Gitea: admin could see content of private repository of the oteher users

[hudecof]

• Gitea version (or commit ref): 1.3.2
• Git version:
• Operating system:

• Database (use [x]):

• Can you reproduce the bug at https://try.gitea.io:

  • [ ] Yes (provide example URL)
  • [ ] No
  • [X ] Not relevant

Description

Admin user could see content of the private repossitories of the other users

user part

• login as a user
• create private repo
• add some content

admin part

• login as a admin
• enter Admin Panel menu
• enter Repositories tab
• choose private repository created by user /click on it/

If the repository is private even ADMIN could not see the content.

[bkcsoft]

This is the intended behaviour as an administrator is legally liable for anything that's on the server. Also for checking abuse. And the administrator could just bring up a console and check the files directly 🤷‍♂️

[hudecof]

depends on the agreement between the provider and customer. I would like to have the possibility to be this configurable. I would not use this as thirtd pary service if I known this.