domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

[GITEA] Revert "Deprecate query string auth tokens (#28390)"

Browse source 
It shows warnings although the setting is not set, this will surely be
fixed later but there is no sense in spaming the users right now. This
revert can be discarded when another fix lands in v1.21.

su -c "forgejo admin user generate-access-token -u root --raw --scopes 'all,sudo'" git
2023/12/12 15:54:45 .../setting/security.go:166:loadSecurityFrom() [W] Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will default to true in gitea 1.23 and will be removed in gitea 1.24.

This reverts commit 4e879fed90.

Conflicts:
	routers/api/v1/api.go
	trivial context conflict

(cherry picked from commit dec6f80559)
(cherry picked from commit 807b6d9066)
(cherry picked from commit 37e21a0c17)
This commit is contained in:
Earl Warren 2023-12-18 19:30:08 +01:00
parent 5e98785109
commit 63b9ebb430
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
5 changed files with 7 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/setting/security.go
View file

@ -34,7 +34,6 @@ var (
PasswordHashAlgo string
PasswordCheckPwn bool
SuccessfulTokensCacheSize int
DisableQueryAuthToken bool
CSRFCookieName = "_csrf"
CSRFCookieHTTPOnly = true
)
@ -158,11 +157,4 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
PasswordComplexity = append(PasswordComplexity, name)
}
}
// TODO: default value should be true in future releases
DisableQueryAuthToken = sec.Key("DISABLE_QUERY_AUTH_TOKEN").MustBool(false)
if !DisableQueryAuthToken {
log.Warn("Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will default to true in gitea 1.23 and will be removed in gitea 1.24.")
}
}