Organization View Does Not Require Authentication #3057

New Issue

GiteaMirror · 2025-11-02T04:59:08-06:00

GiteaMirror commented

2025-11-02 04:59:08 -06:00

Originally created by @muellert on GitHub (Mar 17, 2019).

Gitea version (or commit ref): 1.7.4
Git version:
Operating system: Linux
Database (use [x]):
- [X ] PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

When accessing an URL for an organization, no authentication is required. This way, there is a potential information leak, as non-existent "organizations" will result in a 404.

The contained private repositories or project members are all inaccessible, though, but it would be nice if one could demand that accessing an organization also requires the user to be logged in, and possibly member of a certain group.

Screenshots

Originally created by @muellert on GitHub (Mar 17, 2019).   - Gitea version (or commit ref): 1.7.4 - Git version: - Operating system: Linux - Database (use `[x]`): - [X ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description When accessing an URL for an organization, no authentication is required. This way, there is a potential information leak, as non-existent "organizations" will result in a 404. The contained private repositories or project members are all inaccessible, though, but it would be nice if one could demand that accessing an organization also requires the user to be logged in, and possibly member of a certain group. ## Screenshots

GiteaMirror added the type/question label 2025-11-02 04:59:08 -06:00

GiteaMirror closed this issue

2025-11-02 04:59:08 -06:00

GiteaMirror commented

2025-11-02 04:59:09 -06:00

@lunny commented on GitHub (Mar 17, 2019):

~~That's by design for security consideration.~~

@lunny commented on GitHub (Mar 17, 2019): ~That's by design for security consideration.~

GiteaMirror commented

2025-11-02 04:59:09 -06:00

@muellert commented on GitHub (Mar 17, 2019):

Hmm? I would prefer to be able to hide organizations from unauthenticated views. How does showing them improve security?

@muellert commented on GitHub (Mar 17, 2019): Hmm? I would prefer to be able to hide organizations from unauthenticated views. How does showing them improve security?

GiteaMirror commented

2025-11-02 04:59:10 -06:00

@techknowlogick commented on GitHub (Mar 17, 2019):

@muellert in 1.8.0 you can do exactly this, hide orgs from users who are unauthenticated

@techknowlogick commented on GitHub (Mar 17, 2019): @muellert in 1.8.0 you can do exactly this, hide orgs from users who are unauthenticated

GiteaMirror commented

2025-11-02 04:59:10 -06:00

@lunny commented on GitHub (Mar 18, 2019):

@muellert Forget my word, as @techknowlogick said, you could create private organizations when you upgrade to v1.8

@lunny commented on GitHub (Mar 18, 2019): @muellert Forget my word, as @techknowlogick said, you could create private organizations when you upgrade to v1.8

GiteaMirror referenced this issue

2025-11-02 12:17:49 -06:00

[PR #3057] [MERGED] Sanitize logs for mirror sync #16736

GiteaMirror referenced this issue

2025-11-02 12:18:16 -06:00

[PR #3078] [MERGED] Sanitize logs for mirror sync (#3057, #3082) #16752

Sign in to join this conversation.