Container packages ignore `REQUIRE_SIGNIN_VIEW`

[Shuenhoy]

Description

Our site has enabled REQUIRE_SIGNIN_VIEW, however, we can still docker pull a public image.
This problem had been reported in #20863 and #20873 seemed to have fixed this for other types of package, but not for container.

Gitea Version

1.21.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker

Database

PostgreSQL

[KN4CK3R]

It does not ignore that flag:

gitea/modules/context/package.go

Lines 95 to 98 in 1df06e3

	func determineAccessMode(ctx *Base, pkg *Package, doer *user_model.User) (perm.AccessMode, error) {
	if setting.Service.RequireSignInView && doer == nil {
	return perm.AccessModeNone, nil
	}

Did you perform a docker logout?

[Shuenhoy]

Hi @KN4CK3R, please check this snapshot:

Or am I missing something and the login information can be stored somewhere else?

[KN4CK3R]

No, my bad... The container registry uses the internal ghost user for anonymous requests and the ghost user is not nil. Therefore the test does not return no access rights... I will send a fix soon.

[KN4CK3R]

Fixed in #28877. Thank you for the report.