Func 'runCreateUser' of cli command needs to check the value of DEFAULT_USER_VISIBILITY #10129

New Issue

GiteaMirror · 2025-11-02T08:58:58-06:00

GiteaMirror commented

2025-11-02 08:58:58 -06:00

Originally created by @yp05327 on GitHub (Jan 19, 2023).

Description

I have post a issue at this project: gitea/helm-chart
Admin account's user visibility is public even ALLOWED_USER_VISIBILITY_MODES equals private
But i found that this maybe an issue of gitea cli.

Problem:
In the official helm chart, cli command is used to create the first admin user.

gitea admin user create --admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }} --must-change-password=false

This command will call func runCreateUser which is defined in gitea/cmd/admin.go.
In this function, a new user will be create without checking the env variable DEFAULT_USER_VISIBILITY.
so this new user's visibility will always be public.

If you set the env as the following:

DEFAULT_USER_VISIBILITY = private
ALLOWED_USER_VISIBILITY_MODES = private

When you login with the first created admin user, You will get 500 server error page. Because this user's visibility is public
but ALLOWED_USER_VISIBILITY_MODES is private.

Gitea Version

1.18.1

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Using Official Helm Chart
Helm Chart Version: 7.0.0
Gitea version: 1.18.1

env setting:

gitea:
  config:
    service:
      DISABLE_REGISTRATION: true
      DEFAULT_USER_VISIBILITY: private
      ALLOWED_USER_VISIBILITY_MODES: private
      DEFAULT_ORG_VISIBILITY: private
    service.explore:
      REQUIRE_SIGNIN_VIEW: true
      DISABLE_USERS_PAGE: true

Database

MySQL

Originally created by @yp05327 on GitHub (Jan 19, 2023). ### Description I have post a issue at this project: [gitea/helm-chart](https://gitea.com/gitea/helm-chart) [Admin account's user visibility is public even ALLOWED_USER_VISIBILITY_MODES equals private](https://gitea.com/gitea/helm-chart/issues/382) But i found that this maybe an issue of gitea cli. Problem: In the official helm chart, cli command is used to create the first admin user. ``` yaml gitea admin user create --admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }} --must-change-password=false ``` This command will call func `runCreateUser` which is defined in `gitea/cmd/admin.go`. In this function, a new user will be create without checking the env variable `DEFAULT_USER_VISIBILITY`. so this new user's visibility will always be `public`. If you set the env as the following: ``` text DEFAULT_USER_VISIBILITY = private ALLOWED_USER_VISIBILITY_MODES = private ``` When you login with the first created admin user, You will get 500 server error page. Because this user's visibility is `public` but ALLOWED_USER_VISIBILITY_MODES is private. ### Gitea Version 1.18.1 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Using [Official Helm Chart](https://gitea.com/gitea/helm-chart) Helm Chart Version: 7.0.0 Gitea version: 1.18.1 env setting: ``` yaml gitea: config: service: DISABLE_REGISTRATION: true DEFAULT_USER_VISIBILITY: private ALLOWED_USER_VISIBILITY_MODES: private DEFAULT_ORG_VISIBILITY: private service.explore: REQUIRE_SIGNIN_VIEW: true DISABLE_USERS_PAGE: true ``` ### Database MySQL

GiteaMirror added the type/bug label 2025-11-02 08:58:58 -06:00

GiteaMirror closed this issue

2025-11-02 08:58:58 -06:00

GiteaMirror commented

2025-11-02 08:58:59 -06:00

@justusbunsi commented on GitHub (Jan 19, 2023):

I've analysed this particular Helm Chart issue and what I noticed is that the user create cli command runs without taking the actual app.ini into account with regards to a (possible) default value other than public.

So from my perspective there would be a bugfix for that and maybe a feature for allowing to set the visibility via cli.

@justusbunsi commented on GitHub (Jan 19, 2023): I've analysed this particular Helm Chart issue and what I noticed is that the user create cli command runs without taking the actual app.ini into account with regards to a (possible) default value other than `public`. So from my perspective there would be a bugfix for that and maybe a feature for allowing to set the visibility via cli.

GiteaMirror commented

2025-11-02 08:58:59 -06:00

@pat-s commented on GitHub (Jan 19, 2023):

Should the issue better be moved to https://gitea.com/gitea/tea?

@pat-s commented on GitHub (Jan 19, 2023): Should the issue better be moved to https://gitea.com/gitea/tea?

GiteaMirror commented

2025-11-02 08:58:59 -06:00

@jolheiser commented on GitHub (Jan 19, 2023):

Should the issue better be moved to https://gitea.com/gitea/tea?

No, it looks like this is particularly a command in the Gitea binary itself.
Whether that command should be moved to tea is another matter, but this code is in the main repository currently.

I think at the very least a flag for setting visibility can be added. 👍

@jolheiser commented on GitHub (Jan 19, 2023): > Should the issue better be moved to https://gitea.com/gitea/tea? No, it looks like this is particularly a command in the Gitea binary itself. Whether that command should be moved to `tea` is another matter, but this code is in the main repository currently. --- I think at the very least a flag for setting visibility can be added. 👍

GiteaMirror commented

2025-11-02 08:59:00 -06:00

@justusbunsi commented on GitHub (Jan 19, 2023):

Yep. It's the built-in gitea admin user create command. A flag would actually fix the issue for the Helm chart. Nonetheless there seem to be an issue regarding app.ini consideration during execution.

@justusbunsi commented on GitHub (Jan 19, 2023): Yep. It's the built-in `gitea admin user create` command. A flag would actually fix the issue for the Helm chart. Nonetheless there seem to be an issue regarding app.ini consideration during execution.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#10129