User profile page permission problems when user's visibility is private #13623

New Issue

GiteaMirror · 2025-11-02T10:48:32-06:00

GiteaMirror commented

2025-11-02 10:48:32 -06:00

Originally created by @yp05327 on GitHub (Oct 22, 2024).

Description

Conditions:

User A's visibility is private
User A and User B is the member of an organization
The organization is private and has a private repo
User A has contributed in the private repo

Problems after User B access User A's profile page:

User B can see all internal repos, but he has no permission to access them, so should these repos be displayed in the profile page?
User B can not access projects and packages unit, should it be displayed in the profile page?
User B can access Public Activity page but nothing there, User B can also access the private repo with all read permission, so the activities in this repo should be displayed?
If there's a private repo which User B can not access, but User A started it. Then you will see:

Gitea Version

latest

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

build

Database

None

Originally created by @yp05327 on GitHub (Oct 22, 2024). ### Description Conditions: - User A's visibility is private - User A and User B is the member of an organization - The organization is private and has a private repo - User A has contributed in the private repo Problems after User B access User A's profile page: - User B can see all internal repos, but he has no permission to access them, so should these repos be displayed in the profile page? ![image](https://github.com/user-attachments/assets/2be21ca2-7476-4bf5-97dd-f02117c831c5) - User B can not access `projects` and `packages` unit, should it be displayed in the profile page? ![image](https://github.com/user-attachments/assets/ce57cda9-1beb-4d5a-8271-af7a9b49b546) - User B can access `Public Activity` page but nothing there, User B can also access the private repo with all read permission, so the activities in this repo should be displayed? ![image](https://github.com/user-attachments/assets/066ee9d2-931b-4ded-a5b8-d7b5411489fe) - If there's a private repo which User B can not access, but User A started it. Then you will see: ![image](https://github.com/user-attachments/assets/d0e93315-5408-425b-a5d8-e329fa7a2465) ### Gitea Version latest ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? build ### Database None

GiteaMirror added the type/bug label 2025-11-02 10:48:32 -06:00

GiteaMirror commented

2025-11-02 10:48:33 -06:00

@sepiabrown commented on GitHub (Nov 20, 2024):

User B can access Public Activity page but nothing there, User B can also access the private repo with all read permission, so the activities in this repo should be displayed?

Our org need it too!

@sepiabrown commented on GitHub (Nov 20, 2024): > User B can access `Public Activity page` but nothing there, User B can also access the private repo with all read permission, so the activities in this repo should be displayed? Our org need it too!

GiteaMirror commented

2025-11-02 10:48:33 -06:00

@lunny commented on GitHub (Nov 20, 2024):

Whether a private user's public repositories should be private?

@lunny commented on GitHub (Nov 20, 2024): Whether a private user's public repositories should be private?

GiteaMirror commented

2025-11-02 10:48:33 -06:00

@yp05327 commented on GitHub (Nov 25, 2024):

Private user's private repos should be private to the org members unless they are collaborators.
If not, then joining in an org means leaking all your private repos name to org members.
And these repos can not be accessed, so why should we list them there.

@yp05327 commented on GitHub (Nov 25, 2024): Private user's private repos should be private to the org members unless they are collaborators. If not, then joining in an org means leaking all your private repos name to org members. And these repos can not be accessed, so why should we list them there.

GiteaMirror commented

2025-11-02 10:48:33 -06:00

@yp05327 commented on GitHub (Nov 27, 2024):

Whether a private user's public repositories should be private?

Private user can be seen in some cases. e.g. If private user following user B or they are in the same organization, then B can see his public repositories.
But for others, private users's public repositories should not be accessible.

@yp05327 commented on GitHub (Nov 27, 2024): > Whether a private user's public repositories should be private? Private user can be seen in some cases. e.g. If private user following user B or they are in the same organization, then B can see his public repositories. But for others, private users's public repositories should not be accessible.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13623