---------------------------------------------------------------
[PT-BR]
Este commit implementa a transição do rebranding de Forgejo/Gitea para DATAWARE Forge, realizando as seguintes alterações:
- Atualização dos arquivos de configuração de ambiente e containers:
- `.devcontainer/devcontainer.json` e `.gitpod.yml` agora exibem "DATAWARE Forge" em vez de "Gitea" ou "Forgejo".
- Ajustes no Makefile:
- Alteração do branding do Swagger para "DATAWARE Forge API" e modificação da mensagem de licença.
- Modificações em comandos e scripts:
- Em `cmd/generate.go`, a descrição foi atualizada para refletir "DATAWARE Forge's secrets/keys/tokens".
- Em `contrib/environment-to-ini/environment-to-ini.go`, foram adicionadas novas variantes de prefixos de variáveis de ambiente para suportar diversas formas (DATAWARE, DW, etc.).
- Inclusão de novos arquivos de serviço e init scripts:
- Novos scripts de init para Debian e Ubuntu foram adicionados, com descrições e comandos atualizados para DATAWARE Forge.
- Alterações em diversas partes do código (modelos, rotas, serviços, testes e webhooks):
- Todas as referências, mensagens, headers (ex.: X-DatawareForge-OTP, X-DatawareForge-Object-Type), endpoints, logs e textos foram atualizadas para substituir “Gitea” ou “Forgejo” por “DATAWARE Forge”.
- Ajustes em mensagens de erro e instruções de configuração (app.ini, README, etc.) para refletir a nova identidade.
- Atualizações em arquivos de configuração e templates (ex.: `custom/conf/app.example.ini`) para alinhar com a nova marca DATAWARE Forge.
Essas alterações consolidam a personalização white-label, garantindo a integridade do código original enquanto preparam o sistema para uso interno e futura distribuição a clientes.
---------------------------------------------------------------
[EN]
This commit implements a rebranding from Forgejo/Gitea to DATAWARE Forge, making the following changes:
- Updated environment and container configuration files:
- `.devcontainer/devcontainer.json` and `.gitpod.yml` now display "DATAWARE Forge" instead of "Gitea" or "Forgejo".
- Makefile adjustments:
- Changed the Swagger branding to "DATAWARE Forge API" and updated the license message.
- Modifications in commands and scripts:
- In `cmd/generate.go`, the usage description now reflects "DATAWARE Forge's secrets/keys/tokens".
- In `contrib/environment-to-ini/environment-to-ini.go`, new environment variable prefix variants have been added (DATAWARE, DW, etc.).
- Inclusion of new service and init scripts:
- New init scripts for Debian and Ubuntu have been added, with updated descriptions and commands for DATAWARE Forge.
- Changes across various parts of the code (models, routers, services, tests, and webhooks):
- All references, messages, headers (e.g., X-DatawareForge-OTP, X-DatawareForge-Object-Type), endpoints, logs, and texts have been updated to replace “Gitea”/“Forgejo” with “DATAWARE Forge”.
- Adjustments in error messages and configuration instructions (app.ini, README, etc.) to align with the new identity.
- Updates in configuration files and templates (e.g., `custom/conf/app.example.ini`) to match the new DATAWARE Forge branding.
These changes consolidate the white-label customization, ensuring the original code’s integrity while preparing the system for internal use and future client distribution.
Marcos A. Lucas <mlucas@dataware.com.br>
Closes#27455
> The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.
>
> To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.
The PR removes the now obsolete setting `COOKIE_USERNAME`.
