From e3dfb512d6fe078e938ba1f75a133f500a508ed7 Mon Sep 17 00:00:00 2001 From: Giteabot Date: Sun, 21 Jan 2024 23:21:22 +0800 Subject: [PATCH] Warn that `DISABLE_QUERY_AUTH_TOKEN` is false only if it's explicitly defined (#28783) (#28868) Backport #28783 by @yardenshoham So we don't warn on default behavior - Fixes https://github.com/go-gitea/gitea/issues/28758 - Follows https://github.com/go-gitea/gitea/pull/28390 Signed-off-by: Yarden Shoham Co-authored-by: Yarden Shoham --- modules/setting/security.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/setting/security.go b/modules/setting/security.go index efe0d7eea..01e02ea5a 100644 --- a/modules/setting/security.go +++ b/modules/setting/security.go @@ -161,10 +161,13 @@ func loadSecurityFrom(rootCfg ConfigProvider) { } } + sectionHasDisableQueryAuthToken := sec.HasKey("DISABLE_QUERY_AUTH_TOKEN") + // TODO: default value should be true in future releases DisableQueryAuthToken = sec.Key("DISABLE_QUERY_AUTH_TOKEN").MustBool(false) - if !DisableQueryAuthToken { + // warn if the setting is set to false explicitly + if sectionHasDisableQueryAuthToken && !DisableQueryAuthToken { log.Warn("Enabling Query API Auth tokens is not recommended. DISABLE_QUERY_AUTH_TOKEN will default to true in gitea 1.23 and will be removed in gitea 1.24.") } }