|
|
|
@ -30,6 +30,8 @@ import (
|
|
|
|
|
|
|
|
|
|
"github.com/unknwon/com" |
|
|
|
|
gossh "golang.org/x/crypto/ssh" |
|
|
|
|
"golang.org/x/text/cases" |
|
|
|
|
"golang.org/x/text/language" |
|
|
|
|
ini "gopkg.in/ini.v1" |
|
|
|
|
) |
|
|
|
|
|
|
|
|
@ -637,7 +639,7 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|
|
|
|
} |
|
|
|
|
UnixSocketPermissionRaw := sec.Key("UNIX_SOCKET_PERMISSION").MustString("666") |
|
|
|
|
UnixSocketPermissionParsed, err := strconv.ParseUint(UnixSocketPermissionRaw, 8, 32) |
|
|
|
|
if err != nil || UnixSocketPermissionParsed > 0777 { |
|
|
|
|
if err != nil || UnixSocketPermissionParsed > 0o777 { |
|
|
|
|
log.Fatal("Failed to parse unixSocketPermission: %s", UnixSocketPermissionRaw) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
@ -793,16 +795,16 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|
|
|
|
SSH.AuthorizedPrincipalsAllow, SSH.AuthorizedPrincipalsEnabled = parseAuthorizedPrincipalsAllow(sec.Key("SSH_AUTHORIZED_PRINCIPALS_ALLOW").Strings(",")) |
|
|
|
|
|
|
|
|
|
if !SSH.Disabled && !SSH.StartBuiltinServer { |
|
|
|
|
if err := os.MkdirAll(SSH.RootPath, 0700); err != nil { |
|
|
|
|
if err := os.MkdirAll(SSH.RootPath, 0o700); err != nil { |
|
|
|
|
log.Fatal("Failed to create '%s': %v", SSH.RootPath, err) |
|
|
|
|
} else if err = os.MkdirAll(SSH.KeyTestPath, 0644); err != nil { |
|
|
|
|
} else if err = os.MkdirAll(SSH.KeyTestPath, 0o644); err != nil { |
|
|
|
|
log.Fatal("Failed to create '%s': %v", SSH.KeyTestPath, err) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if len(trustedUserCaKeys) > 0 && SSH.AuthorizedPrincipalsEnabled { |
|
|
|
|
fname := sec.Key("SSH_TRUSTED_USER_CA_KEYS_FILENAME").MustString(filepath.Join(SSH.RootPath, "gitea-trusted-user-ca-keys.pem")) |
|
|
|
|
if err := os.WriteFile(fname, |
|
|
|
|
[]byte(strings.Join(trustedUserCaKeys, "\n")), 0600); err != nil { |
|
|
|
|
[]byte(strings.Join(trustedUserCaKeys, "\n")), 0o600); err != nil { |
|
|
|
|
log.Fatal("Failed to create '%s': %v", fname, err) |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
@ -943,8 +945,9 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
|
|
|
|
|
// The following is a purposefully undocumented option. Please do not run Gitea as root. It will only cause future headaches.
|
|
|
|
|
// Please don't use root as a bandaid to "fix" something that is broken, instead the broken thing should instead be fixed properly.
|
|
|
|
|
unsafeAllowRunAsRoot := Cfg.Section("").Key("I_AM_BEING_UNSAFE_RUNNING_AS_ROOT").MustBool(false) |
|
|
|
|
RunMode = Cfg.Section("").Key("RUN_MODE").MustString("prod") |
|
|
|
|
IsProd = strings.EqualFold(RunMode, "prod") |
|
|
|
|
RunMode = Cfg.Section("").Key("RUN_MODE").MustString("Prod") |
|
|
|
|
RunMode = cases.Title(language.English).String(strings.ToLower(RunMode)) |
|
|
|
|
IsProd = RunMode == "Prod" |
|
|
|
|
// Does not check run user when the install lock is off.
|
|
|
|
|
if InstallLock { |
|
|
|
|
currentUser, match := IsRunUserMatchCurrentUser(RunUser) |
|
|
|
@ -1074,7 +1077,7 @@ func loadInternalToken(sec *ini.Section) string {
|
|
|
|
|
} |
|
|
|
|
switch tempURI.Scheme { |
|
|
|
|
case "file": |
|
|
|
|
fp, err := os.OpenFile(tempURI.RequestURI(), os.O_RDWR, 0600) |
|
|
|
|
fp, err := os.OpenFile(tempURI.RequestURI(), os.O_RDWR, 0o600) |
|
|
|
|
if err != nil { |
|
|
|
|
log.Fatal("Failed to open InternalTokenURI (%s): %v", uri, err) |
|
|
|
|
} |
|
|
|
|