Skip to content

Commit 1ac86cb

Browse files
jpraetjpraet
committed
Respect DefaultUserIsRestricted system default when creating new user (go-gitea#19310 )
1 parent 0d196e2 commit 1ac86cb

File tree

17 files changed

+169
-84
lines changed

17 files changed

+169
-84
lines changed

‎cmd/admin.go

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
repo_module "code.gitea.io/gitea/modules/repository"
2626
"code.gitea.io/gitea/modules/setting"
2727
"code.gitea.io/gitea/modules/storage"
28+
"code.gitea.io/gitea/modules/util"
2829
auth_service "code.gitea.io/gitea/services/auth"
2930
"code.gitea.io/gitea/services/auth/source/oauth2"
3031
"code.gitea.io/gitea/services/auth/source/smtp"
@@ -113,6 +114,10 @@ var (
113114
Name: "access-token",
114115
Usage: "Generate access token for the user",
115116
},
117+
cli.BoolFlag{
118+
Name: "restricted",
119+
Usage: "Make a restricted user account",
120+
},
116121
},
117122
}
118123

@@ -537,17 +542,26 @@ func runCreateUser(c *cli.Context) error {
537542
changePassword = c.Bool("must-change-password")
538543
}
539544

545+
restricted := util.OptionalBoolNone
546+
547+
if c.IsSet("restricted") {
548+
restricted = util.OptionalBoolOf(c.Bool("restricted"))
549+
}
550+
540551
u := &user_model.User{
541552
Name: username,
542553
Email: c.String("email"),
543554
Passwd: password,
544-
IsActive: true,
545555
IsAdmin: c.Bool("admin"),
546556
MustChangePassword: changePassword,
547-
Theme: setting.UI.DefaultTheme,
548557
}
549558

550-
if err := user_model.CreateUser(u); err != nil {
559+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
560+
IsActive: util.OptionalBoolTrue,
561+
IsRestricted: restricted,
562+
}
563+
564+
if err := user_model.CreateUser(u, overwriteDefault); err != nil {
551565
return fmt.Errorf("CreateUser: %v", err)
552566
}
553567

‎models/user/user.go

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -622,7 +622,14 @@ func IsUsableUsername(name string) error {
622622

623623
// CreateUserOverwriteOptions are an optional options who overwrite system defaults on user creation
624624
type CreateUserOverwriteOptions struct {
625-
Visibility structs.VisibleType
625+
KeepEmailPrivate util.OptionalBool
626+
Visibility *structs.VisibleType
627+
AllowCreateOrganization util.OptionalBool
628+
EmailNotificationsPreference *string
629+
MaxRepoCreation *int
630+
Theme *string
631+
IsRestricted util.OptionalBool
632+
IsActive util.OptionalBool
626633
}
627634

628635
// CreateUser creates record of a new user.
@@ -638,10 +645,36 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
638645
u.EmailNotificationsPreference = setting.Admin.DefaultEmailNotification
639646
u.MaxRepoCreation = -1
640647
u.Theme = setting.UI.DefaultTheme
648+
u.IsRestricted = setting.Service.DefaultUserIsRestricted
649+
u.IsActive = !(setting.Service.RegisterEmailConfirm || setting.Service.RegisterManualConfirm)
641650

642651
// overwrite defaults if set
643652
if len(overwriteDefault) != 0 && overwriteDefault[0] != nil {
644-
u.Visibility = overwriteDefault[0].Visibility
653+
overwrite := overwriteDefault[0]
654+
if !overwrite.KeepEmailPrivate.IsNone() {
655+
u.KeepEmailPrivate = overwrite.KeepEmailPrivate.IsTrue()
656+
}
657+
if overwrite.Visibility != nil {
658+
u.Visibility = *overwrite.Visibility
659+
}
660+
if !overwrite.AllowCreateOrganization.IsNone() {
661+
u.AllowCreateOrganization = overwrite.AllowCreateOrganization.IsTrue()
662+
}
663+
if overwrite.EmailNotificationsPreference != nil {
664+
u.EmailNotificationsPreference = *overwrite.EmailNotificationsPreference
665+
}
666+
if overwrite.MaxRepoCreation != nil {
667+
u.MaxRepoCreation = *overwrite.MaxRepoCreation
668+
}
669+
if overwrite.Theme != nil {
670+
u.Theme = *overwrite.Theme
671+
}
672+
if !overwrite.IsRestricted.IsNone() {
673+
u.IsRestricted = overwrite.IsRestricted.IsTrue()
674+
}
675+
if !overwrite.IsActive.IsNone() {
676+
u.IsActive = overwrite.IsActive.IsTrue()
677+
}
645678
}
646679

