Confusing docs for IMPORT_LOCAL_PATHS #2403

New Issue

2025-11-02T04:34:54-06:00

GiteaMirror commented

2025-11-02 04:34:54 -06:00

Originally created by @bugreport0 on GitHub (Oct 12, 2018).

Gitea version (or commit ref): 1.5.2

Description

The documentation and usage for IMPORT_LOCAL_PATHS is confusing from a security standpoint, since it's next to DISABLE_GIT_HOOKS in the Config Cheat Sheet.

After much reading, my interpretation is that:

setting DISABLE_GIT_HOOKS to true is the 'safe' option
setting IMPORT_LOCAL_PATHS to false is the 'safe' option

The documentation for both options actually begins with: 'Prevent all users from…' which might lead some users to believe that setting both options to true is the 'safe' thing.

Maybe we should change the docs to something like:

DISABLE_GIT_HOOKS: Set to true to prevent all users from…
IMPORT_LOCAL_PATHS: Set to false to prevent all users from…

If I misinterpreted everything, maybe we should rename the option to DISABLE_LOCAL_IMPORT?

(Footnote: I know 'safe' is relative, that's why it's in quotes. And I've read through #2501 and #3997 but I'm still unsure about what is 'safe' and what not.)

Originally created by @bugreport0 on GitHub (Oct 12, 2018). - Gitea version (or commit ref): 1.5.2 ## Description The documentation and usage for `IMPORT_LOCAL_PATHS` is confusing from a security standpoint, since it's next to `DISABLE_GIT_HOOKS` in the [Config Cheat Sheet](https://docs.gitea.io/en-us/config-cheat-sheet/). After much reading, my interpretation is that: - setting `DISABLE_GIT_HOOKS` to `true` is the 'safe' option - setting `IMPORT_LOCAL_PATHS` to `false` is the 'safe' option The documentation for both options actually begins with: 'Prevent all users from…' which might lead some users to believe that setting both options to `true` is the 'safe' thing. Maybe we should change the docs to something like: - `DISABLE_GIT_HOOKS`: Set to `true` to prevent all users from… - `IMPORT_LOCAL_PATHS`: Set to `false` to prevent all users from… If I misinterpreted everything, maybe we should rename the option to `DISABLE_LOCAL_IMPORT`? (Footnote: I know 'safe' is relative, that's why it's in quotes. And I've read through #2501 and #3997 but I'm still unsure about what is 'safe' and what not.)

GiteaMirror added the type/docs label 2025-11-02 04:34:55 -06:00

GiteaMirror closed this issue

2025-11-02 04:34:55 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2403