chore: initialize Gitea v1.27.2 fork

Includes direct password setup links in registration emails.

Assisted-by: Codex:GPT-5

modules/markup/external/external.go

@@ -0,0 +1,168 @@
+// Copyright 2017 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package external
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+
+	"github.com/kballard/go-shellquote"
+)
+
+// RegisterRenderers registers all supported third part renderers according settings
+func RegisterRenderers() {
+	markup.RegisterRenderer(&frontendRenderer{
+		name: "openapi-swagger",
+		patterns: []string{
+			"openapi.yaml",
+			"openapi.yml",
+			"openapi.json",
+			"swagger.yaml",
+			"swagger.yml",
+			"swagger.json",
+		},
+	})
+
+	markup.RegisterRenderer(&frontendRenderer{
+		name: "viewer-3d",
+		patterns: []string{
+			// It needs more logic to make it overall right (render a text 3D model automatically):
+			// we need to distinguish the ambiguous filename extensions.
+			// For example: "*.amf, *.obj, *.off, *.step" might be or not be a 3D model file.
+			// So when it is a text file, we can't assume that "we only render it by 3D plugin",
+			// otherwise the end users would be impossible to view its real content when the file is not a 3D model.
+			"*.3dm", "*.3ds", "*.3mf", "*.amf", "*.bim", "*.brep",
+			"*.dae", "*.fbx", "*.fcstd", "*.glb", "*.gltf",
+			"*.ifc", "*.igs", "*.iges", "*.stp", "*.step",
+			"*.stl", "*.obj", "*.off", "*.ply", "*.wrl",
+		},
+	})
+
+	markup.RegisterRenderer(&frontendRenderer{
+		name:     "asciicast",
+		patterns: []string{"*.cast"},
+	})
+
+	for _, renderer := range setting.ExternalMarkupRenderers {
+		markup.RegisterRenderer(&Renderer{renderer})
+	}
+}
+
+// Renderer implements markup.Renderer for external tools
+type Renderer struct {
+	*setting.MarkupRenderer
+}
+
+var (
+	_ markup.PostProcessRenderer = (*Renderer)(nil)
+	_ markup.ExternalRenderer    = (*Renderer)(nil)
+)
+
+func (p *Renderer) Name() string {
+	return p.MarkupName
+}
+
+func (p *Renderer) NeedPostProcess() bool {
+	return p.MarkupRenderer.NeedPostProcess
+}
+
+func (p *Renderer) FileNamePatterns() []string {
+	return p.FilePatterns
+}
+
+func (p *Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
+	return p.MarkupSanitizerRules
+}
+
+func (p *Renderer) GetExternalRendererOptions() (ret markup.ExternalRendererOptions) {
+	ret.SanitizerDisabled = p.RenderContentMode == setting.RenderContentModeNoSanitizer || p.RenderContentMode == setting.RenderContentModeIframe
+	ret.DisplayInIframe = p.RenderContentMode == setting.RenderContentModeIframe
+	ret.ContentSandbox = p.RenderContentSandbox
+	return ret
+}
+
+func (p *Renderer) prepareExternalCommand(vars map[string]string) (string, []string, error) {
+	fields, err := shellquote.Split(strings.TrimSpace(p.Command))
+	if err != nil {
+		return "", nil, err
+	}
+	if len(fields) == 0 {
+		return "", nil, errors.New("no command")
+	}
+	var replacements []string
+	for k, v := range vars {
+		replacements = append(replacements, "$"+k, v)
+		replacements = append(replacements, "%"+k+"%", v) // for legacy Windows-style support
+	}
+	r := strings.NewReplacer(replacements...)
+	for i := range fields {
+		fields[i] = r.Replace(fields[i])
+	}
+	return fields[0], fields[1:], nil
+}
+
+// Render renders the data of the document to HTML via the external tool.
+func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
+	baseLinkSrc := ctx.RenderHelper.ResolveLink("", markup.LinkTypeDefault)
+	baseLinkRaw := ctx.RenderHelper.ResolveLink("", markup.LinkTypeRaw)
+	cmdVars := map[string]string{
+		"GITEA_PREFIX_SRC": baseLinkSrc,
+		"GITEA_PREFIX_RAW": baseLinkRaw,
+	}
+	cmdProg, cmdArgs, err := p.prepareExternalCommand(cmdVars)
+	if err != nil {
+		return fmt.Errorf("invalid external render (%s) command %q: %w", p.Name(), p.Command, err)
+	}
+	if p.IsInputFile {
+		// write to temp file
+		tmpFile, cleanup, err := setting.AppDataTempDir("git-repo-content").CreateTempFileRandom("gitea_input")
+		if err != nil {
+			return fmt.Errorf("%s create temp file when rendering %s failed: %w", p.Name(), p.Command, err)
+		}
+		defer cleanup()
+
+		_, err = io.Copy(tmpFile, input)
+		if err != nil {
+			_ = tmpFile.Close()
+			return fmt.Errorf("%s write data to temp file when rendering %s failed: %w", p.Name(), p.Command, err)
+		}
+
+		err = tmpFile.Close()
+		if err != nil {
+			return fmt.Errorf("%s close temp file when rendering %s failed: %w", p.Name(), p.Command, err)
+		}
+		cmdArgs = append(cmdArgs, tmpFile.Name())
+	}
+
+	processCtx, _, finished := process.GetManager().AddContext(ctx, fmt.Sprintf("Render [%s] for %s", cmdProg, baseLinkSrc))
+	defer finished()
+
+	cmd := exec.CommandContext(processCtx, cmdProg, cmdArgs...)
+	cmd.Env = append(
+		os.Environ(),
+		"GITEA_PREFIX_SRC="+baseLinkSrc,
+		"GITEA_PREFIX_RAW="+baseLinkRaw,
+	)
+	if !p.IsInputFile {
+		cmd.Stdin = input
+	}
+	var stderr bytes.Buffer
+	cmd.Stdout = output
+	cmd.Stderr = &stderr
+	process.SetSysProcAttribute(cmd)
+
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("%s render run command %s %v failed: %w\nStderr: %s", p.Name(), cmdProg, shellquote.Join(cmdArgs...), err, stderr.String())
+	}
+	return nil
+}

