Show private user if this user follows the current user

[6543]

e.g. the explore page did hide private users witch should be visible to the current user

---

Sponsored by Kithara Software GmbH

[yp05327]

I can't image the use case of this change, and I don't think this is a bug. Can your provide more details about this change?
And if current user can see the private user, then can he/she see or access the private user's repos or other things?

[6543]

that's quit intentional, it's a feature to allow-list users if you make yourselfe private.
If that's to less granular, we need a new lookup table just for that. (witch would be an enhancement pull)

this is a bug as it works for single user permission checks but not for user search querys.

see:

gitea/models/user/user.go

Line 1230 in 5380fd5

func IsUserVisibleToViewer(ctx context.Context, u, viewer *User) bool {

gitea/models/user/user.go

Lines 1248 to 1252 in 5380fd5

	// If they follow - they see each over
	follower := IsFollowing(ctx, u.ID, viewer.ID)
	if follower {
	return true
	}

ps: if we split this feature out we would also add block condition to the follow feature as you should only follow users who can also see you

[yp05327]

Not completely understand yet, but I found another bug 🤔
Doer is following TestUser but the following count is 0

Will be fixed in #28037

[yp05327]

I understood what you said.

But I doubt the origin logic you mentioned in IsUserVisibleToViewer which comes from #16069.
This causes many problems now:

• current user can get the repo list of the private user, but current user have no access permission to these repos
• user's package page will return 404
• we do not have private project now, so user's individual projects and the issues in these projects will be displayed
  For example:
  
• started repositories also have bugs
  

I just want to follow user A, but because of the following, user A can see my private repos, projects, and issues which seems strange.
IMO, the correct logic is that at least they are following each other, they can get these private information.
And also we need to check the permission check logic in other places mentioned above.

[6543]

a user cant follow a private user ...
... the only solution is as proposed to make an extra lookup table

[lunny]

I think we need some discussion and decision about whether one should be viewed by the user he followed.