Private "pages" repos visible through *.codeberg.page #362

yuni commented 2020年12月11日 19:57:47 +01:00

Hi, first of all thank you for this service :)

When I found out about the codeberg.page feature through your blog, I was curious to see what my own pages at https://hut.codeberg.page would look like. I expected an error message, or nothing at all, since I didn't set up anything. What I found was a private repository of mine, which was coincidentally called "pages", exposed to the public.

I would very much appreciate if codeberg.page would respect the privacy of a repository, since:

• The general expectation of setting a repository to private is that it becomes inaccessible to the public
• If I had not stumbled on the codeberg.page feature, I would never be aware of this privacy leak

Hi, first of all thank you for this service :) When I found out about the codeberg.page feature through your blog, I was curious to see what my own pages at https://hut.codeberg.page would look like. I expected an error message, or nothing at all, since I didn't set up anything. What I found was a private repository of mine, which was coincidentally called "pages", exposed to the public. I would very much appreciate if codeberg.page would respect the privacy of a repository, since: - The general expectation of setting a repository to private is that it becomes inaccessible to the public - If I had not stumbled on the codeberg.page feature, I would never be aware of this privacy leak

hw commented 2020年12月12日 18:46:03 +01:00

pages/index.php would need to query repo status via API or SQL, if this is desired behavior. PR welcome

pages/index.php would need to query repo status via API or SQL, if this is desired behavior. PR welcome

ashimokawa commented 2020年12月12日 19:01:21 +01:00

I think we should keep the current behavior.
pages being private has an effect - the history and contributors are not browsable. But pages means "serve it".

I think we should keep the current behavior. pages being private has an effect - the history and contributors are not browsable. But pages means "serve it".

techknowlogick commented 2020年12月12日 19:25:40 +01:00

pages being private has an effect - the history and contributors are not browsable. But pages means "serve it".

Perhaps we use custom templates and check if repo name == "pages" then a notice is shown with a link to pages docs and that it is public (IIRC Github has something like this in their settings), happy to add a PR for this if the approach is supported.

> pages being private has an effect - the history and contributors are not browsable. But pages means "serve it". Perhaps we use custom templates and check `if repo name == "pages"` then a notice is shown with a link to pages docs and that it is public (IIRC Github has something like this in their settings), happy to add a PR for this if the approach is supported.

ashimokawa commented 2020年12月12日 19:31:36 +01:00

@techknowlogick

That would be my preferred approach, yes ;)

@techknowlogick That would be my preferred approach, yes ;)

hw commented 2020年12月13日 13:50:25 +01:00

Yes, this sounds good.

Yes, this sounds good.

techknowlogick commented 2020年12月14日 04:05:18 +01:00

PR found here: Codeberg/build-deploy-gitea#48

I made an assumption that the added conditional was correct please deploy it to the test instance first and verify change there.

PR found here: https://codeberg.org/Codeberg/build-deploy-gitea/pulls/48 I made an assumption that the added conditional was correct please deploy it to the test instance first and verify change there.

hw commented 2020年12月14日 06:43:17 +01:00

merged and deployed to https://codeberg-test.org

merged and deployed to https://codeberg-test.org

techknowlogick commented 2020年12月14日 16:30:07 +01:00

I can confirm the notice displays as expected when the repo name == pages, and status==private.

One test case that fails is when reponame is not all lowercase, but this PR is still a net positive.

I can confirm the notice displays as expected when the repo name == pages, and status==private. One test case that fails is when reponame is not all lowercase, but this PR is still a net positive.

hw commented 2020年12月14日 21:23:53 +01:00

Cool, thank you! Can we do case-insensitive checks in template language?

Cool, thank you! Can we do case-insensitive checks in template language?

techknowlogick commented 2020年12月14日 21:46:34 +01:00

Cool, thank you! Can we do case-insensitive checks in template language?

I suspect if we reference .LowerName instead of just .Name in the conditional then that'd work, but I am away from my development machine to test.

> Cool, thank you! Can we do case-insensitive checks in template language? I suspect if we reference .LowerName instead of just .Name in the conditional then that'd work, but I am away from my development machine to test.

hw commented 2020年12月14日 21:58:55 +01:00

.LowerName change deployed to https://codeberg-test.org

.LowerName change deployed to https://codeberg-test.org

techknowlogick commented 2020年12月14日 22:47:46 +01:00

.LowerName change deployed to https://codeberg-test.org

Fantastic. Thanks @hw :) Works as expected

> .LowerName change deployed to https://codeberg-test.org Fantastic. Thanks @hw :) Works as expected

ashimokawa commented 2020年12月15日 08:15:45 +01:00

So shall we deploy on production?

So shall we deploy on production?