Bug: Users authenticated via proxy-auth can change username #1008

New Issue

GiteaMirror · 2025-11-02T03:45:05-06:00

GiteaMirror commented

2025-11-02 03:45:05 -06:00

Originally created by @MTecknology on GitHub (Aug 27, 2017).

In the current version of gitea, it is possible for users authenticated via proxy-auth to edit their username. I'm not able to find a config option to disable this. In cases where proxy authentication is being used, this allows users to change their username and orphan their repositories because a new userid will be immediately created with their correct user.

Originally created by @MTecknology on GitHub (Aug 27, 2017). In the current version of gitea, it is possible for users authenticated via proxy-auth to edit their username. I'm not able to find a config option to disable this. In cases where proxy authentication is being used, this allows users to change their username and orphan their repositories because a new userid will be immediately created with their correct user.

GiteaMirror added the issue/confirmed type/bug labels 2025-11-02 03:45:05 -06:00

GiteaMirror closed this issue

2025-11-02 03:45:05 -06:00

GiteaMirror commented

2025-11-02 03:45:06 -06:00

@bkcsoft commented on GitHub (Aug 27, 2017):

I think in the case of proxy auth (or oauth/openid) we should disallow username changes.

@bkcsoft commented on GitHub (Aug 27, 2017): I think in the case of proxy auth (or oauth/openid) we should disallow username changes.

GiteaMirror commented

2025-11-02 03:45:06 -06:00

@lafriks commented on GitHub (Aug 28, 2017):

Only local users are allowed to change username and I don't think that somehow affects linked openid etc authorization that is handled otherwise and just links to account and are not authorization source

@lafriks commented on GitHub (Aug 28, 2017): Only local users are allowed to change username and I don't think that somehow affects linked openid etc authorization that is handled otherwise and just links to account and are not authorization source

GiteaMirror commented

2025-11-02 03:45:06 -06:00

@stale[bot] commented on GitHub (Feb 13, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Feb 13, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 03:45:07 -06:00

@ptman commented on GitHub (Feb 13, 2019):

Yes, this is a problem

@ptman commented on GitHub (Feb 13, 2019): Yes, this is a problem

GiteaMirror commented

2025-11-02 03:45:07 -06:00

@stale[bot] commented on GitHub (Apr 14, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Apr 14, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror referenced this issue

2025-11-02 11:52:57 -06:00

[PR #1025] [MERGED] Bug fix for dump when data directoryis not exist #15715

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1008