Skip to content

Commit a229e34

Browse files
65436543
authored
Allow only internal registration (#15795)
* Add ALLOW_ONLY_INTERNAL_REGISTRATION into settings * OpenID respect setting too
1 parent e818e91 commit a229e34

File tree

9 files changed

+30
-8
lines changed

9 files changed

+30
-8
lines changed

‎custom/conf/app.example.ini

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -659,6 +659,8 @@ EMAIL_DOMAIN_WHITELIST =
659659
EMAIL_DOMAIN_BLOCKLIST =
660660
; Disallow registration, only allow admins to create accounts.
661661
DISABLE_REGISTRATION = false
662+
; Allow registration only using gitea itself, it works only when DISABLE_REGISTRATION is false
663+
ALLOW_ONLY_INTERNAL_REGISTRATION = false
662664
; Allow registration only using third-party services, it works only when DISABLE_REGISTRATION is false
663665
ALLOW_ONLY_EXTERNAL_REGISTRATION = false
664666
; User must sign in to view anything.

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,7 @@ relation to port exhaustion.
497497
- `AUTO_WATCH_ON_CHANGES`: **false**: Enable this to make users watch a repository after their first commit to it
498498
- `DEFAULT_ORG_VISIBILITY`: **public**: Set default visibility mode for organisations, either "public", "limited" or "private".
499499
- `DEFAULT_ORG_MEMBER_VISIBLE`: **false** True will make the membership of the users visible when added to the organisation.
500+
- `ALLOW_ONLY_INTERNAL_REGISTRATION`: **false** Set to true to force registration only via gitea.
500501
- `ALLOW_ONLY_EXTERNAL_REGISTRATION`: **false** Set to true to force registration only using third-party services.
501502
- `NO_REPLY_ADDRESS`: **noreply.DOMAIN** Value for the domain part of the user's email address in the git log if user has set KeepEmailPrivate to true. DOMAIN resolves to the value in server.DOMAIN.
502503
The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS.

‎modules/setting/service.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ var Service struct {
2323
EmailDomainWhitelist []string
2424
EmailDomainBlocklist []string
2525
DisableRegistration bool
26+
AllowOnlyInternalRegistration bool
2627
AllowOnlyExternalRegistration bool
2728
ShowRegistrationButton bool
2829
ShowMilestonesDashboardPage bool
@@ -73,7 +74,12 @@ func newService() {
7374
Service.ActiveCodeLives = sec.Key("ACTIVE_CODE_LIVE_MINUTES").MustInt(180)
7475
Service.ResetPwdCodeLives = sec.Key("RESET_PASSWD_CODE_LIVE_MINUTES").MustInt(180)
7576
Service.DisableRegistration = sec.Key("DISABLE_REGISTRATION").MustBool()
77+
Service.AllowOnlyInternalRegistration = sec.Key("ALLOW_ONLY_INTERNAL_REGISTRATION").MustBool()
7678
Service.AllowOnlyExternalRegistration = sec.Key("ALLOW_ONLY_EXTERNAL_REGISTRATION").MustBool()
79+
if Service.AllowOnlyExternalRegistration && Service.AllowOnlyInternalRegistration {
80+
log.Warn("ALLOW_ONLY_INTERNAL_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are true - disabling registration")
81+
Service.DisableRegistration = true
82+
}
7783
if !sec.Key("REGISTER_EMAIL_CONFIRM").MustBool() {
7884
Service.RegisterManualConfirm = sec.Key("REGISTER_MANUAL_CONFIRM").MustBool(false)
7985
} else {

‎options/locale/locale_en-US.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2412,6 +2412,7 @@ config.db_path = Path
24122412
config.service_config = Service Configuration
24132413
config.register_email_confirm = Require Email Confirmation to Register
24142414
config.disable_register = Disable Self-Registration
2415+
config.allow_only_internal_registration = Allow Registration Only Through Gitea itself
24152416
config.allow_only_external_registration = Allow Registration Only Through External Services
24162417
config.enable_openid_signup = Enable OpenID Self-Registration
24172418
config.enable_openid_signin = Enable OpenID Sign-In

‎routers/user/auth.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,7 @@ func SignInOAuthCallback(ctx *context.Context) {
617617
}
618618

619619
if u == nil {
620-
if setting.OAuth2Client.EnableAutoRegistration {
620+
if !(setting.Service.DisableRegistration || setting.Service.AllowOnlyInternalRegistration) && setting.OAuth2Client.EnableAutoRegistration {
621621
// create new user with details from oauth2 provider
622622
var missingFields []string
623623
if gothUser.UserID == "" {
@@ -828,6 +828,7 @@ func LinkAccount(ctx *context.Context) {
828828
ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey
829829
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
830830
ctx.Data["DisableRegistration"] = setting.Service.DisableRegistration
831+
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
831832
ctx.Data["ShowRegistrationButton"] = false
832833

