Public repositories of non-public organizations can be cloned by anonymous user #5467

New Issue

GiteaMirror · 2025-11-02T06:25:44-06:00

GiteaMirror commented

2025-11-02 06:25:44 -06:00

Originally created by @mschoettle on GitHub (May 28, 2020).

Gitea version (or commit ref): 1.11.5 & 1.13.0+dev-67-g24be06d7a
Git version:
Operating system:
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

It is possible to clone a public repository of a private organization ("visible only to organization members") and a limited organization ("visible to logged in users only") as an anonymous user.

To reproduce this, I did the following on https://try.gitea.io:

create private org (private-org) with a private and public repo (private-repo and public-repo)
create limited org (limited-org) with a private and public repo (same names as above)
try to clone each repo as an anonymous user

Result:

$ git clone https://try.gitea.io/private-org/private-repo.git
Cloning into 'private-repo'...
Username for 'https://try.gitea.io':

$ git clone https://try.gitea.io/private-org/public-repo.git
Cloning into 'public-repo'...
...

Since it works as an anonymous user I could not test whether this is also the case for a user who is not a member of the organization.

$ git clone https://try.gitea.io/limited-org/private-repo.git
Cloning into 'private-repo'...
Username for 'https://try.gitea.io':

$ git clone https://try.gitea.io/limited-org/public-repo.git limited-public-repo
Cloning into 'limited-public-repo'...
...

Originally created by @mschoettle on GitHub (May 28, 2020). - Gitea version (or commit ref): 1.11.5 & 1.13.0+dev-67-g24be06d7a - Git version: - Operating system: - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description It is possible to clone a public repository of a private organization ("visible only to organization members") and a limited organization ("visible to logged in users only") as an anonymous user. To reproduce this, I did the following on https://try.gitea.io: 1. create private org (`private-org`) with a private and public repo (`private-repo` and `public-repo`) 1. create limited org (`limited-org`) with a private and public repo (same names as above) 1. try to clone each repo as an anonymous user **Result:** ``` $ git clone https://try.gitea.io/private-org/private-repo.git Cloning into 'private-repo'... Username for 'https://try.gitea.io': ``` ``` $ git clone https://try.gitea.io/private-org/public-repo.git Cloning into 'public-repo'... ... ``` Since it works as an anonymous user I could not test whether this is also the case for a user who is not a member of the organization. ``` $ git clone https://try.gitea.io/limited-org/private-repo.git Cloning into 'private-repo'... Username for 'https://try.gitea.io': ``` ``` $ git clone https://try.gitea.io/limited-org/public-repo.git limited-public-repo Cloning into 'limited-public-repo'... ... ```

GiteaMirror added the type/bug label 2025-11-02 06:25:44 -06:00

GiteaMirror closed this issue

2025-11-02 06:25:44 -06:00

GiteaMirror commented

2025-11-02 06:25:45 -06:00

@CirnoT commented on GitHub (May 28, 2020):

Happens only when RequireSignInView is false so should affect only anonymous users.

@CirnoT commented on GitHub (May 28, 2020): Happens only when `RequireSignInView` is false so should affect only anonymous users.

GiteaMirror referenced this issue

2025-11-02 15:55:11 -06:00

[PR #5467] [MERGED] improve the git-scm url's in docs and sample.ini #17804

Sign in to join this conversation.