forgejo

foster/forgejo

Fork 0

mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-11 11:28:02 -05:00

Commit graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Gusted	f5e78e4c20	[SECURITY] Rework long-term authentication - This is a 'front-port' of the already existing patch on v1.21 and v1.20, but applied on top of what Gitea has done to rework the LTA mechanism. Forgejo will stick with the reworked mechanism by the Forgejo Security team for the time being. The removal of legacy code (AES-GCM) has been left out. - The current architecture is inherently insecure, because you can construct the 'secret' cookie value with values that are available in the database. Thus provides zero protection when a database is dumped/leaked. - This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies). - Integration testing is added to ensure the new mechanism works. - Removes a setting, because it's not used anymore. (cherry picked from commit `e3d6622a63`) (cherry picked from commit `fef1a6dac5`) (cherry picked from commit `b0c5165145`) (cherry picked from commit `7ad51b9f8d`) (cherry picked from commit `64f053f383`)	2023-12-25 11:02:13 +01:00
Gusted	d2952769c1	[DB] forgejo migration v1: add blocked user migration (cherry picked from commit `66afddd511`) (cherry picked from commit `19da0dee9d`) (cherry picked from commit `0b725af693`) (cherry picked from commit `64d4de2b66`) (cherry picked from commit `05bc9d3b7f`) (cherry picked from commit `5958553066`) (cherry picked from commit `c4f77e26c9`) (cherry picked from commit `3034832c66`) (cherry picked from commit `d48931ec5b`) (cherry picked from commit `b1e0d53c28`) (cherry picked from commit `e3de35fe15`) (cherry picked from commit `3b2712c3d6`) (cherry picked from commit `00c6940851`) (cherry picked from commit `ac56c7a202`) (cherry picked from commit `d957fb66de`) (cherry picked from commit `01e9125f1b`) (cherry picked from commit `71675caecb`) (cherry picked from commit `0313d02e50`)	2023-12-25 11:00:50 +01:00
Earl Warren	a763fa5de2	[DB] forgejo migration v2: create the forgejo_sem_ver table (cherry picked from commit `86b26436af`) (cherry picked from commit `479cba59ac`) (cherry picked from commit `4765f9a889`) (cherry picked from commit `af771410bf`) (cherry picked from commit `d1ea9305d8`) (cherry picked from commit `f77e1bb7ab`) (cherry picked from commit `0b95f8fe89`) (cherry picked from commit `4f8fb2390a`) (cherry picked from commit `8ea0e22ff6`) (cherry picked from commit `43ac19ac59`) (cherry picked from commit `0d2f63df4f`) (cherry picked from commit `d02a8036fd`) (cherry picked from commit `1fe4c7db94`) (cherry picked from commit `d641cdeaf0`) (cherry picked from commit `10e8a4f8b8`) (cherry picked from commit `8097bc40b3`) (cherry picked from commit `ee5cb37d7e`) (cherry picked from commit `26d93b8e49`) (cherry picked from commit `bc73195e59`)	2023-12-25 11:00:50 +01:00

Gusted

f5e78e4c20

[SECURITY] Rework long-term authentication

- This is a 'front-port' of the already existing patch on v1.21 and
v1.20, but applied on top of what Gitea has done to rework the LTA
mechanism. Forgejo will stick with the reworked mechanism by the Forgejo
Security team for the time being. The removal of legacy code (AES-GCM) has been
left out.
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit e3d6622a63)
(cherry picked from commit fef1a6dac5)
(cherry picked from commit b0c5165145)
(cherry picked from commit 7ad51b9f8d)
(cherry picked from commit 64f053f383)

2023-12-25 11:02:13 +01:00

Gusted

d2952769c1

[DB] forgejo migration v1: add blocked user migration

(cherry picked from commit 66afddd511)
(cherry picked from commit 19da0dee9d)
(cherry picked from commit 0b725af693)
(cherry picked from commit 64d4de2b66)
(cherry picked from commit 05bc9d3b7f)
(cherry picked from commit 5958553066)
(cherry picked from commit c4f77e26c9)
(cherry picked from commit 3034832c66)
(cherry picked from commit d48931ec5b)
(cherry picked from commit b1e0d53c28)
(cherry picked from commit e3de35fe15)
(cherry picked from commit 3b2712c3d6)
(cherry picked from commit 00c6940851)
(cherry picked from commit ac56c7a202)
(cherry picked from commit d957fb66de)
(cherry picked from commit 01e9125f1b)
(cherry picked from commit 71675caecb)
(cherry picked from commit 0313d02e50)

2023-12-25 11:00:50 +01:00

Earl Warren

a763fa5de2

[DB] forgejo migration v2: create the forgejo_sem_ver table

(cherry picked from commit 86b26436af)
(cherry picked from commit 479cba59ac)
(cherry picked from commit 4765f9a889)
(cherry picked from commit af771410bf)
(cherry picked from commit d1ea9305d8)
(cherry picked from commit f77e1bb7ab)
(cherry picked from commit 0b95f8fe89)
(cherry picked from commit 4f8fb2390a)
(cherry picked from commit 8ea0e22ff6)
(cherry picked from commit 43ac19ac59)
(cherry picked from commit 0d2f63df4f)
(cherry picked from commit d02a8036fd)
(cherry picked from commit 1fe4c7db94)
(cherry picked from commit d641cdeaf0)
(cherry picked from commit 10e8a4f8b8)
(cherry picked from commit 8097bc40b3)
(cherry picked from commit ee5cb37d7e)
(cherry picked from commit 26d93b8e49)
(cherry picked from commit bc73195e59)

2023-12-25 11:00:50 +01:00

3 commits