[PR #5437] [CLOSED] check if signups are allowed during SignUpPost #17796

New Issue

GiteaMirror · 2025-11-02T15:51:34-06:00

GiteaMirror commented

2025-11-02 15:51:34 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/5437
Author: @r-52
Created: 11/30/2018
Status: ❌ Closed

Base: master ← Head: r-make-sign-up-hidden-page

📝 Commits (1)

b33f71b check if signups are allowed during SignUpPost

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 routers/user/auth.go (+1 -1)

📄 Description

Previously you could hide the sign up page with the following
configs:

[service]
SHOW_REGISTRATION_BUTTON          = false

This would remove the sign up button from the navbar, but the user could still access the page with a direct link. During the http post action, the go action checked if the key SHOW_REGISTRATION_BUTTON was set to true. If not, the user received a 403.

You can use this scenario for a semi-hidden sign up page that is only accessible through a direct link.

I've changed the check in this PR to check if the sign up is allowed or not. The user can access the sign up page (if it's enabled) and sign up even if the value of SHOW_REGISTRATION_BUTTON is false, the user can sign up.

Another solution could be:

unify SHOW_REGISTRATION_BUTTON with DISABLE_REGISTRATION to
only show the registration page if it's enabled, but that would dis-
allow the mentioned scenario

fixes: https://github.com/go-gitea/gitea/issues/5183

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/5437 **Author:** [@r-52](https://github.com/r-52) **Created:** 11/30/2018 **Status:** ❌ Closed **Base:** `master` ← **Head:** `r-make-sign-up-hidden-page` --- ### 📝 Commits (1) - [`b33f71b`](https://github.com/go-gitea/gitea/commit/b33f71b140bd6a993e1b262986bea686218787a5) check if signups are allowed during SignUpPost ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `routers/user/auth.go` (+1 -1) </details> ### 📄 Description Previously you could hide the sign up page with the following configs: ```ini [service] SHOW_REGISTRATION_BUTTON = false ``` This would remove the sign up button from the navbar, but the user could still access the page with a direct link. During the http post action, the go action checked if the key `SHOW_REGISTRATION_BUTTON` was set to true. If not, the user received a 403. You can use this scenario for a semi-hidden sign up page that is only accessible through a direct link. I've changed the check in this PR to check if the sign up is allowed or not. The user can access the sign up page (if it's enabled) and sign up even if the value of `SHOW_REGISTRATION_BUTTON` is `false`, the user can sign up. Another solution could be: - unify `SHOW_REGISTRATION_BUTTON ` with `DISABLE_REGISTRATION ` to only show the registration page if it's enabled, but that would dis- allow the mentioned scenario fixes: https://github.com/go-gitea/gitea/issues/5183 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 15:51:34 -06:00

GiteaMirror closed this issue

2025-11-02 15:51:38 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17796