Private repo under User activities must hidden!!! #4720

New Issue

GiteaMirror · 2025-11-02T06:00:47-06:00

GiteaMirror commented

2025-11-02 06:00:47 -06:00

Originally created by @matteocostantini on GitHub (Jan 25, 2020).

Gitea version (or commit ref):
Git version: 2.25
Operating system: ubuntu 28.04
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

Visitor (dont autenticated) can view user activities about a private repo. This is mistake. Visitors will never recognize the existence of a private repo.

Screenshots

Originally created by @matteocostantini on GitHub (Jan 25, 2020).  - Gitea version (or commit ref): - Git version: 2.25 - Operating system: ubuntu 28.04 - Database (use `[x]`): - [ ] PostgreSQL - [x]MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description Visitor (dont autenticated) can view user activities about a private repo. This is mistake. Visitors will never recognize the existence of a private repo. ## Screenshots

GiteaMirror added the type/bug label 2025-11-02 06:00:47 -06:00

GiteaMirror closed this issue

2025-11-02 06:00:47 -06:00

GiteaMirror commented

2025-11-02 06:00:48 -06:00

@bagasme commented on GitHub (Jan 26, 2020):

@matteocostantini So they require login to view private repos, right?

@bagasme commented on GitHub (Jan 26, 2020): @matteocostantini So they require login to view private repos, right?

GiteaMirror commented

2025-11-02 06:00:48 -06:00

@bobemoe commented on GitHub (Jan 26, 2020):

I've just tried to recreate this... most of my repos are private, and when I log out and look around at "explore" or at "my activity" I do not see any clues of their existence. Either under /USER?tab=activity (only shows public) or /USER/REPO/activity (404's)

@matteocostantini Maybe a screenshot or URL would help? Which version of Gitea?

@bobemoe commented on GitHub (Jan 26, 2020): I've just tried to recreate this... most of my repos are private, and when I log out and look around at "explore" or at "my activity" I do not see any clues of their existence. Either under /USER?tab=activity (only shows public) or /USER/REPO/activity (404's) @matteocostantini Maybe a screenshot or URL would help? Which version of Gitea?

GiteaMirror commented

2025-11-02 06:00:48 -06:00

@zeripath commented on GitHub (Jan 27, 2020):

@matteocostantini I really don't understand what you mean here.

Could you explain a bit more clearly? What version of Gitea is this on? How did you create the repo, what did the visitor see?

Perhaps give us an example on try or a clear way to reproduce for ourselves .

@zeripath commented on GitHub (Jan 27, 2020): @matteocostantini I really don't understand what you mean here. Could you explain a bit more clearly? What version of Gitea is this on? How did you create the repo, what did the visitor see? Perhaps give us an example on try or a clear way to reproduce for ourselves .

GiteaMirror commented

2025-11-02 06:00:48 -06:00

@matteocostantini commented on GitHub (Jan 27, 2020):

Hi, this is the screenshot of my public activity page (no authenticated!)

I'm using 1.10.3 version, on mysql. no theme customization folder.

@matteocostantini commented on GitHub (Jan 27, 2020): Hi, this is the screenshot of my public activity page (no authenticated!) I'm using 1.10.3 version, on mysql. no theme customization folder. ![Immagine](https://user-images.githubusercontent.com/5763421/73159398-b154c580-40e6-11ea-9bc5-110de40bc8fd.png)

GiteaMirror commented

2025-11-02 06:00:48 -06:00

@bobemoe commented on GitHub (Jan 27, 2020):

@matteocostantini Thanks for the extra info. You may want to blank out the URL from your screenshot if the info is sensitive, but it helped me recreated this issue.

Can you edit the setting for the repo and check "Private" is ticked?

I believe it may be a "Public" repo, but owned by a "Limited" visibility Organisation.

I have recreated this scenario here (1.12-dev) and it looks like it may be a bug:

Create a new Organisation with "Limited" visibility.
Create a new "public" Repository owned be the new Org.
Log out and view activity

You can see the repo and any activity mentioned but clicking it 404's

https://try.gitea.io/bobemoe?tab=activity

@bobemoe commented on GitHub (Jan 27, 2020): @matteocostantini Thanks for the extra info. You may want to blank out the URL from your screenshot if the info is sensitive, but it helped me recreated this issue. Can you edit the setting for the repo and check "Private" is ticked? I believe it may be a "Public" repo, but owned by a "Limited" visibility Organisation. I have recreated this scenario here (1.12-dev) and it looks like it may be a bug: 1. Create a new Organisation with "Limited" visibility. 1. Create a new "public" Repository owned be the new Org. 1. Log out and view activity You can see the repo and any activity mentioned but clicking it 404's https://try.gitea.io/bobemoe?tab=activity

GiteaMirror commented

2025-11-02 06:00:49 -06:00

@matteocostantini commented on GitHub (Jan 27, 2020):

Yes , i recreate the scenario again! It's a bug!

@matteocostantini commented on GitHub (Jan 27, 2020): Yes , i recreate the scenario again! It's a bug!

GiteaMirror commented

2025-11-02 06:00:49 -06:00

@zeripath commented on GitHub (Jan 27, 2020):

Ok so this only affects "public" repos in limited accessibility organisations?

Not private repos? Or are private repos affected on 1.10.x too?

@zeripath commented on GitHub (Jan 27, 2020): Ok so this only affects "public" repos in limited accessibility organisations? Not private repos? Or are private repos affected on 1.10.x too?

GiteaMirror commented

2025-11-02 06:00:49 -06:00

@matteocostantini commented on GitHub (Jan 27, 2020):

Ok so this only affects "public" repos in limited accessibility organisations?

Not private repos? Or are private repos affected on 1.10.x too?

I'm understanding what do you say.

Are private report that showed in public page of user .

https://mygiteaddress/?tab=activity - guest mode showed activities about private organisation repos .
For example
pushed to master at /
pushed to master at /

@matteocostantini commented on GitHub (Jan 27, 2020): > Ok so this only affects "public" repos in limited accessibility organisations? > > Not private repos? Or are private repos affected on 1.10.x too? I'm understanding what do you say. Are private report that showed in public page of user . https://mygiteaddress/<Username>?tab=activity - guest mode showed activities about private organisation repos . For example <Username> pushed to master at <OrganizationName1>/<RepoName1> <Username> pushed to master at <OrganizationName2>/<RepoName3>

GiteaMirror commented

2025-11-02 06:00:49 -06:00

@bobemoe commented on GitHub (Jan 27, 2020):

@matteocostantini can you go to the settings of the repo and check if it is private or public. https://mygitaddress/orgname/reponame/settings

I am not talking about the organisation, I understand that is a private organisation, but I think the bug may be that the repo is still marked as public. Please confirm.

@bobemoe commented on GitHub (Jan 27, 2020): @matteocostantini can you go to the settings of the repo and check if it is private or public. https://mygitaddress/orgname/reponame/settings I am not talking about the organisation, I understand that is a private organisation, but I think the bug may be that the repo is still marked as public. Please confirm.

GiteaMirror referenced this issue

2025-11-02 13:35:37 -06:00

[PR #4720] [MERGED] Make sure to reset commit count in the cache on mirror syncing #17475

GiteaMirror referenced this issue

2025-11-02 13:38:38 -06:00

[PR #4770] [MERGED] Backport 4720 : Make sure to reset commit count in the cache on mirror syncing #17489

Sign in to join this conversation.