forgejo/services/context
AverageHelper 408572dd35 feat: in-browser validation of website URLs for user, repository, and organization profiles (#12991)
This PR pertains to the client-side validation of the Website input on user, repo, and org profiles. #12962 extends `[service].VALID_SITE_URL_SCHEMES` to cover Website fields on repo and org profiles, where before that config key only applied to the one on user profiles. If that change merges, it will then be possible to construct an HTML [`pattern`](https://developer.mozilla.org/docs/Web/HTML/Reference/Elements/input#pattern) attribute for general use on any Website form input that the server validates this way, thus enabling browsers to catch errors early relating to URL scheme confusion.

This PR (1) introduces such a `pattern` attribute, and (2) adds a new UI note to make clear to users which URL schemes are permitted. This change helps explain the browser's otherwise cryptic error messages regarding pattern mismatch, while also letting users know what URI schemes the Forgejo instance supports as Website links (e.g. gemini:// URLs).

![A text field labeled "Website", with a note below which reads, "Allowed URL schemes include: http, https"](/attachments/304e17ee-b5aa-414e-a4fa-d48639336c6c)

This MUST NOT merge before #12962. To do so would introduce a regression wherein the UI may suggest and validate a different set of allowed URL schemes than the server actually permits.

See also #5519

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12991
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
2026-06-08 17:35:15 +02:00
..
upload chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
access_log.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
api.go feat: remove no-transform in Cache-Control header. (#12905) 2026-06-03 05:38:47 +02:00
api_org.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
api_test.go feat: remove admin-level permissions from repo-specific & public-only access tokens (#11468) 2026-03-04 16:17:41 +01:00
base.go fix: omit Content-Length on 307 redirects when serving direct manifest for containers (#8037) 2025-06-09 08:43:41 +02:00
base_test.go branding!: make cookies brand independent (#10645) 2026-03-19 04:34:27 +01:00
captcha.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
context.go feat: in-browser validation of website URLs for user, repository, and organization profiles (#12991) 2026-06-08 17:35:15 +02:00
context_cookie.go feat: persist OAuth2/OIDC sign-in via IdP re-validation (#12321) 2026-05-15 02:31:20 +02:00
context_model.go chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
context_request.go fix: return bad request on malformed packages upload input (#10954) 2026-02-13 18:04:19 +01:00
context_response.go chore: handle error types consistently (#9873) 2026-03-06 00:48:06 +01:00
context_test.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
org.go fix(web): org projects assignment in issue view (#7999) 2026-05-02 01:29:40 +02:00
package.go feat: Global 2FA enforcement (#8753) 2025-08-15 10:56:45 +02:00
pagination.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
permission.go 2026-05-12 security patches (#12493) 2026-05-12 04:54:25 +02:00
private.go Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367) 2025-03-28 22:22:21 +00:00
quota.go Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367) 2025-03-28 22:22:21 +00:00
repo.go 2026-05-12 security patches (#12493) 2026-05-12 04:54:25 +02:00
repository.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
response.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
user.go fix: do visibility check for user redirect lookup 2025-08-30 09:37:25 +02:00
utils.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00