Add ui.explore settings to control view of explore pages (2) #14094

zeripath · 2020-12-21T17:44:40Z

This is an alternative PR to #13687.

Add [ui.explore] settings to allow restricting the
explore pages to logged in users only and to disable the users explore page.

The two proposed settings are:

REQUIRE_SIGNIN_VIEW: Only allows access to the explore pages if the
user is signed in. Also restricts
- /api/v1/user/search
- /api/v1/users/{username}
- /api/v1/users/{username}/repos
- but does not restrict /api/v1/users/{username}/heatmap
DISABLE_USERS_PAGE: Disables the /explore/users page

Fix #2908

Close #13687

Signed-off-by: Andrew Thornton [email protected]

Add `[ui.explore]` settings to allow restricting the explore pages to logged in users only and to restrict the showing of users to only those with publically available repositories. The two proposed settings are: - `REQUIRE_SIGNIN_VIEW`: Only allows access to the explore pages if the user is signed in. Also restricts `/api/v1/user/search`. - `ONLY_SHOW_USERS_WITH_PUBLIC_REPOS`: Only shows users with public repos on the explore page. `/api/v1/user/search` will only show users with public repos unless the user the is signed in. Fix go-gitea#2908 Signed-off-by: Andrew Thornton <[email protected]>

Signed-off-by: a1012112796 <[email protected]>

chinese translation

Signed-off-by: Andrew Thornton <[email protected]>

…ge-settings

codecov-io · 2020-12-21T18:16:49Z

Codecov Report

❗ No coverage uploaded for pull request base (master@34df4e5). Click here to learn what that means.
The diff coverage is 50.00%.

@@            Coverage Diff            @@
##             master   #14094   +/-   ##
=========================================
  Coverage          ?   42.33%           
=========================================
  Files             ?      726           
  Lines             ?    77756           
  Branches          ?        0           
=========================================
  Hits              ?    32918           
  Misses            ?    39431           
  Partials          ?     5407

Impacted Files	Coverage Δ
modules/setting/setting.go	`45.47% <ø> (ø)`
routers/home.go	`47.19% <33.33%> (ø)`
routers/api/v1/api.go	`79.33% <60.00%> (ø)`
routers/routes/macaron.go	`92.54% <100.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 34df4e5...d35b5fe. Read the comment docs.

docs/content/doc/advanced/config-cheat-sheet.zh-cn.md

lafriks · 2020-12-21T23:39:29Z

Is there a use case where REQUIRE_SIGNIN_VIEW is needed? Imho that should be always true and we should not return list of users to unauthorized users

techknowlogick · 2020-12-22T02:44:40Z

@lafriks REQUIRE_SIGNIN_VIEW is for more than just users, but all explore pages (such as repos & orgs too).

lafriks · 2020-12-22T07:17:27Z

imho we should remove users page completely, I don't see much use for it to be honest

lunny · 2020-12-22T07:37:31Z

imho we should remove users page completely, I don't see much use for it to be honest

Maybe for a public big site, users want to find some people they want to contact.

lunny · 2021-02-18T16:02:21Z

Please resolve the conflicts

…plore-page-settings

zeripath · 2021-02-19T19:33:55Z

Conflicts fixed.

lunny · 2021-03-04T03:29:46Z

modules/setting/setting.go

@@ -265,6 +270,10 @@ var (
 			Description: "Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go",
 			Keywords:    "go,git,self-hosted,gitea",
 		},
+		Explore: struct {
+			RequireSigninView bool `ini:"REQUIRE_SIGNIN_VIEW"`
+			DisableUsersPage  bool `ini:"DISABLE_USERS_PAGE"`


I think maybe move this to service is better? We need a feature to disable all the user explore include APIs. A standalone setting for UI search seems not enough.

I really think we have way too much stuff in [service] already - so if it's going in there it should go in [service.explore] I think.

+1 on [service.explore]

art-ist · 2021-03-05T16:53:37Z

You are checking for the ui.explore setting when http://gitea/api/v1/users/search is called. But

curl -X GET "http://gitea/api/v1/users/joe" -H  "accept: application/json"

was our next first guess. So checking on

m.Group("/{username}", func() {

is required as well.

Originally posted by @art-ist in #2908 (comment)

zeripath · 2021-03-05T20:23:22Z

@art-ist I wrote this PR 3 months ago in response so I cannot fully remember all of the details but...

I am absolutely certain that you cannot just block /api/v1/users/{name} and in any case it is pointless as you can just go to /{name}

OK I think I'm wrong here and the UI doesn't rely on this path at all. I guess therefore it's fine to be blocked too.

Signed-off-by: Andrew Thornton <[email protected]>

noerw

~~Oher than the config location this LGBTTOPRTM (looks good and better than the other PR to me).~~

~~I think this more general config will serve more users concerned about privacy, a more finegrained control like ONLY_SHOW_USERS_WITH_PUBLIC_REPOS could be added later as needed~~

I thought more about this, see #2908 (comment) . In short:
We should probably allow for more flexibility and don't add a bool flag DISABLE_USERS_PAGE, but USERS_PAGE with 3 states OPT_OUT, OPT_IN, DISABLED, (where the first is the current behaviour, and the second can be implemented later)

noerw · 2021-03-10T01:00:09Z

modules/setting/setting.go

@@ -265,6 +270,10 @@ var (
 			Description: "Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go",
 			Keywords:    "go,git,self-hosted,gitea",
 		},
+		Explore: struct {
+			RequireSigninView bool `ini:"REQUIRE_SIGNIN_VIEW"`
+			DisableUsersPage  bool `ini:"DISABLE_USERS_PAGE"`


+1 on [service.explore]

