search

go-gitea / gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
https://gitea.com
MIT License
43.98k stars 5.4k forks source link

Block command line pushes that expose a personal email address #31255

Open MrMeeb opened 3 months ago

MrMeeb commented 3 months ago

Feature Description

With the use of DEFAULT_KEEP_EMAIL_PRIVATE, any actions done on Gitea web will automatically obscure a user's email address. The same protection is not in place when a user is working locally on a project and committing to the Gitea remote via CLI. If the user is unfamiliar with git, this can lead to them pushing commits to Gitea with their private email address, undermining the email privacy feature. Fixing this later is painful, since the git log is then full of the user's private email address (ask me how I know...)

GitHub has overcome this problem by blocking commits when the author email in the commit matches the email associated with your GitHub account (https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/blocking-command-line-pushes-that-expose-your-personal-email-address). This would be a useful addition to Gitea as well.

Same as DEFAULT_KEEP_EMAIL_PRIVATE, I think this should be globally and user configurable.

Screenshots

image

MrMeeb commented 3 months ago

This was sort of mentioned in #21273, but not the primary focus of the issue.

jolheiser commented 3 months ago

Some prior art: https://github.com/go-gitea/gitea/pull/14686

That PR is fairly old and likely doesn't apply cleanly, but there may still be something of value to it. :slightly_smiling_face:

MrMeeb commented 3 months ago

Thank you. I have zero experience with contributing to open source, or working in Go. Generally I have pretty limited coding experience beyond bash. I think with that in mind, me trying to cobble together a solution would not be to the desired quality, but the FR is there if anyone else takes an interest as you did before.