Skip to content

Commit eca3563

Browse files
pboguslawskipboguslawski
committed
DISABLE_LOCAL_USER_MANAGEMENT mode added
This patch blocks access to local user management options that are not required and possibly problematic in scenario when users are managed in external database (like LDAP) and should not be managed separately in gitea. Options specific to gitea (like restricted users) are still managed in this app. Author-Change-Id: IB#1105051
1 parent 795b75e commit eca3563

File tree

15 files changed

+175
-31
lines changed

15 files changed

+175
-31
lines changed

‎models/user.go

Lines changed: 39 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1126,7 +1126,43 @@ func checkDupEmail(e Engine, u *User) error {
11261126
return nil
11271127
}
11281128

1129+
// updateUserAllowed is used to block updating selected user fields when local user managemement is disabled.
1130+
func updateUserAllowed(u *User) error {
1131+
// Don't allow changes of selected user fields if local user management is disabled.
1132+
if setting.Service.DisableLocalUserManagement {
1133+
if currUser, err := GetUserByID(u.ID); err == nil {
1134+
if currUser.Name != u.Name {
1135+
return fmt.Errorf("cannot change user %s username; local user management disabled", u.Name)
1136+
}
1137+
if (currUser.LoginSource != u.LoginSource) || (currUser.LoginName != u.LoginName) {
1138+
return fmt.Errorf("cannot change user %s login; local user management disabled", u.Name)
1139+
}
1140+
if currUser.FullName != u.FullName {
1141+
return fmt.Errorf("cannot change user %s full name; local user management disabled", u.Name)
1142+
}
1143+
if currUser.Email != u.Email {
1144+
return fmt.Errorf("cannot change user %s e-mail; local user management disabled", u.Name)
1145+
}
1146+
if (currUser.Passwd != u.Passwd) || (currUser.PasswdHashAlgo != u.PasswdHashAlgo) {
1147+
return fmt.Errorf("cannot change user %s password; local user management disabled", u.Name)
1148+
}
1149+
if currUser.IsActive != u.IsActive {
1150+
return fmt.Errorf("cannot change user %s activity; local user management disabled", u.Name)
1151+
}
1152+
if currUser.IsAdmin != u.IsAdmin {
1153+
return fmt.Errorf("cannot change user %s admin permission; local user management disabled", u.Name)
1154+
}
1155+
} else {
1156+
return err
1157+
}
1158+
}
1159+
return nil
1160+
}
1161+
11291162
func updateUser(e Engine, u *User) error {
1163+
if err := updateUserAllowed(u); err != nil {
1164+
return err
1165+
}
11301166
_, err := e.ID(u.ID).AllCols().Update(u)
11311167
return err
11321168
}
@@ -1142,30 +1178,15 @@ func UpdateUserCols(u *User, cols ...string) error {
11421178
}
11431179

11441180
func updateUserCols(e Engine, u *User, cols ...string) error {
1181+
if err := updateUserAllowed(u); err != nil {
1182+
return err
1183+
}
11451184
_, err := e.ID(u.ID).Cols(cols...).Update(u)
11461185
return err
11471186
}
11481187

11491188
// UpdateUserSetting updates user's settings.
11501189
func UpdateUserSetting(u *User) error {
1151-
1152-
// Don't allow username, fullname nor email changes if local user management is disabled.
1153-
if setting.Service.DisableLocalUserManagement {
1154-
if currUser, err := GetUserByID(u.ID); err == nil {
1155-
if currUser.Name != u.Name {
1156-
return fmt.Errorf("cannot change %s username; local user management disabled", u.Name)
1157-
}
1158-
if currUser.FullName != u.FullName {
1159-
return fmt.Errorf("cannot change %s full name; local user management disabled", u.Name)
1160-
}
1161-
if currUser.Email != u.Email {
1162-
return fmt.Errorf("cannot change %s e-mail; local user management disabled", u.Name)
1163-
}
1164-
} else {
1165-
return err
1166-
}
1167-
}
1168-
11691190
if !u.IsOrganization() {
11701191
if err := checkDupEmail(x, u); err != nil {
11711192
return err

