Only use supported sort order for "explore/users" page #29430

wxiaoguang · 2024-02-26T17:17:47Z

Thanks to inferenceus : some sort orders on the "explore/users" page could list users by their lastlogintime/updatetime.

It leaks user's activity unintentionally. This PR makes that page only use "supported" sort orders.

Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help.

tests/integration/explore_user_test.go

routers/web/explore/user.go

zokkis · 2024-02-26T21:40:22Z

routers/web/explore/user.go

 		ctx.Data["SortType"] = "recentupdate"
 		orderBy = "`user`.updated_unix DESC"
 	}

+	if opts.SupportedSortOrders != nil && !opts.SupportedSortOrders.Contains(sortOrder) {
+		ctx.NotFound("unsupported sort order", nil)


https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400
Should be better?

I agree to use it, but at the moment Gitea doesn't have the ability to render such a page .....

It needs other framework-level refacotring first.

zokkis · 2024-02-26T21:41:25Z

And maybe extends the supportedSortOrders to all for admins?

delvh

I still think that

unsupported search params should simply ignore the param instead of throwing a 404
the test is prone to fail once we refactor the templates

However, these changes are not important enough to warrant not giving an LGTM.

silverwind · 2024-02-26T22:20:14Z

unsupported search params should simply ignore the param instead of throwing a 404

Agree, I also design API's to just ignore unknown search params. We should do whatever is consistent with existing APIs.

One problem with param validation on APIs is that if you remove a previously known param, you have broken the API. This is also why things like JSON Schema by default allows additional properties to be present, they don't hurt.

delvh · 2024-02-26T22:22:28Z

Not only because of consistency, imagine a user that enters a URL manually and fatfingers for some reason.
At the moment, they'll receive a 404 instead of what they wanted in a different sorting.

silverwind · 2024-02-26T22:29:09Z

Yeah, additional params could in theory even be introduced by systems outside our control. I think some analytic engines like google like to append tracking params to URLs, assuming the destination will just ignore them.

wxiaoguang · 2024-02-27T02:36:46Z

This change is not ideal enough. But I would like to keep it as-is to make it easier to backport.

I think we can propose new improvements later. Actually the "RenderUser" related code was much too over-abstracted and there are various problems in it. Sooner or later it would be refactored.

GiteaBot · 2024-02-27T07:12:36Z

@wxiaoguang please fix the merge conflicts. 🍵

# Conflicts: # routers/web/explore/org.go # routers/web/explore/user.go

GiteaBot · 2024-02-27T09:10:57Z

I was unable to create a backport for 1.21. @wxiaoguang, please send one manually. 🍵

go run ./contrib/backport 29430
...  // fix git conflicts if any
go run ./contrib/backport --continue

Thanks to inferenceus : some sort orders on the "explore/users" page could list users by their lastlogintime/updatetime. It leaks user's activity unintentionally. This PR makes that page only use "supported" sort orders. Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help. ![image](https://github.com/go-gitea/gitea/assets/2114189/ce5c39c1-1e86-484a-80c3-33cac6419af8) # Conflicts: # routers/web/explore/org.go # routers/web/explore/user.go

* giteaofficial/main: (23 commits) Fix wrong test usage of `AppSubURL` (go-gitea#29459) Improve contrast on blame timestamp, fix double border (go-gitea#29482) Fix/Improve `processWindowErrorEvent` (go-gitea#29407) Apply compact padding to small buttons with svg icons (go-gitea#29471) Fix counter display number incorrectly displayed on the page (go-gitea#29448) Fix incorrect user location link on profile page (go-gitea#29474) Fix workflow trigger event bugs (go-gitea#29467) Fix URL calculation in clone input box (go-gitea#29470) Remove jQuery from the "find file" page (go-gitea#29456) Move generate from module to service (go-gitea#29465) The job should always run when `if` is `always()` (go-gitea#29464) Recolor dark theme to blue shade (go-gitea#29283) Let ctx.FormOptionalBool() return optional.Option[bool] (go-gitea#29461) Implement actions badge svgs (go-gitea#28102) Fix missed return (go-gitea#29450) Use tailwind instead of `gt-[wh]-` helper classes (go-gitea#29423) Lock issues and pulls faster (go-gitea#29436) Allow to change primary email before account activation (go-gitea#29412) Update docs about `DEFAULT_ACTIONS_URL` (go-gitea#29442) Only use supported sort order for "explore/users" page (go-gitea#29430) ...

Backport #29430 Thanks to inferenceus : some sort orders on the "explore/users" page could list users by their lastlogintime/updatetime. It leaks user's activity unintentionally. This PR makes that page only use "supported" sort orders. Removing the "sort orders" could also be a good solution, while IMO at the moment keeping the "create time" and "name" orders is also fine, in case some users would like to find a target user in the search result, the "sort order" might help.

