Registration fails when SHOW_REGISTRATION_BUTTON = false

[lpoujol]

• Gitea version (or commit ref): 1.5.2
• Git version: 2.11.0
• Operating system: Debian Stretch
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: https://gist.github.com/lpoujol/728e3b299c53ed7bef579a3ab0e5cdd6 (when retried with loglevel as debug)

Description

Hi,
I've been trying gitea with some coworkers. For our tests, I've decided to go with registration enabled but with the registration button hidden. So our config looked like :

[service]
DISABLE_REGISTRATION = false
SHOW_REGISTRATION_BUTTON = false
REGISTER_EMAIL_CONFIRM = true
ENABLE_CAPTCHA = true

As expected, the registration button is hidden, but the registration page is visible. Then after filling the form. Validating it leads to a 403 page with empty content. No user is created.

Expected behavior : Registration works, and a new account is created.

Also, when SHOW_REGISTRATION_BUTTON is set to true, registration do work as expected.

Screenshots

[lunny]

It seems no error on log files.

[r-52]

You can reproduce this behavior with the mentioned settings. You can reach the regular SignUp page because there's nothing that checks the settings entry SHOW_REGISTRATION_BUTTON.

gitea/routers/user/auth.go

Line 899 in c8a9384

func SignUp(ctx *context.Context) {

If you hit the send button/trigger the form-post, the action checks if SHOW_REGISTRATION_BUTTON is true or returns the 403.

gitea/routers/user/auth.go

Lines 926 to 929 in c8a9384

	if !setting.Service.ShowRegistrationButton {
	ctx.Error(403)
	return
	}

I believe there are two ways to change this:

• already check SHOW_REGISTRATION_BUTTON in the get action to return a 403 or redirect to login.
• keep the current behavior, but remove the check in the post action to keep a semi-hidden signup page, that is not reachable from the navbar

what do you think? Is it worth a pr?

[lunny]

@romankl PR is welcome.