647680
// validate data

‎modules/structs/admin_user.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ type CreateUserOption struct {
1919
Password string `json:"password" binding:"Required;MaxSize(255)"`
2020
MustChangePassword *bool `json:"must_change_password"`
2121
SendNotify bool `json:"send_notify"`
22+
Restricted *bool `json:"restricted"`
2223
Visibility string `json:"visibility" binding:"In(,public,limited,private)"`
2324
}
2425

‎routers/api/v1/admin/user.go

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"code.gitea.io/gitea/modules/password"
2323
"code.gitea.io/gitea/modules/setting"
2424
api "code.gitea.io/gitea/modules/structs"
25+
"code.gitea.io/gitea/modules/util"
2526
"code.gitea.io/gitea/modules/web"
2627
"code.gitea.io/gitea/routers/api/v1/user"
2728
"code.gitea.io/gitea/routers/api/v1/utils"
@@ -81,7 +82,6 @@ func CreateUser(ctx *context.APIContext) {
8182
Email: form.Email,
8283
Passwd: form.Password,
8384
MustChangePassword: true,
84-
IsActive: true,
8585
LoginType: auth.Plain,
8686
}
8787
if form.MustChangePassword != nil {
@@ -107,11 +107,17 @@ func CreateUser(ctx *context.APIContext) {
107107
return
108108
}
109109

110-
var overwriteDefault *user_model.CreateUserOverwriteOptions
110+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
111+
IsActive: util.OptionalBoolTrue,
112+
}
113+
114+
if form.Restricted != nil {
115+
overwriteDefault.IsRestricted = util.OptionalBoolOf(*form.Restricted)
116+
}
117+
111118
if form.Visibility != "" {
112-
overwriteDefault = &user_model.CreateUserOverwriteOptions{
113-
Visibility: api.VisibilityModes[form.Visibility],
114-
}
119+
visibility := api.VisibilityModes[form.Visibility]
120+
overwriteDefault.Visibility = &visibility
115121
}
116122

117123
if err := user_model.CreateUser(u, overwriteDefault); err != nil {

‎routers/install/install.go

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -508,13 +508,17 @@ func SubmitInstall(ctx *context.Context) {
508508
// Create admin account
509509
if len(form.AdminName) > 0 {
510510
u := &user_model.User{
511-
Name: form.AdminName,
512-
Email: form.AdminEmail,
513-
Passwd: form.AdminPasswd,
514-
IsAdmin: true,
515-
IsActive: true,
511+
Name: form.AdminName,
512+
Email: form.AdminEmail,
513+
Passwd: form.AdminPasswd,
514+
IsAdmin: true,
516515
}
517-
if err = user_model.CreateUser(u); err != nil {
516+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
517+
IsRestricted: util.OptionalBoolFalse,
518+
IsActive: util.OptionalBoolTrue,
519+
}
520+
521+
if err = user_model.CreateUser(u, overwriteDefault); err != nil {
518522
if !user_model.IsErrUserAlreadyExist(err) {
519523
setting.InstallLock = false
520524
ctx.Data["Err_AdminName"] = true

‎routers/web/admin/users.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,14 @@ func NewUserPost(ctx *context.Context) {
125125
Name: form.UserName,
126126
Email: form.Email,
127127
Passwd: form.Password,
128-
IsActive: true,
129128
LoginType: auth.Plain,
130129
}
131130

131+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
132+
IsActive: util.OptionalBoolTrue,
133+
Visibility: &form.Visibility,
134+
}
135+
132136
if len(form.LoginType) > 0 {
133137
fields := strings.Split(form.LoginType, "-")
134138
if len(fields) == 2 {
@@ -163,7 +167,7 @@ func NewUserPost(ctx *context.Context) {
163167
u.MustChangePassword = form.MustChangePassword
164168
}
165169

166-
if err := user_model.CreateUser(u, &user_model.CreateUserOverwriteOptions{Visibility: form.Visibility}); err != nil {
170+
if err := user_model.CreateUser(u, overwriteDefault); err != nil {
167171
switch {
168172
case user_model.IsErrUserAlreadyExist(err):
169173
ctx.Data["Err_UserName"] = true

‎routers/web/auth/auth.go

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -507,14 +507,12 @@ func SignUpPost(ctx *context.Context) {
507507
}
508508

