"Activities" tab and the logging for it is bad for the privacy - should be optional

[l-jonas]

• Gitea version (or commit ref): unknown (codeberg.org)
• Git version: not relevant
• Operating system: not relevant
• Database (use [x]): not relevant
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (https://try.gitea.io/xandertest?tab=activity)
  • No
  • Not relevant

Description

Git logs the commit timestamps (which a developer can spoof for better privacy), however gitea logs the push timestamps and some other events. Is it possible to add the option to hide/ disable it per user/ project/ organization?

Note: In the linked example, there is the text "3 weeks ago". When moving the mouse over it, then there is the exact timestamp visible.

Screenshots

[guillep2k]

Not entirely effective. The push date is written by git, no matter what the pusher sends. Anyone can check the log and see the actual dates if it comes to that.

[l-jonas]

@guillep2k From the page you linked:

Note, if you fetched from origin/master, it will print the date you fetched it; NOT the date someone else pushed the commit.

So it would be still saved at the git server, but not everyone from the internet would be able to see it

[guillep2k]

@l-jonas You are right! One can learn something new every day.

[lafriks]

I don't see how that could be implemented

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[l-jonas]

There was no activity but the issue does still exist

[lunny]

I can't catch what's the problem. If you have read permission of git repository, you will get all the informations on Activities. The privacy is not from gitea, may you mean git. So I think maybe you could find other VCS tool could resolve that.

[l-jonas]

@lunny Did you read the whole thread? The "Activities" contain more data than git itself provides. Git itself only provides logs of the commit timestamps but Gitea additionally logs other events (like push timestamps) for the "Activities" and sends it to anyone who requests it.

[guillep2k]

I don't see why hiding the push date is important, unless you want to make your boss believe you've worked at a different time than you did. 🤣

[l-jonas]

@guillep2k It's not only a date, it's a timestamp. And it's not for the boss, because it's publicly visible for anyone and for a long time.

[zeripath]

Ah I think I understand. You would like to say change the displayed timeformat to only say display the day something was done or possibly even the month - not withstanding that if you can access git you can get the full timestamps in any case.

I would say that you could simply set within the app.ini:

...
[time]
format=2006-01-02
...

However, the issue is that:

gitea/modules/setting/setting.go

Lines 827 to 830 in 491887d

	TestTimeFormat, _ := time.Parse(TimeFormat, TimeFormat)
	if TestTimeFormat.Format(time.RFC3339) != "2006-01-02T15:04:05Z" {
	log.Fatal("Can't create time properly, please check your time format has 2006, 01, 02, 15, 04 and 05")
	}

Enforces that this format has to be fully specified.

Now, looking at the use of TimeFormat I don't think there is a good reason to enforce that we are so strict with this.

A simple fix would be to change that log.Fatal to simple log.Warn.

[l-jonas]

@zeripath

not withstanding that if you can access git you can get the full timestamps in any case

That's wrong. One can chose anything as commit timestamp and the push timestamps are in the reflog, but are never shared by the git server.

Reducing the accuracy in the Activities tab would be a good default. However, I wrote at the start of this issue what I want

Is it possible to add the option to hide/ disable it [logging for activity tab + showing activity tab] per user/ project/ organization?