‎routers/admin/admin.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ func Dashboard(ctx *context.Context) {
127127
ctx.Data["Title"] = ctx.Tr("admin.dashboard")
128128
ctx.Data["PageIsAdmin"] = true
129129
ctx.Data["PageIsAdminDashboard"] = true
130+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
130131
ctx.Data["Stats"] = models.GetStatistic()
131132
// FIXME: update periodically
132133
updateSystemStatus()
@@ -139,6 +140,7 @@ func DashboardPost(ctx *context.Context, form auth.AdminDashboardForm) {
139140
ctx.Data["Title"] = ctx.Tr("admin.dashboard")
140141
ctx.Data["PageIsAdmin"] = true
141142
ctx.Data["PageIsAdminDashboard"] = true
143+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
142144
ctx.Data["Stats"] = models.GetStatistic()
143145
updateSystemStatus()
144146
ctx.Data["SysStatus"] = sysStatus
@@ -235,6 +237,7 @@ func Config(ctx *context.Context) {
235237
ctx.Data["Title"] = ctx.Tr("admin.config")
236238
ctx.Data["PageIsAdmin"] = true
237239
ctx.Data["PageIsAdminConfig"] = true
240+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
238241

239242
ctx.Data["CustomConf"] = setting.CustomConf
240243
ctx.Data["AppUrl"] = setting.AppURL
@@ -325,6 +328,7 @@ func Monitor(ctx *context.Context) {
325328
ctx.Data["Title"] = ctx.Tr("admin.monitor")
326329
ctx.Data["PageIsAdmin"] = true
327330
ctx.Data["PageIsAdminMonitor"] = true
331+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
328332
ctx.Data["Processes"] = process.GetManager().Processes()
329333
ctx.Data["Entries"] = cron.ListTasks()
330334
ctx.Data["Queues"] = queue.GetManager().ManagedQueues()

‎routers/admin/auths.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ func Authentications(ctx *context.Context) {
4040
ctx.Data["PageIsAdmin"] = true
4141
ctx.Data["PageIsAdminAuthentications"] = true
4242

43+
// No access to this page if local user management is disabled.
44+
if setting.Service.DisableLocalUserManagement {
45+
ctx.ServerError("Authentications", fmt.Errorf("access to /admin/auths page denied; local user management disabled"))
46+
return
47+
}
48+
4349
var err error
4450
ctx.Data["Sources"], err = models.LoginSources()
4551
if err != nil {
@@ -96,6 +102,12 @@ func NewAuthSource(ctx *context.Context) {
96102
ctx.Data["SSPISeparatorReplacement"] = "_"
97103
ctx.Data["SSPIDefaultLanguage"] = ""
98104

105+
// No access to this page if local user management is disabled.
106+
if setting.Service.DisableLocalUserManagement {
107+
ctx.ServerError("NewAuthSource", fmt.Errorf("access to /admin/auths/new page denied; local user management disabled"))
108+
return
109+
}
110+
99111
// only the first as default
100112
for key := range models.OAuth2Providers {
101113
ctx.Data["oauth2_provider"] = key
@@ -218,6 +230,12 @@ func NewAuthSourcePost(ctx *context.Context, form auth.AuthenticationForm) {
218230
ctx.Data["SSPISeparatorReplacement"] = "_"
219231
ctx.Data["SSPIDefaultLanguage"] = ""
220232

233+
// Don't allow to create auth source if local user management is disabled.
234+
if setting.Service.DisableLocalUserManagement {
235+
ctx.ServerError("NewAuthSourcePost", fmt.Errorf("cannot create auth source; local user management disabled"))
236+
return
237+
}
238+
221239
hasTLS := false
222240
var config convert.Conversion
223241
switch models.LoginType(form.Type) {
@@ -290,6 +308,12 @@ func EditAuthSource(ctx *context.Context) {
290308
ctx.Data["OAuth2Providers"] = models.OAuth2Providers
291309
ctx.Data["OAuth2DefaultCustomURLMappings"] = models.OAuth2DefaultCustomURLMappings
292310

