From 8fa9547fb1b9537e418cf90a4b3a70d57df0da55 Mon Sep 17 00:00:00 2001 From: casjay Date: Sat, 3 Oct 2026 20:30:18 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20Remove=20DISABLE=5FQUERY=5FAUTH?= =?UTF-8?q?=5FTOKEN=20pin=20from=20app.ini=20=F0=9F=94=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gitea 28 still defaults the setting to false, so dropping the explicit pin changes no behaviour and removes its startup warning. Existing installs keep whatever they already have; the startup script never touched this key. - rootfs/tmp/etc/gitea/app.ini: remove DISABLE_QUERY_AUTH_TOKEN and its explanatory comment from [security] - TODO.AI.md: note the removal in the Gitea 28 migration entry Claude-Session: https://claude.ai/code/session_01Kae22tmhzhmfHyqc34PZbx --- TODO.AI.md | 4 ++-- rootfs/tmp/etc/gitea/app.ini | 5 ----- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/TODO.AI.md b/TODO.AI.md index f257a34..4933d10 100644 --- a/TODO.AI.md +++ b/TODO.AI.md @@ -23,8 +23,8 @@ deprecated `[webhook]` key is moved to `[security]`), `[migrations]` host list and `EGRESS_MODE` are added only when missing. Dead keys are left in place (ignored by Gitea). - Verified with the real image: a fresh install and an upgrade of a real customised config both start with - zero `[E]` and, for the upgrade, zero warnings. Kept on purpose: `DISABLE_QUERY_AUTH_TOKEN = false` (an - earlier deliberate pin) so a fresh install still logs its one warning. + zero `[E]` and, for the upgrade, zero warnings. `DISABLE_QUERY_AUTH_TOKEN = false` pin removed at the + owner's request (28 still defaults to false, so no behaviour change; the startup warning is gone). - Behaviour now actually in effect (was silently ignored before): `[migrations] SKIP_TLS_VERIFY = true` and migrations/mirrors may reach private and loopback hosts. Needs the owner's confirmation. diff --git a/rootfs/tmp/etc/gitea/app.ini b/rootfs/tmp/etc/gitea/app.ini index 99c443d..90d20f7 100644 --- a/rootfs/tmp/etc/gitea/app.ini +++ b/rootfs/tmp/etc/gitea/app.ini @@ -198,11 +198,6 @@ REVERSE_PROXY_AUTHENTICATION_FULL_NAME = X-WEBAUTH-FULLNAME X_FRAME_OPTIONS = SAMEORIGIN ALLOWED_HOST_LIST = private,loopback EGRESS_MODE = lax -; explicit: defaults to true starting Gitea 1.23 and deprecates ?token=/?access_token= -; auth entirely in 1.24 — pin false so query-token API calls keep authenticating on -; upgrade instead of silently downgrading to anonymous; migrate callers to -; "Authorization: token " when convenient -DISABLE_QUERY_AUTH_TOKEN = false ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; [time] DEFAULT_UI_LOCATION = REPLACE_TZ