Users from private organization are visible for all other users. #3146

New Issue

GiteaMirror · 2025-11-02T05:01:58-06:00

GiteaMirror commented

2025-11-02 05:01:58 -06:00

Originally created by @igsol on GitHub (Apr 6, 2019).

Gitea version (or commit ref): 1.8rc2, cd8cdbd
Operating system: CentOS7, Fedora 29, I guess on all.
Database:
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes ( https://try.gitea.io/explore/users?q=tt00&tab= )

Description

The new cool feature "private organization" enables only users of a private organization to see this organization e.g. on "Explore/Organization" ( https://try.gitea.io/explore/organizations ). In this aspect, it's perfect.

But users belonging to private organizations are also all listed on "Explore/Users" alongside with users from public organizations. This is not logical!

For instance, I created two private organizations:

tt007-org1, it contains tt007 user
tt008-org1, it contains tt008 user

Now, if you open https://try.gitea.io/explore/users?q=tt00&tab= you can see all users from these private organizations even if you are not administrator and is registered neither in tt007-org1 nor in tt008-org1.

Expected behavior

Only users from the current private organization should see other users from the same organization.

Screenshots

Originally created by @igsol on GitHub (Apr 6, 2019). - Gitea version (or commit ref): 1.8rc2, cd8cdbd - Operating system: CentOS7, Fedora 29, I guess on all. - Database: - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes ( https://try.gitea.io/explore/users?q=tt00&tab= ) ## Description The new cool feature "private organization" enables only users of a private organization to see this organization e.g. on "Explore/Organization" ( https://try.gitea.io/explore/organizations ). In this aspect, it's perfect. But users belonging to private organizations are also all listed on "Explore/Users" alongside with users from public organizations. This is not logical! For instance, I created two private organizations: - `tt007-org1`, it contains `tt007` user - `tt008-org1`, it contains `tt008` user Now, if you open https://try.gitea.io/explore/users?q=tt00&tab= you can see all users from these private organizations even if you are not administrator and is registered neither in `tt007-org1` nor in `tt008-org1`. ## Expected behavior Only users from the current private organization should see other users from the same organization. ## Screenshots ![image](https://user-images.githubusercontent.com/14091049/55675092-16280080-58c6-11e9-963b-27e2d0646b47.png)

GiteaMirror added the issue/duplicate label 2025-11-02 05:01:58 -06:00

GiteaMirror closed this issue

2025-11-02 05:01:58 -06:00

GiteaMirror commented

2025-11-02 05:01:59 -06:00

@fangchin commented on GitHub (Apr 6, 2019):

Indeed, I ran into this too. So far, while waiting for a resolution, we just hacked a few files to disable the showing of users. But this is a quick hack and I would be embarrassed to show it.

@fangchin commented on GitHub (Apr 6, 2019): Indeed, I ran into this too. So far, while waiting for a resolution, we just hacked a few files to disable the showing of users. But this is a quick hack and I would be embarrassed to show it.

GiteaMirror commented

2025-11-02 05:01:59 -06:00

@lafriks commented on GitHub (Apr 8, 2019):

First we should define what users should be shown or hidden

@lafriks commented on GitHub (Apr 8, 2019): First we should define what users should be shown or hidden

GiteaMirror commented

2025-11-02 05:01:59 -06:00

@lafriks commented on GitHub (Apr 8, 2019):

Duplicate of #2908

@lafriks commented on GitHub (Apr 8, 2019): Duplicate of #2908

GiteaMirror referenced this issue

2025-11-02 12:19:19 -06:00