311+
// No access to this page if local user management is disabled.
312+
if setting.Service.DisableLocalUserManagement {
313+
ctx.ServerError("EditAuthSource", fmt.Errorf("access to /admin/auths page denied; local user management disabled"))
314+
return
315+
}
316+
293317
source, err := models.GetLoginSourceByID(ctx.ParamsInt64(":authid"))
294318
if err != nil {
295319
ctx.ServerError("GetLoginSourceByID", err)
@@ -314,6 +338,12 @@ func EditAuthSourcePost(ctx *context.Context, form auth.AuthenticationForm) {
314338
ctx.Data["OAuth2Providers"] = models.OAuth2Providers
315339
ctx.Data["OAuth2DefaultCustomURLMappings"] = models.OAuth2DefaultCustomURLMappings
316340

341+
// Don't allow to update auth source if local user management is disabled.
342+
if setting.Service.DisableLocalUserManagement {
343+
ctx.ServerError("EditAuthSourcePost", fmt.Errorf("cannot update auth source; local user management disabled"))
344+
return
345+
}
346+
317347
source, err := models.GetLoginSourceByID(ctx.ParamsInt64(":authid"))
318348
if err != nil {
319349
ctx.ServerError("GetLoginSourceByID", err)

‎routers/admin/emails.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package admin
66

77
import (
88
"bytes"
9+
"fmt"
910
"net/url"
1011

1112
"code.gitea.io/gitea/models"
@@ -28,6 +29,12 @@ func Emails(ctx *context.Context) {
2829
ctx.Data["PageIsAdmin"] = true
2930
ctx.Data["PageIsAdminEmails"] = true
3031

32+
// No access to this page if local user management is disabled.
33+
if setting.Service.DisableLocalUserManagement {
34+
ctx.ServerError("Emails", fmt.Errorf("access to /admin/emails page denied; local user management disabled"))
35+
return
36+
}
37+
3138
opts := &models.SearchEmailOptions{
3239
ListOptions: models.ListOptions{
3340
PageSize: setting.UI.Admin.UserPagingNum,
@@ -112,6 +119,12 @@ func isKeywordValid(keyword string) bool {
112119
// ActivateEmail serves a POST request for activating/deactivating a user's email
113120
func ActivateEmail(ctx *context.Context) {
114121

122+
// Don't allow to activate/deactivate emails if local user management is disabled.
123+
if setting.Service.DisableLocalUserManagement {
124+
ctx.ServerError("ActivateEmail", fmt.Errorf("cannot activate email; local user management disabled"))
125+
return
126+
}
127+
115128
truefalse := map[string]bool{"1": true, "0": false}
116129

117130
uid := com.StrTo(ctx.Query("uid")).MustInt64()

‎routers/admin/hooks.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ const (
2020
func DefaultOrSystemWebhooks(ctx *context.Context) {
2121
var ws []*models.Webhook
2222
var err error
23+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
2324

2425
// Are we looking at default webhooks?
2526
if ctx.Params(":configType") == "hooks" {

‎routers/admin/notice.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ func Notices(ctx *context.Context) {
2424
ctx.Data["Title"] = ctx.Tr("admin.notices")
2525
ctx.Data["PageIsAdmin"] = true
2626
ctx.Data["PageIsAdminNotices"] = true
27+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
2728

2829
total := models.CountNotices()
2930
page := ctx.QueryInt("page")

‎routers/admin/orgs.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ func Organizations(ctx *context.Context) {
2323
ctx.Data["Title"] = ctx.Tr("admin.organizations")
2424
ctx.Data["PageIsAdmin"] = true
2525
ctx.Data["PageIsAdminOrganizations"] = true
26+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
2627

