Hide users from public view

[demonpig]

• Gitea version (or commit ref): 1.2.3
• Git version: 2.15
• Operating system: CentOS
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

I think there should exist a config option to prevent the viewing of user accounts from public view. I have user accounts on my Gitea instance that I would not like others to see. This might be doable with templates but I am not sure at the moment.

[bkcsoft]

Define "viewing". Are you referring to listings like /explore/users? What about them commenting on public issues, do you want the comment hidden? Commiting to a public repo, should the commit not be shown?

(none of the two latter cases are doable in a sensible way by the way :) )

[lafriks]

I think this is meant for hiding from explore/users

[demonpig]

@bkcsoft Yes i am referring to /explore/users. To you the truth, I forgot all about this issue. I was able to resolve it by using a template.

To fully answer your question, I have the root user and other "read-only" users that I do not want shown on the /explore/users page. If they have no commits, then they are essentially hidden from public view. I want to prevent someone from logging in with the root or "read-only" users.

Note:

• By "read-only" I mean that I have accounts that have read-only access to repositories in my main Gitea account.

[techknowlogick]

@demonpig would you be able to post a gist of the custom template you are using?

[demonpig]

@techknowlogick Here you go.
The file is in: ${GITEA_HOME}/custom/templates/explore

{{template "base/head" .}}
<div class="explore users">
        {{template "explore/navbar" .}}
        <div class="ui container">
                Users not viewable.
        </div>
</div>
{{template "base/footer" .}}

[techknowlogick]

@demonpig thanks

[ruifung]

It would be nice to have, in addition to an option that hides all users from public view, to have an option to hide specific users from public view. Like the backup local accounts when you have ldap auth enabled =/.

[rmattes]

+1
I just encountered the same problem - the admin-only non-LDAP account is shown prominently on the landing page. This asks for "creative" login attempts ....

[OmarAssadi]

Yeah, this would be nice to have. For now, I've just had to 403 anyone who visits /explore/users via NGINX.

FWIW, looks like both the gitea and gogs community wants this.

gogs/gogs#5080
gogs/gogs#3248

[shuhaowu]

Denying access to /explore/users only doesn't solve the issue. Users still can be found via the API:

curl -X GET "http://gitea/api/v1/users/search" -H  "accept: application/json"

[OmarAssadi]

@shuhaowu Nice catch! Totally forgot to block access to that endpoint as well.

I'd love to see this so the admin user isn't so prominent.