509509
u := &user_model.User{
510-
Name: form.UserName,
511-
Email: form.Email,
512-
Passwd: form.Password,
513-
IsActive: !(setting.Service.RegisterEmailConfirm || setting.Service.RegisterManualConfirm),
514-
IsRestricted: setting.Service.DefaultUserIsRestricted,
510+
Name: form.UserName,
511+
Email: form.Email,
512+
Passwd: form.Password,
515513
}
516514

517-
if !createAndHandleCreatedUser(ctx, tplSignUp, form, u, nil, false) {
515+
if !createAndHandleCreatedUser(ctx, tplSignUp, form, u, nil, nil, false) {
518516
// error already handled
519517
return
520518
}
@@ -525,17 +523,17 @@ func SignUpPost(ctx *context.Context) {
525523

526524
// createAndHandleCreatedUser calls createUserInContext and
527525
// then handleUserCreated.
528-
func createAndHandleCreatedUser(ctx *context.Context, tpl base.TplName, form interface{}, u *user_model.User, gothUser *goth.User, allowLink bool) bool {
529-
if !createUserInContext(ctx, tpl, form, u, gothUser, allowLink) {
526+
func createAndHandleCreatedUser(ctx *context.Context, tpl base.TplName, form interface{}, u *user_model.User, overwrites *user_model.CreateUserOverwriteOptions, gothUser *goth.User, allowLink bool) bool {
527+
if !createUserInContext(ctx, tpl, form, u, overwrites, gothUser, allowLink) {
530528
return false
531529
}
532530
return handleUserCreated(ctx, u, gothUser)
533531
}
534532

535533
// createUserInContext creates a user and handles errors within a given context.
536534
// Optionally a template can be specified.
537-
func createUserInContext(ctx *context.Context, tpl base.TplName, form interface{}, u *user_model.User, gothUser *goth.User, allowLink bool) (ok bool) {
538-
if err := user_model.CreateUser(u); err != nil {
535+
func createUserInContext(ctx *context.Context, tpl base.TplName, form interface{}, u *user_model.User, overwrites *user_model.CreateUserOverwriteOptions, gothUser *goth.User, allowLink bool) (ok bool) {
536+
if err := user_model.CreateUser(u, overwrites); err != nil {
539537
if allowLink && (user_model.IsErrUserAlreadyExist(err) || user_model.IsErrEmailAlreadyUsed(err)) {
540538
if setting.OAuth2Client.AccountLinking == setting.OAuth2AccountLinkingAuto {
541539
var user *user_model.User

‎routers/web/auth/linkaccount.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -285,13 +285,12 @@ func LinkAccountPostRegister(ctx *context.Context) {
285285
Name: form.UserName,
286286
Email: form.Email,
287287
Passwd: form.Password,
288-
IsActive: !(setting.Service.RegisterEmailConfirm || setting.Service.RegisterManualConfirm),
289288
LoginType: auth.OAuth2,
290289
LoginSource: authSource.ID,
291290
LoginName: gothUser.UserID,
292291
}
293292

294-
if !createAndHandleCreatedUser(ctx, tplLinkAccount, form, u, &gothUser, false) {
293+
if !createAndHandleCreatedUser(ctx, tplLinkAccount, form, u, nil, &gothUser, false) {
295294
// error already handled
296295
return
297296
}

‎routers/web/auth/oauth.go

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"code.gitea.io/gitea/modules/session"
2626
"code.gitea.io/gitea/modules/setting"
2727
"code.gitea.io/gitea/modules/timeutil"
28+
"code.gitea.io/gitea/modules/util"
2829
"code.gitea.io/gitea/modules/web"
2930
"code.gitea.io/gitea/modules/web/middleware"
3031
auth_service "code.gitea.io/gitea/services/auth"
@@ -872,19 +873,21 @@ func SignInOAuthCallback(ctx *context.Context) {
872873
return
873874
}
874875
u = &user_model.User{
875-
Name: getUserName(&gothUser),
876-
FullName: gothUser.Name,
877-
Email: gothUser.Email,
878-
IsActive: !setting.OAuth2Client.RegisterEmailConfirm,
879-
LoginType: auth.OAuth2,
880-
LoginSource: authSource.ID,
881-
LoginName: gothUser.UserID,
882-
IsRestricted: setting.Service.DefaultUserIsRestricted,
876+
Name: getUserName(&gothUser),
877+
FullName: gothUser.Name,
878+
Email: gothUser.Email,
879+
LoginType: auth.OAuth2,
880+
LoginSource: authSource.ID,
881+
LoginName: gothUser.UserID,
882+
}
883+
884+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
885+
IsActive: util.OptionalBoolOf(!setting.OAuth2Client.RegisterEmailConfirm),
883886
}
884887

