Private repo under User activities must hidden!!!

[matteocostantini]

• Gitea version (or commit ref):
• Git version: 2.25
• Operating system: ubuntu 28.04
• Database (use [x]):
  • PostgreSQL
  • [x]MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Visitor (dont autenticated) can view user activities about a private repo. This is mistake. Visitors will never recognize the existence of a private repo.

Screenshots

[bagasme]

@matteocostantini So they require login to view private repos, right?

[bobemoe]

I've just tried to recreate this... most of my repos are private, and when I log out and look around at "explore" or at "my activity" I do not see any clues of their existence. Either under /USER?tab=activity (only shows public) or /USER/REPO/activity (404's)

@matteocostantini Maybe a screenshot or URL would help? Which version of Gitea?

[zeripath]

@matteocostantini I really don't understand what you mean here.

Could you explain a bit more clearly? What version of Gitea is this on? How did you create the repo, what did the visitor see?

Perhaps give us an example on try or a clear way to reproduce for ourselves .

[matteocostantini]

Hi, this is the screenshot of my public activity page (no authenticated!)

I'm using 1.10.3 version, on mysql. no theme customization folder.

[bobemoe]

@matteocostantini Thanks for the extra info. You may want to blank out the URL from your screenshot if the info is sensitive, but it helped me recreated this issue.

Can you edit the setting for the repo and check "Private" is ticked?

I believe it may be a "Public" repo, but owned by a "Limited" visibility Organisation.

I have recreated this scenario here (1.12-dev) and it looks like it may be a bug:

1. Create a new Organisation with "Limited" visibility.
2. Create a new "public" Repository owned be the new Org.
3. Log out and view activity

You can see the repo and any activity mentioned but clicking it 404's

https://try.gitea.io/bobemoe?tab=activity

[matteocostantini]

Yes , i recreate the scenario again! It's a bug!

[zeripath]

Ok so this only affects "public" repos in limited accessibility organisations?

Not private repos? Or are private repos affected on 1.10.x too?

[matteocostantini]

Ok so this only affects "public" repos in limited accessibility organisations?

Not private repos? Or are private repos affected on 1.10.x too?

I'm understanding what do you say.

Are private report that showed in public page of user .

https://mygiteaddress/?tab=activity - guest mode showed activities about private organisation repos .
For example
pushed to master at /
pushed to master at /

[bobemoe]

@matteocostantini can you go to the settings of the repo and check if it is private or public. https://mygitaddress/orgname/reponame/settings

I am not talking about the organisation, I understand that is a private organisation, but I think the bug may be that the repo is still marked as public. Please confirm.