Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ui.explore settings to control view of explore pages #13687

Closed

Conversation

zeripath
Copy link
Contributor

@zeripath zeripath commented Nov 24, 2020

Add [ui.explore] settings to allow restricting the
explore pages to logged in users only and to restrict
the showing of users to only those with publically available
repositories.

The two proposed settings are:

  • REQUIRE_SIGNIN_VIEW: Only allows access to the explore pages if the
    user is signed in. Also restricts
    • /api/v1/user/search
    • /api/v1/users/{username}
    • /api/v1/users/{username}/repos
    • but does not restrict /api/v1/users/{username}/heatmap
  • ONLY_SHOW_USERS_WITH_PUBLIC_REPOS: Only shows users with public
    repos on the explore page. /api/v1/user/search will only show users
    with public repos unless the user the is signed in.

Fix #2908

Close #14094

Signed-off-by: Andrew Thornton [email protected]

Add `[ui.explore]` settings to allow restricting the
explore pages to logged in users only and to restrict
the showing of users to only those with publically available
repositories.

The two proposed settings are:

- `REQUIRE_SIGNIN_VIEW`: Only allows access to the explore pages if the
user is signed in. Also restricts `/api/v1/user/search`.
- `ONLY_SHOW_USERS_WITH_PUBLIC_REPOS`: Only shows users with public
repos on the explore page. `/api/v1/user/search` will only show users
with public repos unless the user the is signed in.

Fix go-gitea#2908

Signed-off-by: Andrew Thornton <[email protected]>
@zeripath zeripath added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Nov 24, 2020
@zeripath zeripath added this to the 1.14.0 milestone Nov 24, 2020
@zeripath
Copy link
Contributor Author

This is likely to need further thought and we should think about the api calls for repositories too.

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Nov 24, 2020
a1012112796 and others added 6 commits November 24, 2020 21:42
Signed-off-by: a1012112796 <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
@lafriks
Copy link
Member

lafriks commented Nov 25, 2020

Imho we don't need special app.ini settings for this. My proposal would be:

  • Remove users explore page completely
  • Limit API call to users list to require authorization

Signed-off-by: Andrew Thornton <[email protected]>
Signed-off-by: Andrew Thornton <[email protected]>
@codecov-io
Copy link

Codecov Report

Merging #13687 (adc8b60) into master (24330f7) will decrease coverage by 0.03%.
The diff coverage is 40.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #13687      +/-   ##
==========================================
- Coverage   42.27%   42.24%   -0.04%     
==========================================
  Files         697      698       +1     
  Lines       76616    76695      +79     
==========================================
+ Hits        32389    32396       +7     
- Misses      38908    38971      +63     
- Partials     5319     5328       +9     
Impacted Files Coverage Δ
models/migrations/migrations.go 2.44% <ø> (ø)
models/migrations/v160.go 0.00% <0.00%> (ø)
models/user.go 54.23% <0.00%> (-0.12%) ⬇️
modules/setting/setting.go 46.12% <ø> (ø)
models/repo.go 56.18% <57.89%> (+0.02%) ⬆️
routers/api/v1/api.go 79.33% <60.00%> (-0.18%) ⬇️
models/consistency.go 56.75% <100.00%> (+1.44%) ⬆️
routers/api/v1/user/user.go 51.02% <100.00%> (+1.02%) ⬆️
routers/home.go 47.70% <100.00%> (+0.20%) ⬆️
routers/routes/macaron.go 92.54% <100.00%> (+<0.01%) ⬆️
... and 12 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 24330f7...adc8b60. Read the comment docs.

@zeripath
Copy link
Contributor Author

I think there's still likely to be a point for findability for public repositories and users with public repos.

@zeripath
Copy link
Contributor Author

I would guess however that we should default to only showing users with public repositories

@lafriks
Copy link
Member

lafriks commented Nov 28, 2020

There is not much point in listing users with public repositories, it will be resource intensive imho and usually everyone are still using repository listing

@lunny
Copy link
Member

lunny commented Feb 18, 2021

Please resolve the conflicts

@zeripath
Copy link
Contributor Author

Conflicts fixed

@zeripath
Copy link
Contributor Author

zeripath commented Mar 3, 2021

conflicts fixed again

@noerw noerw mentioned this pull request Mar 10, 2021
7 tasks
zeripath added a commit that referenced this pull request Mar 11, 2021
This is an alternative PR to #13687.

Add `[ui.explore]` settings to allow restricting the
explore pages to logged in users only and to disable the users explore page.

The two proposed settings are:

- `REQUIRE_SIGNIN_VIEW`: Only allows access to the explore pages if the
user is signed in. Also restricts
  - `/api/v1/user/search`
  - `/api/v1/users/{username}`
  - `/api/v1/users/{username}/repos`
  - but does not restrict `/api/v1/users/{username}/heatmap`
- `DISABLE_USERS_PAGE`: Disables the /explore/users page

Fix #2908

Close #13687 

Signed-off-by: Andrew Thornton <[email protected]>
Co-authored-by: 6543 <[email protected]>
@go-gitea go-gitea locked and limited conversation to collaborators May 13, 2021
@zeripath zeripath deleted the fix-2908-explore-page-settings branch December 29, 2022 19:17
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. type/feature Completely new functionality. Can only be merged if feature freeze is not active.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Hide users from public view
7 participants