6543 · 2024-10-28T16:50:32Z

routers/web/explore/org.go

+	)
+	sortOrder := ctx.FormString("sort")
+	if sortOrder == "" {
+		sortOrder = "newest"


setting.UI.ExploreDefaultSort is not respected anymore!!!

fix

7c2cb4b

wxiaoguang added the type/enhancement An improvement of existing functionality label Feb 26, 2024

wxiaoguang added this to the 1.22.0 milestone Feb 26, 2024

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Feb 26, 2024

pull-request-size bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 26, 2024

wxiaoguang mentioned this pull request Feb 26, 2024

User (public visibility) login can be listed on the "explore user" page by "Recently Updated" #29425

Closed

rearrange NotFound call

f6b68be

wxiaoguang force-pushed the fix-explore-user branch from bf83a41 to f6b68be Compare February 26, 2024 17:33

delvh reviewed Feb 26, 2024

View reviewed changes

tests/integration/explore_user_test.go Outdated Show resolved Hide resolved

tests/integration/explore_user_test.go Outdated Show resolved Hide resolved

routers/web/explore/user.go Show resolved Hide resolved

fix org, rewrite tests

7b996ca

silverwind approved these changes Feb 26, 2024

View reviewed changes

GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Feb 26, 2024

wxiaoguang added the backport/v1.21 This PR should be backported to Gitea 1.21 label Feb 26, 2024

zokkis reviewed Feb 26, 2024

View reviewed changes

delvh approved these changes Feb 26, 2024

View reviewed changes

GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Feb 26, 2024

wxiaoguang added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 27, 2024

Merge branch 'main' into fix-explore-user

e0276a8

lunny approved these changes Feb 27, 2024

View reviewed changes

wxiaoguang added type/bug and removed type/enhancement An improvement of existing functionality labels Feb 27, 2024

Merge branch 'main' into fix-explore-user

ef01b74

GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Feb 27, 2024

wxiaoguang mentioned this pull request Feb 27, 2024

Filter Repositories by type #29231

Merged

Merge branch 'main' into fix-explore-user

3277a6e

# Conflicts: # routers/web/explore/org.go # routers/web/explore/user.go

lunny merged commit eedb8f4 into go-gitea:main Feb 27, 2024
26 checks passed

GiteaBot added the backport/manual No power to the bots! Create your backport yourself! label Feb 27, 2024

wxiaoguang deleted the fix-explore-user branch February 27, 2024 09:14

wxiaoguang mentioned this pull request Feb 27, 2024

Only use supported sort order for "explore/users" page (#29430) #29443

Merged

wxiaoguang added the backport/done All backports for this PR have been created label Feb 27, 2024

github-actions bot locked as resolved and limited conversation to collaborators Mar 6, 2024

6543 reviewed Oct 28, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Only use supported sort order for "explore/users" page #29430

Only use supported sort order for "explore/users" page #29430

wxiaoguang commented Feb 26, 2024 •

edited

Loading

zokkis Feb 26, 2024

wxiaoguang Feb 27, 2024

zokkis commented Feb 26, 2024

delvh left a comment •

edited

Loading

silverwind commented Feb 26, 2024 •

edited

Loading

delvh commented Feb 26, 2024

silverwind commented Feb 26, 2024 •

edited

Loading

wxiaoguang commented Feb 27, 2024

GiteaBot commented Feb 27, 2024

GiteaBot commented Feb 27, 2024

6543 Oct 28, 2024

6543 Oct 28, 2024

Only use supported sort order for "explore/users" page #29430

Only use supported sort order for "explore/users" page #29430

Conversation

wxiaoguang commented Feb 26, 2024 • edited Loading

zokkis Feb 26, 2024

Choose a reason for hiding this comment

wxiaoguang Feb 27, 2024

Choose a reason for hiding this comment

zokkis commented Feb 26, 2024

delvh left a comment • edited Loading

Choose a reason for hiding this comment

silverwind commented Feb 26, 2024 • edited Loading

delvh commented Feb 26, 2024

silverwind commented Feb 26, 2024 • edited Loading

wxiaoguang commented Feb 27, 2024

GiteaBot commented Feb 27, 2024

GiteaBot commented Feb 27, 2024

6543 Oct 28, 2024

Choose a reason for hiding this comment

6543 Oct 28, 2024

Choose a reason for hiding this comment

wxiaoguang commented Feb 26, 2024 •

edited

Loading

delvh left a comment •

edited

Loading

silverwind commented Feb 26, 2024 •

edited

Loading

silverwind commented Feb 26, 2024 •

edited

Loading