delete user with its repositories & organization memberships #7234

New Issue

GiteaMirror · 2025-11-02T07:20:24-06:00

GiteaMirror commented

2025-11-02 07:20:24 -06:00

Originally created by @a1batross on GitHub (Apr 22, 2021).

Gitea version (or commit ref): 1.14.1 from GitHub Releases
Git version: 2.25.1
Operating system: Ubuntu 20.04.2
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No

I recently had a spam attack on my open Gitea instance.

Spammers seems are targeted for the Gitea instances, as some accounts created several repositories or created and joined organizations. The problem is, I can't delete these accounts with one command or click.

Nor CLI, nor Web admin panel gives me anything to purge everything made by these bots.

Originally created by @a1batross on GitHub (Apr 22, 2021). - Gitea version (or commit ref): 1.14.1 from GitHub Releases - Git version: 2.25.1 - Operating system: Ubuntu 20.04.2 - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No I recently had a spam attack on my open Gitea instance. Spammers seems are targeted for the Gitea instances, as some accounts created several repositories or created and joined organizations. The problem is, I can't delete these accounts with one command or click. Nor CLI, nor Web admin panel gives me anything to purge everything made by these bots.

GiteaMirror added the issue/confirmed type/feature labels 2025-11-02 07:20:24 -06:00

GiteaMirror closed this issue

2025-11-02 07:20:24 -06:00

GiteaMirror commented

2025-11-02 07:20:25 -06:00

@6543 commented on GitHub (Apr 22, 2021):

I would propose a "purge user" function for admins ...
-> delete user, deletes a user & his membership
-> purge user, deletes all a user has done ...

@6543 commented on GitHub (Apr 22, 2021): I would propose a "purge user" function for admins ... -> delete user, deletes a user & his membership -> purge user, deletes all a user has done ...

GiteaMirror commented

2025-11-02 07:20:25 -06:00

@a1batross commented on GitHub (Apr 22, 2021):

@6543 that seems fine to me.

Anything better than deleting repositories one by one.

@a1batross commented on GitHub (Apr 22, 2021): @6543 that seems fine to me. Anything better than deleting repositories one by one.

GiteaMirror commented

2025-11-02 07:20:25 -06:00

@lunny commented on GitHub (Apr 22, 2021):

Or a flag --force.

@lunny commented on GitHub (Apr 22, 2021): Or a flag `--force`.

GiteaMirror commented

2025-11-02 07:20:26 -06:00

@silverwind commented on GitHub (Apr 22, 2021):

I too would like such an option on the admin UI to delete a user along with all its memberships.

@silverwind commented on GitHub (Apr 22, 2021): I too would like such an option on the admin UI to delete a user along with all its memberships.

GiteaMirror commented

2025-11-02 07:20:26 -06:00

@mewalig commented on GitHub (Oct 5, 2021):

Is there any back-end administrative script that can do this (e.g. a script that runs a few lines of SQL)?

@mewalig commented on GitHub (Oct 5, 2021): Is there any back-end administrative script that can do this (e.g. a script that runs a few lines of SQL)?

GiteaMirror commented

2025-11-02 07:20:26 -06:00

@fnetX commented on GitHub (Nov 17, 2021):

Does it already help anyone to provide an API function here? Either an option to remove a user including everything, or a separate that removes a user with all the data that can be run after some kind of confirmation.

@fnetX commented on GitHub (Nov 17, 2021): Does it already help anyone to provide an API function here? Either an option to remove a user *including* everything, or a separate that removes a user with all the data that can be run after some kind of confirmation.

GiteaMirror commented

2025-11-02 07:20:27 -06:00

@mewalig commented on GitHub (Nov 17, 2021):

API would be great.

As far as options: even better would be the option for the account deletion to merely disable the account without deleting it, so that all of the data related to the user account remains intact. Perhaps such an option exists that I'm not aware of, in which case please disregard this comment. If not, there are a wide range of business, operational and/or legal reasons why disabling may be preferable-- or necessary-- in lieu of deleting.

Also important to consider is that it may be desirable for peripheral content created under that account-- such as, for example, comments to some issue related to someone else's repo-- to remain (imagine trying to read an issue history with a key participant's comments removed). There are surely also regulatory considerations related to users' control of content as well, and in a world where regulatory requirements can quickly change, flexibility is even more valuable.

Worth making the connection as well that related to these considerations is the ability to export data related to a specific account i.e. https://github.com/go-gitea/gitea/issues/1446 and https://github.com/go-gitea/gitea/issues/4351

@mewalig commented on GitHub (Nov 17, 2021): API would be great. As far as options: even better would be the option for the account deletion to merely disable the account without deleting it, so that all of the data related to the user account remains intact. Perhaps such an option exists that I'm not aware of, in which case please disregard this comment. If not, there are a wide range of business, operational and/or legal reasons why disabling may be preferable-- or necessary-- in lieu of deleting. Also important to consider is that it may be desirable for peripheral content created under that account-- such as, for example, comments to some issue related to someone else's repo-- to remain (imagine trying to read an issue history with a key participant's comments removed). There are surely also regulatory considerations related to users' control of content as well, and in a world where regulatory requirements can quickly change, flexibility is even more valuable. Worth making the connection as well that related to these considerations is the ability to export data related to a specific account i.e. https://github.com/go-gitea/gitea/issues/1446 and https://github.com/go-gitea/gitea/issues/4351

GiteaMirror commented

2025-11-02 07:20:27 -06:00

@fnetX commented on GitHub (Mar 2, 2022):

By the way, because the link doesn't exist, there is #18064.

@fnetX commented on GitHub (Mar 2, 2022): By the way, because the link doesn't exist, there is #18064.

GiteaMirror commented

2025-11-02 07:20:28 -06:00

@stale[bot] commented on GitHub (May 1, 2022):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (May 1, 2022): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror commented

2025-11-02 07:20:28 -06:00

@MightyPork commented on GitHub (Nov 14, 2022):

Hi, can I ask how to use this feature? I'm using 1.17.3

A common pattern of spam on my gitea is that a user signs up and creates an empty repository (or several) with ads and links. The user can't be deleted through the admin UI, because it has repositories. The spam repositories have to be deleted one at a time.

This spam vector greatly dropped in popularity when I disabled sign-ups other than through github, but it's still happening.

@MightyPork commented on GitHub (Nov 14, 2022): Hi, can I ask how to use this feature? I'm using 1.17.3 A common pattern of spam on my gitea is that a user signs up and creates an empty repository (or several) with ads and links. The user can't be deleted through the admin UI, because it has repositories. The spam repositories have to be deleted one at a time. This spam vector greatly dropped in popularity when I disabled sign-ups other than through github, but it's still happening. ![Screenshot_20221114_105415](https://user-images.githubusercontent.com/2041118/201630093-4ba1d748-14be-4eba-ae28-f501770f8202.png) ![Screenshot_20221114_105510](https://user-images.githubusercontent.com/2041118/201630263-f5e1ae17-fe65-41f7-8cb0-dbe8b3dffc9b.png) ![Screenshot_20221114_105520](https://user-images.githubusercontent.com/2041118/201630276-505f57b9-ac4b-469c-b7ea-8225c8d9e77f.png)

GiteaMirror commented

2025-11-02 07:20:29 -06:00

@zeripath commented on GitHub (Nov 14, 2022):

The feature is in 1.18 so would be in dev, 1.18-dev or 1.18-rc0

@zeripath commented on GitHub (Nov 14, 2022): The feature is in 1.18 so would be in dev, 1.18-dev or 1.18-rc0

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7234