2728
routers.RenderUserSearch(ctx, &models.SearchUserOptions{
2829
Type: models.UserTypeOrganization,

‎routers/admin/repos.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ func Repos(ctx *context.Context) {
2828
ctx.Data["Title"] = ctx.Tr("admin.repositories")
2929
ctx.Data["PageIsAdmin"] = true
3030
ctx.Data["PageIsAdminRepositories"] = true
31+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
3132

3233
routers.RenderRepoSearch(ctx, &routers.RepoSearchOptions{
3334
Private: true,

‎routers/admin/users.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
package admin
77

88
import (
9+
"fmt"
910
"strings"
1011

1112
"code.gitea.io/gitea/models"
@@ -32,6 +33,7 @@ func Users(ctx *context.Context) {
3233
ctx.Data["Title"] = ctx.Tr("admin.users")
3334
ctx.Data["PageIsAdmin"] = true
3435
ctx.Data["PageIsAdminUsers"] = true
36+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
3537

3638
routers.RenderUserSearch(ctx, &models.SearchUserOptions{
3739
Type: models.UserTypeIndividual,
@@ -50,6 +52,12 @@ func NewUser(ctx *context.Context) {
5052

5153
ctx.Data["login_type"] = "0-0"
5254

55+
// No access to this page if local user management is disabled.
56+
if setting.Service.DisableLocalUserManagement {
57+
ctx.ServerError("NewUser", fmt.Errorf("access to /admin/users/new page denied; local user management disabled"))
58+
return
59+
}
60+
5361
sources, err := models.LoginSources()
5462
if err != nil {
5563
ctx.ServerError("LoginSources", err)
@@ -67,6 +75,12 @@ func NewUserPost(ctx *context.Context, form auth.AdminCreateUserForm) {
6775
ctx.Data["PageIsAdmin"] = true
6876
ctx.Data["PageIsAdminUsers"] = true
6977

78+
// Don't allow to create users if local user management is disabled.
79+
if setting.Service.DisableLocalUserManagement {
80+
ctx.ServerError("NewUserPost", fmt.Errorf("cannot create new user; local user management disabled"))
81+
return
82+
}
83+
7084
sources, err := models.LoginSources()
7185
if err != nil {
7286
ctx.ServerError("LoginSources", err)
@@ -188,6 +202,7 @@ func EditUser(ctx *context.Context) {
188202
ctx.Data["PageIsAdmin"] = true
189203
ctx.Data["PageIsAdminUsers"] = true
190204
ctx.Data["DisableRegularOrgCreation"] = setting.Admin.DisableRegularOrgCreation
205+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
191206

192207
prepareUserInfo(ctx)
193208
if ctx.Written() {
@@ -202,6 +217,7 @@ func EditUserPost(ctx *context.Context, form auth.AdminEditUserForm) {
202217
ctx.Data["Title"] = ctx.Tr("admin.users.edit_account")
203218
ctx.Data["PageIsAdmin"] = true
204219
ctx.Data["PageIsAdminUsers"] = true
220+
ctx.Data["DisableLocalUserManagement"] = setting.Service.DisableLocalUserManagement
205221

206222
u := prepareUserInfo(ctx)
207223
if ctx.Written() {
@@ -226,6 +242,11 @@ func EditUserPost(ctx *context.Context, form auth.AdminEditUserForm) {
226242

227243
if len(form.Password) > 0 {
228244
var err error
245+
// Don't allow password changes if local user management is disabled.
246+
//if setting.Service.DisableLocalUserManagement {
247+
//ctx.ServerError("UpdateUser", fmt.Errorf("cannot change %s password; local user management disabled", u.Name))
248+
//return
249+
//}
229250
if len(form.Password) < setting.MinPasswordLength {
230251
ctx.Data["Err_Password"] = true
231252
ctx.RenderWithErr(ctx.Tr("auth.password_too_short", setting.MinPasswordLength), tplUserEdit, &form)

0 commit comments

Comments
 (0)