Admin users should not be able to see private repositories on users profile page #11723

New Issue

GiteaMirror · 2025-11-02T09:45:49-06:00

GiteaMirror commented

2025-11-02 09:45:49 -06:00

Originally created by @lautriva on GitHub (Sep 25, 2023).

Description

I understand that admin users have all access

But, when logged as an administrator
Private repos of other users should not be shown on their profile page https://git.example.com/{USERNAME} and only shown at https://git.example.com/admin/repos

Example

User A is an admin. User B is a regular user

User B have many repos: some private, some shared (with A as a collaborator) and some public ones

Expected behavior

User A should only sees B's public or collaborated repositories on B's public page

Actual Behavior

All B's repositories are shown

Gitea Version

1.20.4

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker installation with docker-compose

Database

MySQL/MariaDB

Originally created by @lautriva on GitHub (Sep 25, 2023). ### Description I understand that admin users have all access But, when logged as an administrator Private repos of other users should not be shown on their profile page `https://git.example.com/{USERNAME}` and only shown at `https://git.example.com/admin/repos` ## Example User A is an admin. User B is a regular user User B have many repos: some private, some shared (with A as a collaborator) and some public ones #### Expected behavior User A should only sees B's public or collaborated repositories on B's public page #### Actual Behavior All B's repositories are shown ---- ### Gitea Version 1.20.4 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker installation with docker-compose ### Database MySQL/MariaDB

GiteaMirror added the type/bug label 2025-11-02 09:45:49 -06:00

GiteaMirror commented

2025-11-02 09:45:50 -06:00

@jrjake commented on GitHub (Oct 8, 2023):

Seems to be duplicate of #3442. With most software deployments like Gitea, OpenProject, JIRA, Confluence, typically people with administrator rights will have two accounts - their main, non-admin account and an admin account which is used exclusively for administration purposes.

Using an admin account as daily driver is kind of like logging into servers as 'root'. If computer is infected or they accidentally run command, there is lot of potential for damage.

@jrjake commented on GitHub (Oct 8, 2023): Seems to be duplicate of #3442. With most software deployments like Gitea, OpenProject, JIRA, Confluence, typically people with administrator rights will have two accounts - their main, non-admin account and an admin account which is used exclusively for administration purposes. Using an admin account as daily driver is kind of like logging into servers as 'root'. If computer is infected or they accidentally run command, there is lot of potential for damage.

GiteaMirror commented

2025-11-02 09:45:50 -06:00

@lautriva commented on GitHub (Oct 11, 2023):

I think the code to check that is already there
For example in the main page, the Repositories list (see below) seems to honor the permissions (I don't see people's private repos)
I think its just a bug because the same permissions aren't applied between those 2 pages

@lautriva commented on GitHub (Oct 11, 2023): I think the code to check that is already there For example in the main page, the `Repositories` list (see below) seems to honor the permissions (I don't see people's private repos) I think its just a bug because the same permissions aren't applied between those 2 pages ![image](https://github.com/go-gitea/gitea/assets/10651285/816fc741-323e-42ca-afbe-d74db36a74c1)

GiteaMirror commented

2025-11-02 09:45:50 -06:00

@lunny commented on GitHub (Oct 11, 2023):

Administrators should find the repositories from admin panel features.

@lunny commented on GitHub (Oct 11, 2023): Administrators should find the repositories from admin panel features.

GiteaMirror commented

2025-11-02 09:45:50 -06:00

@lautriva commented on GitHub (Oct 11, 2023):

Yes I know this one, in my example I referred it as https://git.example.com/admin/repos
I know and I'm ok with the fact that here all instance repos are shown 🙂

My problem is when I check on user profile page https://git.example.com/{USERNAME}, their private repos are shown here but they shouldn't be

@lautriva commented on GitHub (Oct 11, 2023): Yes I know this one, in my example I referred it as `https://git.example.com/admin/repos` I know and I'm ok with the fact that here all instance repos are shown :slightly_smiling_face: My problem is when I check on user profile page `https://git.example.com/{USERNAME}`, their private repos are shown here but they shouldn't be

GiteaMirror commented

2025-11-02 09:45:51 -06:00

@lautriva commented on GitHub (Dec 3, 2024):

Hi,
Any news on this one ?

@lautriva commented on GitHub (Dec 3, 2024): Hi, Any news on this one ?

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11723