Add ui.explore settings to control view of explore pages (2) (#14094)

This is an alternative PR to #13687.

Add `[ui.explore]` settings to allow restricting the
explore pages to logged in users only and to disable the users explore page.

The two proposed settings are:

- `REQUIRE_SIGNIN_VIEW`: Only allows access to the explore pages if the
user is signed in. Also restricts
  - `/api/v1/user/search`
  - `/api/v1/users/{username}`
  - `/api/v1/users/{username}/repos`
  - but does not restrict `/api/v1/users/{username}/heatmap`
- `DISABLE_USERS_PAGE`: Disables the /explore/users page

Fix #2908

Close #13687

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: 6543 <6543@obermui.de>

diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
index 61831d083b91ce58ce1a0fad342baf6154634367..c19f9fc7179db5ddf5a4763ee41350e0dc7bfd43 100644 (file)
--- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
@@ -479,6 +479,12 @@ relation to port exhaustion.
   The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS.
 - `USER_DELETE_WITH_COMMENTS_MAX_TIME`: **0** Minimum amount of time a user must exist before comments are kept when the user is deleted.
 
+### Service - Expore (`service.explore`)
+
+- `REQUIRE_SIGNIN_VIEW`: **false**: Only allow signed in users to view the explore pages.
+- `DISABLE_USERS_PAGE`: **false**: Disable the users explore page.
+
+
 ## SSH Minimum Key Sizes (`ssh.minimum_key_sizes`)
 
 Define allowed algorithms and their minimum key length (use -1 to disable a type):

diff --git a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
index 5bae3cb03a3569e5945ab73cb55ac439669b8e9d..cc12005d571c0f87d6b8ce205e745380f5220197 100644 (file)
--- a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
@@ -135,6 +135,11 @@ menu:
 - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: 允许通过反向认证做自动注册。
 - `ENABLE_CAPTCHA`: 注册时使用图片验证码。
 
+### Service - Expore (`service.explore`)
+
+- `REQUIRE_SIGNIN_VIEW`: **false**: 仅允许已登录的用户查看探索页面。
+- `DISABLE_USERS_PAGE`: **false**: 不显示用户探索页面。
+
 ## Webhook (`webhook`)
 
 - `QUEUE_LENGTH`: 说明: Hook 任务队列长度。

diff --git a/modules/setting/service.go b/modules/setting/service.go
index fc4326fde55437d85a0f24ee3a400dfd0890c5d6..9696e98641837e54d9f7520559e4104bf017b787 100644 (file)
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -8,6 +8,7 @@ import (
        "regexp"
        "time"
 
+       "code.gitea.io/gitea/modules/log"
        "code.gitea.io/gitea/modules/structs"
 )
 
@@ -59,6 +60,12 @@ var Service struct {
        EnableOpenIDSignUp bool
        OpenIDWhitelist    []*regexp.Regexp
        OpenIDBlacklist    []*regexp.Regexp
+
+       // Explore page settings
+       Explore struct {
+               RequireSigninView bool `ini:"REQUIRE_SIGNIN_VIEW"`
+               DisableUsersPage  bool `ini:"DISABLE_USERS_PAGE"`
+       } `ini:"service.explore"`
 }
 
 func newService() {
@@ -108,6 +115,10 @@ func newService() {
        Service.DefaultOrgMemberVisible = sec.Key("DEFAULT_ORG_MEMBER_VISIBLE").MustBool()
        Service.UserDeleteWithCommentsMaxTime = sec.Key("USER_DELETE_WITH_COMMENTS_MAX_TIME").MustDuration(0)
 
+       if err := Cfg.Section("service.explore").MapTo(&Service.Explore); err != nil {
+               log.Fatal("Failed to map service.explore settings: %v", err)
+       }
+
        sec = Cfg.Section("openid")
        Service.EnableOpenIDSignIn = sec.Key("ENABLE_OPENID_SIGNIN").MustBool(!InstallLock)
        Service.EnableOpenIDSignUp = sec.Key("ENABLE_OPENID_SIGNUP").MustBool(!Service.DisableRegistration && Service.EnableOpenIDSignIn)

diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index a8499e0ee8f6a9a7a875992ac8a5c570e41620cf..57bcdf49f657a2e40d823e3299b7e906cc1ceb95 100644 (file)
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -204,6 +204,14 @@ func reqToken() func(ctx *context.APIContext) {
        }
 }
 
+func reqExploreSignIn() func(ctx *context.APIContext) {
+       return func(ctx *context.APIContext) {
+               if setting.Service.Explore.RequireSigninView && !ctx.IsSigned {
+                       ctx.Error(http.StatusUnauthorized, "reqExploreSignIn", "you must be signed in to search for users")
+               }
+       }
+}
+
 func reqBasicAuth() func(ctx *context.APIContext) {
        return func(ctx *context.APIContext) {
                if !ctx.Context.IsBasicAuth {
@@ -603,16 +611,16 @@ func Routes() *web.Route {
 
                // Users
                m.Group("/users", func() {
-                       m.Get("/search", user.Search)
+                       m.Get("/search", reqExploreSignIn(), user.Search)
 
                        m.Group("/{username}", func() {
-                               m.Get("", user.GetInfo)
+                               m.Get("", reqExploreSignIn(), user.GetInfo)
 
                                if setting.Service.EnableUserHeatmap {
                                        m.Get("/heatmap", user.GetUserHeatmapData)
                                }
 