833834
// use this to set the right link into the signIn and signUp templates in the link_account template
@@ -993,7 +994,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
993994
return
994995
}
995996

996-
if setting.Service.DisableRegistration {
997+
if setting.Service.DisableRegistration || setting.Service.AllowOnlyInternalRegistration {
997998
ctx.Error(http.StatusForbidden)
998999
return
9991000
}

‎routers/user/auth_openid.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ func signInOpenIDVerify(ctx *context.Context) {
249249
log.Error("signInOpenIDVerify: Unable to save changes to the session: %v", err)
250250
}
251251

252-
if u != nil || !setting.Service.EnableOpenIDSignUp {
252+
if u != nil || !setting.Service.EnableOpenIDSignUp || setting.Service.AllowOnlyInternalRegistration {
253253
ctx.Redirect(setting.AppSubURL + "/user/openid/connect")
254254
} else {
255255
ctx.Redirect(setting.AppSubURL + "/user/openid/register")
@@ -267,6 +267,7 @@ func ConnectOpenID(ctx *context.Context) {
267267
ctx.Data["PageIsSignIn"] = true
268268
ctx.Data["PageIsOpenIDConnect"] = true
269269
ctx.Data["EnableOpenIDSignUp"] = setting.Service.EnableOpenIDSignUp
270+
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
270271
ctx.Data["OpenID"] = oid
271272
userName, _ := ctx.Session.Get("openid_determined_username").(string)
272273
if userName != "" {
@@ -328,6 +329,7 @@ func RegisterOpenID(ctx *context.Context) {
328329
ctx.Data["PageIsSignIn"] = true
329330
ctx.Data["PageIsOpenIDRegister"] = true
330331
ctx.Data["EnableOpenIDSignUp"] = setting.Service.EnableOpenIDSignUp
332+
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
331333
ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha
332334
ctx.Data["Captcha"] = context.GetImageCaptcha()
333335
ctx.Data["CaptchaType"] = setting.Service.CaptchaType
@@ -367,6 +369,11 @@ func RegisterOpenIDPost(ctx *context.Context) {
367369
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
368370
ctx.Data["OpenID"] = oid
369371

372+
if setting.Service.AllowOnlyInternalRegistration {
373+
ctx.Error(http.StatusForbidden)
374+
return
375+
}
376+
370377
if setting.Service.EnableCaptcha {
371378
var valid bool
372379
var err error

‎templates/admin/config.tmpl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@
149149
<dd>{{if .Service.RegisterEmailConfirm}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
150150
<dt>{{.i18n.Tr "admin.config.disable_register"}}</dt>
151151
<dd>{{if .Service.DisableRegistration}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
152+
<dt>{{.i18n.Tr "admin.config.allow_only_internal_registration"}}</dt>
153+
<dd>{{if .Service.AllowOnlyInternalRegistration}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
152154
<dt>{{.i18n.Tr "admin.config.allow_only_external_registration"}}</dt>
153155
<dd>{{if .Service.AllowOnlyExternalRegistration}}{{svg "octicon-check"}}{{else}}{{svg "octicon-x"}}{{end}}</dd>
154156
<dt>{{.i18n.Tr "admin.config.show_registration_button"}}</dt>

‎templates/user/auth/link_account.tmpl

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33
<div class="ui secondary pointing tabular top attached borderless menu new-menu navbar">
44
<div class="new-menu-inner">
55
<!-- TODO handle .ShowRegistrationButton once other login bugs are fixed -->
6-
<a class="item {{if not .user_exists}}active{{end}}"
7-
data-tab="auth-link-signup-tab">
8-
{{.i18n.Tr "auth.oauth_signup_tab"}}
9-
</a>
6+
{{if not .AllowOnlyInternalRegistration}}
7+
<a class="item {{if not .user_exists}}active{{end}}"
8+
data-tab="auth-link-signup-tab">
9+
{{.i18n.Tr "auth.oauth_signup_tab"}}
10+
</a>
11+
{{end}}
1012
<a class="item {{if .user_exists}}active{{end}}"
1113
data-tab="auth-link-signin-tab">
1214
{{.i18n.Tr "auth.oauth_signin_tab"}}

‎templates/user/auth/signup_openid_navbar.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<a class="{{if .PageIsOpenIDConnect}}active{{end}} item" href="{{AppSubUrl}}/user/openid/connect">
44
{{.i18n.Tr "auth.openid_connect_title"}}
55
</a>
6-
{{if .EnableOpenIDSignUp}}
6+
{{if and .EnableOpenIDSignUp (not .AllowOnlyInternalRegistration)}}
77
<a class="{{if .PageIsOpenIDRegister}}active{{end}} item" href="{{AppSubUrl}}/user/openid/register">
88
{{.i18n.Tr "auth.openid_register_title"}}
99
</a>

0 commit comments

Comments
 (0)