Skip to content

Access to package repository is public with REQUIRE_SIGNIN_VIEW #20863

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Jaffex opened this issue Aug 19, 2022 · 2 comments · Fixed by #20873
Closed

Access to package repository is public with REQUIRE_SIGNIN_VIEW #20863

Jaffex opened this issue Aug 19, 2022 · 2 comments · Fixed by #20873
Labels
topic/packages type/bug
Milestone
1.17.3

Comments

@Jaffex
Copy link

Jaffex commented Aug 19, 2022

Description

Hello there,

we have a gitea instance hosted to which we enabled the following in the app.ini:

[service]
REQUIRE_SIGNIN_VIEW = true

This setting is supposed to make access to the instance non public, i. e. even with public repositories, you can only see them after you signed in.

The new package repository feature introduced in 1.7.0 does not honor this setting - all packages hosted on a public repository on a view protected instance can be downloaded without signing in.

(I can't reproduce on demo site as I have no possibility to make changes to its configuration)

Gitea Version

1.7.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

2.7.4

Operating System

Ubuntu 20.04

How are you running Gitea?

Used the precompiled version from the releases page.

Database

MySQL
@lunny lunny added this to the 1.17.2 milestone Aug 19, 2022
@eeyrjmr
Copy link
Contributor

eeyrjmr commented Aug 19, 2022

Related to: #20100

Which was closed

@KN4CK3R KN4CK3R mentioned this issue Aug 20, 2022
Merged
@lunny lunny modified the milestones: 1.17.2, 1.17.3 Sep 5, 2022
wxiaoguang added a commit that referenced this issue Sep 21, 2022
@KN4CK3R @lafriks @wxiaoguang
Respect REQUIRE_SIGNIN_VIEW for packages (#20873)
0a9a86b 
Fix #20863

When REQUIRE_SIGNIN_VIEW = true, even with public repositories, you can only see them after you login. The packages should not be accessed without login.

Co-authored-by: Lauris BH <[email protected]>
Co-authored-by: wxiaoguang <[email protected]>
@wxiaoguang
Copy link
Contributor

Wait for backport

@wxiaoguang wxiaoguang reopened this Sep 21, 2022
KN4CK3R added a commit to KN4CK3R/gitea that referenced this issue Sep 21, 2022
@KN4CK3R @lafriks @wxiaoguang
Respect REQUIRE_SIGNIN_VIEW for packages (go-gitea#20873)
ca25b04 
Fix go-gitea#20863

When REQUIRE_SIGNIN_VIEW = true, even with public repositories, you can only see them after you login. The packages should not be accessed without login.

Co-authored-by: Lauris BH <[email protected]>
Co-authored-by: wxiaoguang <[email protected]>
@KN4CK3R KN4CK3R closed this as completed Oct 7, 2022
@go-gitea go-gitea locked and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
topic/packages type/bug
Projects
None yet
Milestone
1.17.3
Development

Successfully merging a pull request may close this issue.

Respect REQUIRE_SIGNIN_VIEW for packages KN4CK3R/gitea
6 participants
@lunny @techknowlogick @KN4CK3R @wxiaoguang @eeyrjmr @Jaffex