mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-30 22:21:58 +01:00
ARUNAVO RAY
c6157cdaad
* fix(security): guard connection tests, close sign-up and scope SSO providers Fixes the four privately reported issues GHSA-9m33-xfrc-5jxw, GHSA-6m23-28hh-gjh2, GHSA-2hpx-83vg-gm45 and GHSA-5pp8-r7f5-6q8p. - The Gitea and GitHub test-connection routes require a signed-in user. They were the only non-public API routes without a guard and made a server side request to any URL in the body. - Email sign-up is refused server side once an account exists unless AUTH_ALLOW_SIGNUP=true. Only the signup page redirected before; the endpoint accepted new accounts from anyone reaching the instance. - SSO providers are scoped to their owner for list, update and delete, and the client secret is never returned. An empty secret on update keeps the stored one, and the form says so. - HttpError messages carry the status only; the upstream body stays on the response field for logs and never reaches API clients. - A narrow outbound guard for user supplied URLs (connection tests, OIDC discovery, ntfy, Gotify, Apprise, webhook): link local and cloud metadata addresses are refused, host names are resolved and checked, and redirects are not followed. Private networks stay allowed since mirroring to a LAN Gitea is the normal deployment. * fix(security): pin plain http requests to the checked address The guard resolved a host name and checked its addresses, but fetch resolved the name a second time, so a name that changes its answer between the two lookups could still reach a link local address. Plain http requests now go to the address the check saw, with the original name in the Host header. https keeps the name: the certificate is validated against it and the metadata services speak no TLS.
Gitea Mirror Marketing Site
This Astro workspace powers the public marketing experience for Gitea Mirror. It includes the landing page, screenshots, call-to-action components, and the new use case library that highlights real-world workflows.
Developing Locally
bun install
bun run dev
The site is available at http://localhost:4321. Tailwind CSS v4 handles styling; classes can be used directly inside Astro, MDX, and React components.
Project Structure
src/pages/index.astro– Main landing pagesrc/components/– Reusable UI (Header, Hero, Features, UseCases, etc.)src/lib/use-cases.ts– Central data source for use case titles, summaries, and tagssrc/pages/use-cases/– MDX guides for each use case, rendered withUseCaseLayoutsrc/layouts/UseCaseLayout.astro– Shared layout that injects the header, shader background, and footer into MDX guides
Authoring Use Case Guides
- Add or update a record in
src/lib/use-cases.ts. This keeps the landing page and library listing in sync. - Create a new MDX file in
src/pages/use-cases/<slug>.mdxwith theUseCaseLayoutlayout and descriptive frontmatter. - Run
bun run devto preview the layout and ensure the new guide inherits global styles.
Deployment
The marketing site is built with the standard Astro pipeline. Use bun run build to generate a production build before deploying.