Deactivated administrators are not deactivated? #2955

New Issue

GiteaMirror · 2025-11-02T04:55:13-06:00

GiteaMirror commented

2025-11-02 04:55:13 -06:00

Originally created by @michelvosje on GitHub (Feb 21, 2019).

Gitea version (or commit ref): 3b612ce built with go1.11.5 : bindata, sqlite, sqlite_unlock_notify
Git version: 2.18.1
Operating system: Docker
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Log gist:

Description

A week ago we deactivated a user account which was marked as an administrator account. The person assigned to the user account has left the organisation. We assumed that the user would not be able to login again into Gitea.

Today we found out he was able to create a new non-administrator account for somebody else (no worries it's contract related). I just tried it out and i see that deactivated administrator accounts still administrator rights. For us this is unexpected behaviour of Gitea which i wanted to report.
...

Screenshots

Originally created by @michelvosje on GitHub (Feb 21, 2019). - Gitea version (or commit ref): 3b612ce built with go1.11.5 : bindata, sqlite, sqlite_unlock_notify - Git version: 2.18.1 - Operating system: Docker - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [X] SQLite - Log gist: ## Description A week ago we deactivated a user account which was marked as an administrator account. The person assigned to the user account has left the organisation. We assumed that the user would not be able to login again into Gitea. Today we found out he was able to create a new non-administrator account for somebody else (no worries it's contract related). I just tried it out and i see that deactivated administrator accounts still administrator rights. For us this is unexpected behaviour of Gitea which i wanted to report. ... ## Screenshots ![image](https://user-images.githubusercontent.com/5354633/53181418-ca601700-35f7-11e9-90d3-20a93cc13e05.png)

GiteaMirror added the type/question issue/stale labels 2025-11-02 04:55:13 -06:00

GiteaMirror closed this issue

2025-11-02 04:55:13 -06:00

GiteaMirror commented

2025-11-02 04:55:14 -06:00

@jolheiser commented on GitHub (Feb 21, 2019):

One thing to note, Activated is referring to email activation when you have enabled REGISTER_EMAIL_CONFIRM in settings.
To stop someone from signing in, you would need to check Disable Sign-In when editing them.

@jolheiser commented on GitHub (Feb 21, 2019): One thing to note, `Activated` is referring to email activation when you have enabled `REGISTER_EMAIL_CONFIRM` in settings. To stop someone from signing in, you would need to check `Disable Sign-In` when editing them.

GiteaMirror commented

2025-11-02 04:55:14 -06:00

@lunny commented on GitHub (Feb 23, 2019):

@michelvosje @jolheiser I think I have sent https://github.com/go-gitea/gitea/pull/6115 merged in v1.7.3 should fix this problem. An unactived user should also be deny login except he clicked the activation link on the confirm email.

@lunny commented on GitHub (Feb 23, 2019): @michelvosje @jolheiser I think I have sent https://github.com/go-gitea/gitea/pull/6115 merged in v1.7.3 should fix this problem. An unactived user should also be deny login except he clicked the activation link on the confirm email.

GiteaMirror commented

2025-11-02 04:55:14 -06:00

@michelvosje commented on GitHub (Feb 25, 2019):

So am i correct that it is not possible to see from the overview of User Accounts which account is marked as enabled/disabled? I'd have to manually click all accounts 1 by 1 to see which one is and is not disabled?

From a security perspective i don't think that is correct. As an administrator i don't care who has and who has not clicked the email activation link.

@michelvosje commented on GitHub (Feb 25, 2019): So am i correct that it is not possible to see from the overview of User Accounts which account is marked as enabled/disabled? I'd have to manually click all accounts 1 by 1 to see which one is and is not disabled? From a security perspective i don't think that is correct. As an administrator i don't care who has and who has not clicked the email activation link.

GiteaMirror commented

2025-11-02 04:55:14 -06:00

@lafriks commented on GitHub (Feb 25, 2019):

Most probably both options would be nice to see

@lafriks commented on GitHub (Feb 25, 2019): Most probably both options would be nice to see

GiteaMirror commented

2025-11-02 04:55:15 -06:00

@adelowo commented on GitHub (Mar 3, 2019):

Might be a little confusing if both options are there. I think Activated can be swapped out for @michelvosje 's suggestion

@adelowo commented on GitHub (Mar 3, 2019): Might be a little confusing if both options are there. I think Activated can be swapped out for @michelvosje 's suggestion

GiteaMirror commented

2025-11-02 04:55:15 -06:00

@stale[bot] commented on GitHub (May 2, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (May 2, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:55:15 -06:00

@stale[bot] commented on GitHub (May 16, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (May 16, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.

GiteaMirror referenced this issue

2025-11-02 12:16:15 -06:00

[PR #2955] [MERGED] Fix language names #16681

Sign in to join this conversation.