgejo.org/modules/setting"
api "forgejo.org/modules/structs"
"forgejo.org/modules/test"
"forgejo.org/modules/translation"
gitea_context "forgejo.org/services/context"
doctor "forgejo.org/services/doctor"
"forgejo.org/services/migrations"
@ -38,6 +41,46 @@ import (
"github.com/stretchr/testify/require"
)
func TestPushMirrorRedactCredential(t *testing.T) {
defer test.MockVariableValue(&setting.Mirror.Enabled, true)()
defer tests.PrepareTestEnv(t)()
session := loginUser(t, "user2")
cloneAddr := "https://:TOKEN@example.com/example/example.git"
t.Run("Web route", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
resp := session.MakeRequest(t, NewRequestWithValues(t, "POST", "/user2/repo1/settings", map[string]string{
"_csrf": GetCSRF(t, session, "/user2/repo1/settings"),
"action": "push-mirror-add",
"push_mirror_address": cloneAddr,
"push_mirror_interval": "0",
}), http.StatusOK)
htmlDoc := NewHTMLParser(t, resp.Body)
assert.Contains(t,
htmlDoc.doc.Find(".ui.negative.message").Text(),
translation.NewLocale("en-US").Tr("migrate.form.error.url_credentials"),
)
})
t.Run("API route", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
resp := MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/push_mirrors", &api.CreatePushMirrorOption{
RemoteAddress: cloneAddr,
Interval: "0",
}).AddTokenAuth(token), http.StatusBadRequest)
var respBody map[string]any
DecodeJSON(t, resp, &respBody)
assert.Equal(t, "The URL contains credentials", respBody["message"])
})
}
func TestMirrorPush(t *testing.T) {
onGiteaRun(t, testMirrorPush)
}