-                               m.Get("/repos", user.ListUserRepos)
+                               m.Get("/repos", reqExploreSignIn(), user.ListUserRepos)
                                m.Group("/tokens", func() {
                                        m.Combo("").Get(user.ListAccessTokens).
                                                Post(bind(api.CreateAccessTokenOption{}), user.CreateAccessToken)

diff --git a/routers/home.go b/routers/home.go
index 6505a4180df03e23852dd0fba9d4b30d23071d56..9f54c7aa641511ba735e36760bd3a911ed330c52 100644 (file)
--- a/routers/home.go
+++ b/routers/home.go
@@ -171,6 +171,7 @@ func RenderRepoSearch(ctx *context.Context, opts *RepoSearchOptions) {
 
 // ExploreRepos render explore repositories page
 func ExploreRepos(ctx *context.Context) {
+       ctx.Data["UsersIsDisabled"] = setting.Service.Explore.DisableUsersPage
        ctx.Data["Title"] = ctx.Tr("explore")
        ctx.Data["PageIsExplore"] = true
        ctx.Data["PageIsExploreRepositories"] = true
@@ -247,6 +248,10 @@ func RenderUserSearch(ctx *context.Context, opts *models.SearchUserOptions, tplN
 
 // ExploreUsers render explore users page
 func ExploreUsers(ctx *context.Context) {
+       if setting.Service.Explore.DisableUsersPage {
+               ctx.Redirect(setting.AppSubURL + "/explore/repos")
+               return
+       }
        ctx.Data["Title"] = ctx.Tr("explore")
        ctx.Data["PageIsExplore"] = true
        ctx.Data["PageIsExploreUsers"] = true
@@ -263,6 +268,7 @@ func ExploreUsers(ctx *context.Context) {
 
 // ExploreOrganizations render explore organizations page
 func ExploreOrganizations(ctx *context.Context) {
+       ctx.Data["UsersIsDisabled"] = setting.Service.Explore.DisableUsersPage
        ctx.Data["Title"] = ctx.Tr("explore")
        ctx.Data["PageIsExplore"] = true
        ctx.Data["PageIsExploreOrganizations"] = true
@@ -288,6 +294,7 @@ func ExploreCode(ctx *context.Context) {
                return
        }
 
+       ctx.Data["UsersIsDisabled"] = setting.Service.Explore.DisableUsersPage
        ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
        ctx.Data["Title"] = ctx.Tr("explore")
        ctx.Data["PageIsExplore"] = true

diff --git a/routers/routes/web.go b/routers/routes/web.go
index 22774b2cdccca288d80d7ef0582e041875d4c4e2..08faa274a5b5af7686832350c6cdcc9af3d4d8ed 100644 (file)
--- a/routers/routes/web.go
+++ b/routers/routes/web.go
@@ -286,6 +286,7 @@ func goGet(ctx *context.Context) {
 func RegisterRoutes(m *web.Route) {
        reqSignIn := context.Toggle(&context.ToggleOptions{SignInRequired: true})
        ignSignIn := context.Toggle(&context.ToggleOptions{SignInRequired: setting.Service.RequireSignInView})
+       ignExploreSignIn := context.Toggle(&context.ToggleOptions{SignInRequired: setting.Service.RequireSignInView || setting.Service.Explore.RequireSigninView})
        ignSignInAndCsrf := context.Toggle(&context.ToggleOptions{DisableCSRF: true})
        reqSignOut := context.Toggle(&context.ToggleOptions{SignOutRequired: true})
 
@@ -335,7 +336,7 @@ func RegisterRoutes(m *web.Route) {
                m.Get("/users", routers.ExploreUsers)
                m.Get("/organizations", routers.ExploreOrganizations)
                m.Get("/code", routers.ExploreCode)
-       }, ignSignIn)
+       }, ignExploreSignIn)
        m.Get("/issues", reqSignIn, user.Issues)
        m.Get("/pulls", reqSignIn, user.Pulls)
        m.Get("/milestones", reqSignIn, reqMilestonesDashboardPageEnabled, user.Milestones)

diff --git a/templates/explore/navbar.tmpl b/templates/explore/navbar.tmpl
index 93810dcf4a16d345fd72f57096ede2bb20f3400a..5b1e6b5d0605fb634513f871f0d0cbd53d49a47f 100644 (file)
--- a/templates/explore/navbar.tmpl
+++ b/templates/explore/navbar.tmpl
@@ -2,9 +2,11 @@
        <a class="{{if .PageIsExploreRepositories}}active{{end}} item" href="{{AppSubUrl}}/explore/repos">
                {{svg "octicon-repo"}} {{.i18n.Tr "explore.repos"}}
        </a>
-       <a class="{{if .PageIsExploreUsers}}active{{end}} item" href="{{AppSubUrl}}/explore/users">
-               {{svg "octicon-person"}} {{.i18n.Tr "explore.users"}}
-       </a>
+       {{if not .UsersIsDisabled}}
+               <a class="{{if .PageIsExploreUsers}}active{{end}} item" href="{{AppSubUrl}}/explore/users">
+                       {{svg "octicon-person"}} {{.i18n.Tr "explore.users"}}
+               </a>
+       {{end}}
        <a class="{{if .PageIsExploreOrganizations}}active{{end}} item" href="{{AppSubUrl}}/explore/organizations">
                {{svg "octicon-organization"}} {{.i18n.Tr "explore.organizations"}}
        </a>