Signed-off-by: Andrew Thornton <[email protected]>

6543 · 2021-03-11T12:36:18Z

🚀

noerw

Thinking about it again again, the opt-in feature can also be realised via a separate flag, so please ignore my above comment

zeripath and others added 11 commits November 24, 2020 09:39

chinese translation

ed89cc3

Signed-off-by: a1012112796 <[email protected]>

Merge pull request #8 from a1012112796/pr/13687

9936ff4

chinese translation

Fix test

b73f311

Signed-off-by: Andrew Thornton <[email protected]>

fix test (2)

99aa69d

Signed-off-by: Andrew Thornton <[email protected]>

oops ignExploreSignIn should use an or

127ee03

Signed-off-by: Andrew Thornton <[email protected]>

Fix test (3)

a6f0714

Signed-off-by: Andrew Thornton <[email protected]>

attempt to placate mssql

11881c0

Signed-off-by: Andrew Thornton <[email protected]>

Fix for MSSQL

adc8b60

Signed-off-by: Andrew Thornton <[email protected]>

Merge remote-tracking branch 'origin/master' into fix-2908-explore-pa…

be0e163

…ge-settings

drop the public repos code

d35b5fe

zeripath added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Dec 21, 2020

zeripath added this to the 1.14.0 milestone Dec 21, 2020

zeripath mentioned this pull request Dec 21, 2020

Add ui.explore settings to control view of explore pages #13687

Closed

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 21, 2020

lunny reviewed Dec 21, 2020

View reviewed changes

docs/content/doc/advanced/config-cheat-sheet.zh-cn.md Outdated Show resolved Hide resolved

lafriks added type/enhancement An improvement of existing functionality and removed type/feature Completely new functionality. Can only be merged if feature freeze is not active. labels Dec 22, 2020

Merge remote-tracking branch 'origin/master' into fix-2908-no-user-ex…

57e18b5

…plore-page-settings

Update docs/content/doc/advanced/config-cheat-sheet.zh-cn.md

d8596b8

lunny reviewed Mar 4, 2021

View reviewed changes

Merge branch 'master' into fix-2908-no-user-explore-page-settings

080e2cd

zeripath added 2 commits March 5, 2021 21:36

Place the entirety of /api/v1/users/... under reqExploreSignIn

4d8c1d5

Signed-off-by: Andrew Thornton <[email protected]>

Move heatmap out of reqExploreSignIn

dd1c221

Signed-off-by: Andrew Thornton <[email protected]>

noerw approved these changes Mar 10, 2021

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 10, 2021

noerw mentioned this pull request Mar 10, 2021

Hide users from public view #2908

Closed

7 tasks

zeripath added 3 commits March 10, 2021 21:20

Move ui.explore to service.explore

272d19b

Signed-off-by: Andrew Thornton <[email protected]>

Merge branch 'master' into fix-2908-no-user-explore-page-settings

e061509

remove extraneous comment

ad4e0bd

Signed-off-by: Andrew Thornton <[email protected]>

6543 approved these changes Mar 10, 2021

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 10, 2021

6543 added 3 commits March 11, 2021 05:46

Handle MapTo error

a3093c1

Merge branch 'master' into fix-2908-no-user-explore-page-settings

da875e9

Merge branch 'master' into fix-2908-no-user-explore-page-settings

0802ff5

noerw approved these changes Mar 11, 2021

View reviewed changes

zeripath merged commit c8e5c79 into go-gitea:master Mar 11, 2021

zeripath deleted the fix-2908-no-user-explore-page-settings branch March 11, 2021 13:40

6543 mentioned this pull request Mar 11, 2021

Changelog for 1.14.0-RC1 #14935

Merged

1 task

go-gitea locked and limited conversation to collaborators May 13, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ui.explore settings to control view of explore pages (2) #14094

Add ui.explore settings to control view of explore pages (2) #14094

zeripath commented Dec 21, 2020 •

edited

Loading

codecov-io commented Dec 21, 2020

lafriks commented Dec 21, 2020

techknowlogick commented Dec 22, 2020

lafriks commented Dec 22, 2020

lunny commented Dec 22, 2020

lunny commented Feb 18, 2021

zeripath commented Feb 19, 2021

lunny Mar 4, 2021

zeripath Mar 5, 2021

noerw Mar 10, 2021

art-ist commented Mar 5, 2021

zeripath commented Mar 5, 2021 •

edited

Loading

noerw left a comment •

edited

Loading

noerw Mar 10, 2021

6543 commented Mar 11, 2021

noerw left a comment

Add ui.explore settings to control view of explore pages (2) #14094

Add ui.explore settings to control view of explore pages (2) #14094

Conversation

zeripath commented Dec 21, 2020 • edited Loading

codecov-io commented Dec 21, 2020

Codecov Report

lafriks commented Dec 21, 2020

techknowlogick commented Dec 22, 2020

lafriks commented Dec 22, 2020

lunny commented Dec 22, 2020

lunny commented Feb 18, 2021

zeripath commented Feb 19, 2021

lunny Mar 4, 2021

Choose a reason for hiding this comment

zeripath Mar 5, 2021

Choose a reason for hiding this comment

noerw Mar 10, 2021

Choose a reason for hiding this comment

art-ist commented Mar 5, 2021

zeripath commented Mar 5, 2021 • edited Loading

noerw left a comment • edited Loading

Choose a reason for hiding this comment

noerw Mar 10, 2021

Choose a reason for hiding this comment

6543 commented Mar 11, 2021

noerw left a comment

Choose a reason for hiding this comment

zeripath commented Dec 21, 2020 •

edited

Loading

zeripath commented Mar 5, 2021 •

edited

Loading

noerw left a comment •

edited

Loading