check if signups are allowed during SignUpPost

[r-52]

Previously you could hide the sign up page with the following
configs:

[service]
SHOW_REGISTRATION_BUTTON          = false

This would remove the sign up button from the navbar, but the user could still access the page with a direct link. During the http post action, the go action checked if the key SHOW_REGISTRATION_BUTTON was set to true. If not, the user received a 403.

You can use this scenario for a semi-hidden sign up page that is only accessible through a direct link.

I've changed the check in this PR to check if the sign up is allowed or not. The user can access the sign up page (if it's enabled) and sign up even if the value of SHOW_REGISTRATION_BUTTON is false, the user can sign up.

Another solution could be:

• unify SHOW_REGISTRATION_BUTTON with DISABLE_REGISTRATION to
  only show the registration page if it's enabled, but that would dis-
  allow the mentioned scenario

fixes: #5183

[codecov-io]

Codecov Report

Merging #5437 into master will not change coverage.
The diff coverage is 0%.

@@           Coverage Diff           @@
##           master    #5437   +/-   ##
=======================================
  Coverage   37.56%   37.56%           
=======================================
  Files         317      317           
  Lines       46821    46821           
=======================================
  Hits        17590    17590           
  Misses      26732    26732           
  Partials     2499     2499

Impacted Files	Coverage Δ
routers/user/auth.go	13.28% <0%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 06ef5b6...b33f71b. Read the comment docs.

[kolaente]

I see no point in why we have two settings which try to achive the same goal. From a security perspective, only hiding the button and still enabling sign ups is useless if the path is kept the same, an attacker could just try to visit gitea-instance.tld/register and only hiding a button to that page wont prevent him from doing so.

So, I'd prefer to uinon these two settings.

[stale]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 months. Thank you for your contributions.

[lunny]

I think we can drop SHOW_REGISTRATION_BUTTON and always use DISABLE_REGISTRATION.

[zeripath]

@lunny this PR doesn't actually drop SHOW_REGISTRATION_BUTTON - it's just that this PR disconnects SHOW_REGISTRATION_BUTTON and DISABLE_REGISTRATION - so if you set SHOW_REGISTRATION_BUTTON to false but leave DISABLE_REGISTRATION unset you can still register.

@romankl in order prevent a broken UI you need to change https://github.com/go-gitea/gitea/blob/master/modules/setting/service.go#L57 :

Service.ShowRegistrationButton = sec.Key("SHOW_REGISTRATION_BUTTON").MustBool(!(Service.DisableRegistration || Service.AllowOnlyExternalRegistration))

to

Service.ShowRegistrationButton = sec.Key("SHOW_REGISTRATION_BUTTON").MustBool(true) && !(Service.DisableRegistration || Service.AllowOnlyExternalRegistration)

So that DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION properly override SHOW_REGISTRATION_BUTTON

[zeripath]

See my comment above.

[stale]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 months. Thank you for your contributions.