modules/markup/external/external_test.go

@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package external
+
+import (
+	"testing"
+
+	"gitea.dev/modules/setting"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPrepareExternalCommand(t *testing.T) {
+	r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: ""}}
+	_, _, err := r.prepareExternalCommand(map[string]string{"KEY": "val"})
+	assert.ErrorContains(t, err, "no command")
+
+	r = &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: `"/foo bar/bin" --opt $KEY "$KEY" %KEY% other`}}
+	prog, args, err := r.prepareExternalCommand(map[string]string{"KEY": `a"b`})
+	assert.NoError(t, err)
+	assert.Equal(t, "/foo bar/bin", prog)
+	assert.Equal(t, []string{"--opt", `a"b`, `a"b`, `a"b`, "other"}, args)
+}

modules/markup/external/frontend.go

@@ -0,0 +1,88 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package external
+
+import (
+	"encoding/base64"
+	"errors"
+	"io"
+	"unicode/utf8"
+
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+)
+
+type frontendRenderer struct {
+	name     string
+	patterns []string
+}
+
+var _ markup.ExternalRenderer = (*frontendRenderer)(nil)
+
+func (p *frontendRenderer) Name() string {
+	return p.name
+}
+
+func (p *frontendRenderer) FileNamePatterns() []string {
+	// TODO: the file extensions are ambiguous, even if the file name matches, it doesn't mean that the file is a 3D model
+	// There are some approaches to make it more accurate, but they are all complicated:
+	// A. Make backend know everything (detect a file is a 3D model or not)
+	// B. Let frontend renders to try render one by one
+	//
+	// If there would be more frontend renders in the future, we need to implement the "frontend" approach:
+	// 1. Make backend or parent window collect the supported extensions of frontend renders (done: backend external render framework)
+	// 2. If the current file matches any extension, start the general iframe embedded render (done: this renderer)
+	// 3. The iframe window calls the frontend renders one by one (done: frontend external render)
+	// 4. Report the render result to parent by postMessage (TODO: when needed)
+	return p.patterns
+}
+
+func (p *frontendRenderer) SanitizerRules() []setting.MarkupSanitizerRule {
+	return nil
+}
+
+func (p *frontendRenderer) GetExternalRendererOptions() (ret markup.ExternalRendererOptions) {
+	ret.SanitizerDisabled = true
+	ret.DisplayInIframe = true
+	ret.ContentSandbox = setting.MarkupRenderDefaultSandbox
+	return ret
+}
+
+func (p *frontendRenderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
+	if ctx.RenderOptions.StandalonePageOptions == nil {
+		return errors.New("should only be rendered in standalone page")
+	}
+
+	content, err := util.ReadWithLimit(input, int(setting.UI.MaxDisplayFileSize))
+	if err != nil {
+		return err
+	}
+
+	contentEncoding, contentString := "text", util.UnsafeBytesToString(content)
+	if !utf8.Valid(content) {
+		contentEncoding = "base64"
+		contentString = base64.StdEncoding.EncodeToString(content)
+	}
+
+	_, err = htmlutil.HTMLPrintf(output,
+		`<!DOCTYPE html>
+<html>
+<head>
+	<!-- external-render-helper will be injected here by the markup render -->
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+</head>
+<body>
+	<div id="frontend-render-viewer" data-frontend-renders="%s" data-file-tree-path="%s"></div>
+	<textarea id="frontend-render-data" data-content-encoding="%s" hidden>%s</textarea>
+	<script nonce type="module" src="%s"></script>
+</body>
+</html>`,
+		p.name, ctx.RenderOptions.RelativePath,
+		contentEncoding, contentString,
+		public.AssetURI("web_src/js/external-render-frontend.ts"))
+	return err
+}