forgejo

magic_rb/forgejo

Template

Fork 0

mirror of https://codeberg.org/forgejo/forgejo synced 2024-12-11 22:11:58 +01:00

Commit graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Gusted	fef1a6dac5	[SECURITY] Rework long-term authentication - This is a 'front-port' of the already existing patch on v1.21 and v1.20, but applied on top of what Gitea has done to rework the LTA mechanism. Forgejo will stick with the reworked mechanism by the Forgejo Security team for the time being. The removal of legacy code (AES-GCM) has been left out. - The current architecture is inherently insecure, because you can construct the 'secret' cookie value with values that are available in the database. Thus provides zero protection when a database is dumped/leaked. - This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies). - Integration testing is added to ensure the new mechanism works. - Removes a setting, because it's not used anymore. (cherry picked from commit `e3d6622a63`)	2023-11-27 16:17:05 +01:00
Gusted	d957fb66de	[DB] forgejo migration v1: add blocked user migration (cherry picked from commit `66afddd511`) (cherry picked from commit `19da0dee9d`) (cherry picked from commit `0b725af693`) (cherry picked from commit `64d4de2b66`) (cherry picked from commit `05bc9d3b7f`) (cherry picked from commit `5958553066`) (cherry picked from commit `c4f77e26c9`) (cherry picked from commit `3034832c66`) (cherry picked from commit `d48931ec5b`) (cherry picked from commit `b1e0d53c28`) (cherry picked from commit `e3de35fe15`) (cherry picked from commit `3b2712c3d6`) (cherry picked from commit `00c6940851`) (cherry picked from commit `ac56c7a202`)	2023-11-27 16:16:02 +01:00
Earl Warren	8097bc40b3	[DB] forgejo migration v2: create the forgejo_sem_ver table (cherry picked from commit `86b26436af`) (cherry picked from commit `479cba59ac`) (cherry picked from commit `4765f9a889`) (cherry picked from commit `af771410bf`) (cherry picked from commit `d1ea9305d8`) (cherry picked from commit `f77e1bb7ab`) (cherry picked from commit `0b95f8fe89`) (cherry picked from commit `4f8fb2390a`) (cherry picked from commit `8ea0e22ff6`) (cherry picked from commit `43ac19ac59`) (cherry picked from commit `0d2f63df4f`) (cherry picked from commit `d02a8036fd`) (cherry picked from commit `1fe4c7db94`) (cherry picked from commit `d641cdeaf0`) (cherry picked from commit `10e8a4f8b8`)	2023-11-27 16:16:02 +01:00

Gusted

fef1a6dac5

[SECURITY] Rework long-term authentication

- This is a 'front-port' of the already existing patch on v1.21 and
v1.20, but applied on top of what Gitea has done to rework the LTA
mechanism. Forgejo will stick with the reworked mechanism by the Forgejo
Security team for the time being. The removal of legacy code (AES-GCM) has been
left out.
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit e3d6622a63)

2023-11-27 16:17:05 +01:00

Gusted

d957fb66de

[DB] forgejo migration v1: add blocked user migration

(cherry picked from commit 66afddd511)
(cherry picked from commit 19da0dee9d)
(cherry picked from commit 0b725af693)
(cherry picked from commit 64d4de2b66)
(cherry picked from commit 05bc9d3b7f)
(cherry picked from commit 5958553066)
(cherry picked from commit c4f77e26c9)
(cherry picked from commit 3034832c66)
(cherry picked from commit d48931ec5b)
(cherry picked from commit b1e0d53c28)
(cherry picked from commit e3de35fe15)
(cherry picked from commit 3b2712c3d6)
(cherry picked from commit 00c6940851)
(cherry picked from commit ac56c7a202)

2023-11-27 16:16:02 +01:00

Earl Warren

8097bc40b3

[DB] forgejo migration v2: create the forgejo_sem_ver table

(cherry picked from commit 86b26436af)
(cherry picked from commit 479cba59ac)
(cherry picked from commit 4765f9a889)
(cherry picked from commit af771410bf)
(cherry picked from commit d1ea9305d8)
(cherry picked from commit f77e1bb7ab)
(cherry picked from commit 0b95f8fe89)
(cherry picked from commit 4f8fb2390a)
(cherry picked from commit 8ea0e22ff6)
(cherry picked from commit 43ac19ac59)
(cherry picked from commit 0d2f63df4f)
(cherry picked from commit d02a8036fd)
(cherry picked from commit 1fe4c7db94)
(cherry picked from commit d641cdeaf0)
(cherry picked from commit 10e8a4f8b8)

2023-11-27 16:16:02 +01:00

3 commits