mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
3ea73962ff
Finishes the residual pass: the bulk of served leaks remained (28 locale files, most templates, all raster/source assets, Chinese READMEs). Imports, identifiers, and wire contracts are left intact. - locale: 28 files, all "Gitea" -> "Hanzo Git"; docs/blog/about.gitea.* + gitea.com/.io + go-gitea help URLs -> docs.hanzo.ai / git.hanzo.ai / github.com/hanzoai/git (keys with lowercase "gitea" preserved) - templates: footer, swagger UI title + generated OpenAPI specs (stale gitea.dev x-go-package -> github.com/hanzoai/git), webhook usernames, OAuth-source labels, package/help doc links, example org/team identifiers - Go served defaults: RSS feed author/description, git commit user.name + fallback email, WWW-Authenticate realms (OAuth2/packages/container), 500/error pages, MS Teams card, built-in OAuth provider label, CLI --help, SSH + push-rejection messages, startup/index/redis/doctor logs, test-mail subject + X-Mailer - config: app.example.ini APP_NAME default - assets: source assets/*.svg, gitea.svg, gitea-gitea sprite, and all PNGs (logo/favicon/apple-touch/avatar_default) regenerated as the committed black-tile Hanzo mark; --color-logo #609926 -> monochrome; favicon-status test realigned to the new mark (viewBox 64) - README.zh-tw + README.zh-cn rewritten as Hanzo Git - render field CommitParticipant.GiteaUser -> User Preserved (imports / identifiers / external contracts): code.gitea.io, module github.com/hanzoai/git, gitea.dev/sdk dep, X-Gitea-* webhook + email headers, WWW-Authenticate realm="Gitea" in git-HTTP (Git Credential Manager OAuth2 detection), GitServiceType "Gitea" migration-source name, theme id gitea-auto, .gitea-* classes / svg symbol ids, Go/JS identifiers, "The Gitea Authors" copyright headers, outbound User-Agent headers. Co-authored-by: Hanzo Dev <[email protected]>
32 lines
1.8 KiB
Handlebars
32 lines
1.8 KiB
Handlebars
{{/*
|
|
Why we need to disable form autofill:
|
|
1. Many pages contain different password inputs for different usages, eg: repo setting, autofill will make a mess.
|
|
2. We have `areYouSure` confirm dialog if a user leaves a pages without submit.
|
|
Autofill will make the form changed even if the user didn't input anything. Then the user keeps seeing annoying confirm dialog.
|
|
|
|
In history, Hanzo Git put `<input class="fake" type="password">` in forms to bypass the autofill,
|
|
but there were still many forms suffered the autofill problem.
|
|
|
|
Now we improve it.
|
|
|
|
Solutions which do NOT work:
|
|
1. Adding `autocomplete=off` doesn't help. New Chrome completely ignores it.
|
|
2. Use a JavaScript to run in a few seconds later after the page is loaded to process the autofilled inputs, it doesn't work.
|
|
Because for security reason, the inputs won't be filled before the user makes an interaction in the page.
|
|
So we can not predict the correct time to run the JavaScript code.
|
|
|
|
Solutions which work:
|
|
1. Some hacky methods like: https://github.com/matteobad/detect-autofill
|
|
2. This solution: use invisible inputs. Be aware of:
|
|
(a) The inputs must be at the beginning of the form, and can not be hidden.
|
|
(b) The input for username must have a valid name.
|
|
(c) There should be no negative word (eg: fake) in the `name` attribute.
|
|
(d) Chrome seems to use a weighted algorithm to choose an input to fill text, so the using "username" as input name is better than using "user".
|
|
We make the names of these dummy inputs begin with an underline to indicate it is for special usage,
|
|
and these dummy form values won't be used by backend code.
|
|
*/}}
|
|
<div class="autofill-dummy" aria-hidden="true">
|
|
<input type="text" name="_autofill_dummy_username" class="ays-ignore" tabindex="-1">
|
|
<input type="password" name="_autofill_dummy_password" class="ays-ignore" tabindex="-1">
|
|
</div>
|