Allow options to disable user ssh keys configuration from the interface on app.ini...

Follow #29275
Extract from #20549
Fix #24716

---------

Co-authored-by: delvh <dev.lh@web.de>

diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index dc5aa691ee3c59e18f9f2092b36ac73bba81f77a..17d6cd3a35e027612a19c64ef02c30074c7929f5 100644 (file)
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -1480,8 +1480,9 @@ LEVEL = Info
 ;;
 ;; Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled
 ;DEFAULT_EMAIL_NOTIFICATIONS = enabled
-;; Disabled features for users, could be "deletion","manage_gpg_keys" more features can be disabled in future
+;; Disabled features for users, could be "deletion", "manage_ssh_keys","manage_gpg_keys" more features can be disabled in future
 ;; - deletion: a user cannot delete their own account
+;; - manage_ssh_keys: a user cannot configure ssh keys
 ;; - manage_gpg_keys: a user cannot configure gpg keys
 ;USER_DISABLED_FEATURES =
 

diff --git a/docs/content/administration/config-cheat-sheet.en-us.md b/docs/content/administration/config-cheat-sheet.en-us.md
index ea6e1eb1a4dd44eb09d53a441875bf12189abe27..8a01711949a3070cf3b4ce7bb1b8bec0f98b100c 100644 (file)
--- a/docs/content/administration/config-cheat-sheet.en-us.md
+++ b/docs/content/administration/config-cheat-sheet.en-us.md
@@ -518,9 +518,10 @@ And the following unique queues:
 
 - `DEFAULT_EMAIL_NOTIFICATIONS`: **enabled**: Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled
 - `DISABLE_REGULAR_ORG_CREATION`: **false**: Disallow regular (non-admin) users from creating organizations.
-- `USER_DISABLED_FEATURES`: **_empty_** Disabled features for users, could be `deletion`, `manage_gpg_keys` and more features can be added in future.
+- `USER_DISABLED_FEATURES`: **_empty_** Disabled features for users, could be `deletion`, `manage_ssh_keys`, `manage_gpg_keys` and more features can be added in future.
   - `deletion`: User cannot delete their own account.
-  - `manage_gpg_keys`: User cannot configure gpg keys
+  - `manage_ssh_keys`: User cannot configure ssh keys.
+  - `manage_gpg_keys`: User cannot configure gpg keys.
 
 ## Security (`security`)
 

diff --git a/docs/content/administration/config-cheat-sheet.zh-cn.md b/docs/content/administration/config-cheat-sheet.zh-cn.md
index 5cc5734359065b9ae9be749ff407b15566faa587..7b102eda8e12d7147e5bb1545b14a39b86bbe3b4 100644 (file)
--- a/docs/content/administration/config-cheat-sheet.zh-cn.md
+++ b/docs/content/administration/config-cheat-sheet.zh-cn.md
@@ -497,9 +497,10 @@ Gitea 创建以下非唯一队列：
 
 - `DEFAULT_EMAIL_NOTIFICATIONS`: **enabled**：用户电子邮件通知的默认配置（用户可配置）。选项：enabled、onmention、disabled
 - `DISABLE_REGULAR_ORG_CREATION`: **false**：禁止普通（非管理员）用户创建组织。
-- `USER_DISABLED_FEATURES`:**_empty_** 禁用的用户特性，当前允许为空或者 `deletion`，`manage_gpg_keys` 未来可以增加更多设置。
+- `USER_DISABLED_FEATURES`:**_empty_** 禁用的用户特性，当前允许为空或者 `deletion`，`manage_ssh_keys`， `manage_gpg_keys` 未来可以增加更多设置。
   - `deletion`: 用户不能通过界面或者API删除他自己。
-  - `manage_gpg_keys`: 用户不能配置 GPG 密钥
+  - `manage_ssh_keys`: 用户不能通过界面或者API配置SSH Keys。
+  - `manage_gpg_keys`: 用户不能配置 GPG 密钥。
 
 ## 安全性 (`security`)
 

diff --git a/modules/setting/admin.go b/modules/setting/admin.go
index 29bb947bc4780be134e182c3d757ff816a949210..be214a58ce4085dcd193caea53f235087c155fc3 100644 (file)
--- a/modules/setting/admin.go
+++ b/modules/setting/admin.go
@@ -21,5 +21,6 @@ func loadAdminFrom(rootCfg ConfigProvider) {
 
 const (
        UserFeatureDeletion      = "deletion"
+       UserFeatureManageSSHKeys = "manage_ssh_keys"
        UserFeatureManageGPGKeys = "manage_gpg_keys"
 )

diff --git a/routers/api/v1/user/key.go b/routers/api/v1/user/key.go
index ada6759f8e6c59afcff64eaea828a46ae1b8b7cd..bcbfd93bd3edea6539a85caeaefb00617aa34c34 100644 (file)
--- a/routers/api/v1/user/key.go
+++ b/routers/api/v1/user/key.go
@@ -5,6 +5,7 @@ package user
 
 import (
        std_ctx "context"
+       "fmt"
        "net/http"
 
        asymkey_model "code.gitea.io/gitea/models/asymkey"
@@ -198,6 +199,11 @@ func GetPublicKey(ctx *context.APIContext) {
 