885888
setUserGroupClaims(authSource, u, &gothUser)
886889

887-
if !createAndHandleCreatedUser(ctx, base.TplName(""), nil, u, &gothUser, setting.OAuth2Client.AccountLinking != setting.OAuth2AccountLinkingDisabled) {
890+
if !createAndHandleCreatedUser(ctx, base.TplName(""), nil, u, overwriteDefault, &gothUser, setting.OAuth2Client.AccountLinking != setting.OAuth2AccountLinkingDisabled) {
888891
// error already handled
889892
return
890893
}

‎routers/web/auth/openid.go

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -425,12 +425,11 @@ func RegisterOpenIDPost(ctx *context.Context) {
425425
}
426426

427427
u := &user_model.User{
428-
Name: form.UserName,
429-
Email: form.Email,
430-
Passwd: password,
431-
IsActive: !(setting.Service.RegisterEmailConfirm || setting.Service.RegisterManualConfirm),
428+
Name: form.UserName,
429+
Email: form.Email,
430+
Passwd: password,
432431
}
433-
if !createUserInContext(ctx, tplSignUpOID, form, u, nil, false) {
432+
if !createUserInContext(ctx, tplSignUpOID, form, u, nil, nil, false) {
434433
// error already handled
435434
return
436435
}

‎services/auth/reverseproxy.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
user_model "code.gitea.io/gitea/models/user"
1313
"code.gitea.io/gitea/modules/log"
1414
"code.gitea.io/gitea/modules/setting"
15+
"code.gitea.io/gitea/modules/util"
1516
"code.gitea.io/gitea/modules/web/middleware"
1617
"code.gitea.io/gitea/services/mailer"
1718

@@ -106,11 +107,15 @@ func (r *ReverseProxy) newUser(req *http.Request) *user_model.User {
106107
}
107108

108109
user := &user_model.User{
109-
Name: username,
110-
Email: email,
111-
IsActive: true,
110+
Name: username,
111+
Email: email,
112112
}
113-
if err := user_model.CreateUser(user); err != nil {
113+
114+
overwriteDefault := user_model.CreateUserOverwriteOptions{
115+
IsActive: util.OptionalBoolTrue,
116+
}
117+
118+
if err := user_model.CreateUser(user, &overwriteDefault); err != nil {
114119
// FIXME: should I create a system notice?
115120
log.Error("CreateUser: %v", err)
116121
return nil

‎services/auth/source/ldap/source_authenticate.go

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"code.gitea.io/gitea/models/auth"
1313
"code.gitea.io/gitea/models/db"
1414
user_model "code.gitea.io/gitea/models/user"
15+
"code.gitea.io/gitea/modules/util"
1516
"code.gitea.io/gitea/services/mailer"
1617
user_service "code.gitea.io/gitea/services/user"
1718
)
@@ -80,19 +81,21 @@ func (source *Source) Authenticate(user *user_model.User, userName, password str
8081
}
8182

8283
user = &user_model.User{
83-
LowerName: strings.ToLower(sr.Username),
84-
Name: sr.Username,
85-
FullName: composeFullName(sr.Name, sr.Surname, sr.Username),
86-
Email: sr.Mail,
87-
LoginType: source.authSource.Type,
88-
LoginSource: source.authSource.ID,
89-
LoginName: userName,
90-
IsActive: true,
91-
IsAdmin: sr.IsAdmin,
92-
IsRestricted: sr.IsRestricted,
84+
LowerName: strings.ToLower(sr.Username),
85+
Name: sr.Username,
86+
FullName: composeFullName(sr.Name, sr.Surname, sr.Username),
87+
Email: sr.Mail,
88+
LoginType: source.authSource.Type,
89+
LoginSource: source.authSource.ID,
90+
LoginName: userName,
91+
IsAdmin: sr.IsAdmin,
92+
}
93+
overwriteDefault := &user_model.CreateUserOverwriteOptions{
94+
IsRestricted: util.OptionalBoolOf(sr.IsRestricted),
95+
IsActive: util.OptionalBoolTrue,
9396
}
9497

95-
err := user_model.CreateUser(user)
98+
err := user_model.CreateUser(user, overwriteDefault)
9699
if err != nil {
97100
return user, err
98101
}

0 commit comments

Comments
 (0)