 // CreateUserPublicKey creates new public key to given user by ID.
 func CreateUserPublicKey(ctx *context.APIContext, form api.CreateKeyOption, uid int64) {
+       if setting.Admin.UserDisabledFeatures.Contains(setting.UserFeatureManageSSHKeys) {
+               ctx.NotFound("Not Found", fmt.Errorf("ssh keys setting is not allowed to be visited"))
+               return
+       }
+
        content, err := asymkey_model.CheckPublicKeyString(form.Key)
        if err != nil {
                repo.HandleCheckKeyStringError(ctx, err)
@@ -263,6 +269,11 @@ func DeletePublicKey(ctx *context.APIContext) {
        //   "404":
        //     "$ref": "#/responses/notFound"
 
+       if setting.Admin.UserDisabledFeatures.Contains(setting.UserFeatureManageSSHKeys) {
+               ctx.NotFound("Not Found", fmt.Errorf("ssh keys setting is not allowed to be visited"))
+               return
+       }
+
        id := ctx.ParamsInt64(":id")
        externallyManaged, err := asymkey_model.PublicKeyIsExternallyManaged(ctx, id)
        if err != nil {

diff --git a/routers/web/user/setting/keys.go b/routers/web/user/setting/keys.go
index cb01913bdafb220516dc99f8021a550d93b8cf9b..d2b60fc809e31b284f377c3a47b5003e07dfd167 100644 (file)
--- a/routers/web/user/setting/keys.go
+++ b/routers/web/user/setting/keys.go
@@ -159,6 +159,11 @@ func KeysPost(ctx *context.Context) {
                ctx.Flash.Success(ctx.Tr("settings.verify_gpg_key_success", keyID))
                ctx.Redirect(setting.AppSubURL + "/user/settings/keys")
        case "ssh":
+               if setting.Admin.UserDisabledFeatures.Contains(setting.UserFeatureManageSSHKeys) {
+                       ctx.NotFound("Not Found", fmt.Errorf("ssh keys setting is not allowed to be visited"))
+                       return
+               }
+
                content, err := asymkey_model.CheckPublicKeyString(form.Content)
                if err != nil {
                        if db.IsErrSSHDisabled(err) {
@@ -198,6 +203,11 @@ func KeysPost(ctx *context.Context) {
                ctx.Flash.Success(ctx.Tr("settings.add_key_success", form.Title))
                ctx.Redirect(setting.AppSubURL + "/user/settings/keys")
        case "verify_ssh":
+               if setting.Admin.UserDisabledFeatures.Contains(setting.UserFeatureManageSSHKeys) {
+                       ctx.NotFound("Not Found", fmt.Errorf("ssh keys setting is not allowed to be visited"))
+                       return
+               }
+
                token := asymkey_model.VerificationToken(ctx.Doer, 1)
                lastToken := asymkey_model.VerificationToken(ctx.Doer, 0)
 
@@ -240,6 +250,11 @@ func DeleteKey(ctx *context.Context) {
                        ctx.Flash.Success(ctx.Tr("settings.gpg_key_deletion_success"))
                }
        case "ssh":
+               if setting.Admin.UserDisabledFeatures.Contains(setting.UserFeatureManageSSHKeys) {
+                       ctx.NotFound("Not Found", fmt.Errorf("ssh keys setting is not allowed to be visited"))
+                       return
+               }
+
                keyID := ctx.FormInt64("id")
                external, err := asymkey_model.PublicKeyIsExternallyManaged(ctx, keyID)
                if err != nil {
@@ -318,4 +333,5 @@ func loadKeysData(ctx *context.Context) {
 
        ctx.Data["VerifyingID"] = ctx.FormString("verify_gpg")
        ctx.Data["VerifyingFingerprint"] = ctx.FormString("verify_ssh")
+       ctx.Data["UserDisabledFeatures"] = &setting.Admin.UserDisabledFeatures
 }

diff --git a/templates/user/settings/keys.tmpl b/templates/user/settings/keys.tmpl
index a44bf5004827affab2a1396868fdef6c314d3473..e0f5e426ae45aa22b20b1b7a5a66b68a97042478 100644 (file)
--- a/templates/user/settings/keys.tmpl
+++ b/templates/user/settings/keys.tmpl
@@ -1,6 +1,8 @@
 {{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings sshkeys")}}
        <div class="user-setting-content">
-               {{template "user/settings/keys_ssh" .}}
+               {{if not ($.UserDisabledFeatures.Contains "manage_ssh_keys")}}
+                       {{template "user/settings/keys_ssh" .}}
+               {{end}}
                {{template "user/settings/keys_principal" .}}
                {{if not ($.UserDisabledFeatures.Contains "manage_gpg_keys")}}
                {{template "user/settings/keys_gpg" .}}