From 40ba7d7d7615928ddb980a9cd1d7066f4f1f498a Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 13:34:01 +0200
Subject: [PATCH 01/13] restructure CreateUser

---
 models/user.go | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/models/user.go b/models/user.go
index 221c840a7f7f3..488e770fa3bdf 100644
--- a/models/user.go
+++ b/models/user.go
@@ -863,12 +863,27 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return err
 	}
 
+	// set system defaults
+	u.KeepEmailPrivate = setting.Service.DefaultKeepEmailPrivate
+	u.Visibility = setting.Service.DefaultUserVisibilityMode
+	u.AllowCreateOrganization = setting.Service.DefaultAllowCreateOrganization && !setting.Admin.DisableRegularOrgCreation
+	u.EmailNotificationsPreference = setting.Admin.DefaultEmailNotification
+	u.MaxRepoCreation = -1
+	u.Theme = setting.UI.DefaultTheme
+
+	// overwrite defaults if set
+	if len(overwriteDefault) != 0 && overwriteDefault[0] != nil {
+		u.Visibility = overwriteDefault[0].Visibility
+	}
+
 	sess := x.NewSession()
 	defer sess.Close()
 	if err = sess.Begin(); err != nil {
 		return err
 	}
 
+	// validate data
+
 	isExist, err := isUserExist(sess, 0, u.Name)
 	if err != nil {
 		return err
@@ -876,10 +891,6 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return ErrUserAlreadyExist{u.Name}
 	}
 
-	if err = deleteUserRedirect(sess, u.Name); err != nil {
-		return err
-	}
-
 	u.Email = strings.ToLower(u.Email)
 	if err = ValidateEmail(u.Email); err != nil {
 		return err
@@ -892,6 +903,8 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return ErrEmailAlreadyUsed{u.Email}
 	}
 
+	// prepare for database
+
 	u.LowerName = strings.ToLower(u.Name)
 	u.AvatarEmail = u.Email
 	if u.Rands, err = GetUserSalt(); err != nil {
@@ -901,16 +914,10 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return err
 	}
 
-	// set system defaults
-	u.KeepEmailPrivate = setting.Service.DefaultKeepEmailPrivate
-	u.Visibility = setting.Service.DefaultUserVisibilityMode
-	u.AllowCreateOrganization = setting.Service.DefaultAllowCreateOrganization && !setting.Admin.DisableRegularOrgCreation
-	u.EmailNotificationsPreference = setting.Admin.DefaultEmailNotification
-	u.MaxRepoCreation = -1
-	u.Theme = setting.UI.DefaultTheme
-	// overwrite defaults if set
-	if len(overwriteDefault) != 0 && overwriteDefault[0] != nil {
-		u.Visibility = overwriteDefault[0].Visibility
+	// save changes to database
+
+	if err = deleteUserRedirect(sess, u.Name); err != nil {
+		return err
 	}
 
 	if _, err = sess.Insert(u); err != nil {

From 8a9589d7ff04f42dde7a18cf7fd3a4f83afe03ee Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 13:52:45 +0200
Subject: [PATCH 02/13] Service.AllowedUserVisibilityModes

---
 models/user.go             |  4 ++++
 modules/setting/service.go | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/models/user.go b/models/user.go
index 488e770fa3bdf..fd18d3a49fdf1 100644
--- a/models/user.go
+++ b/models/user.go
@@ -903,6 +903,10 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return ErrEmailAlreadyUsed{u.Email}
 	}
 
+	if !setting.Service.AllowedUserVisibilityModesMap[u.Visibility] {
+		return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
+	}
+
 	// prepare for database
 
 	u.LowerName = strings.ToLower(u.Name)
diff --git a/modules/setting/service.go b/modules/setting/service.go
index 3f689212f373c..cea32f09d619b 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -17,6 +17,8 @@ import (
 var Service struct {
 	DefaultUserVisibility                   string
 	DefaultUserVisibilityMode               structs.VisibleType
+	AllowedUserVisibilityModes              []string
+	AllowedUserVisibilityModesMap           map[structs.VisibleType]bool `ini:"-"`
 	DefaultOrgVisibility                    string
 	DefaultOrgVisibilityMode                structs.VisibleType
 	ActiveCodeLives                         int
@@ -122,6 +124,16 @@ func newService() {
 	Service.AutoWatchOnChanges = sec.Key("AUTO_WATCH_ON_CHANGES").MustBool(false)
 	Service.DefaultUserVisibility = sec.Key("DEFAULT_USER_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultUserVisibilityMode = structs.VisibilityModes[Service.DefaultUserVisibility]
+	Service.AllowedUserVisibilityModes = sec.Key("AllowedUserVisibilityModes").Strings(",")
+	Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	for _, modes := range Service.AllowedUserVisibilityModes {
+		Service.AllowedUserVisibilityModesMap[structs.VisibilityModes[modes]] = true
+	}
+	if len(Service.AllowedUserVisibilityModesMap) == 0 {
+		Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+		Service.AllowedUserVisibilityModesMap[structs.VisibleTypeLimited] = true
+		Service.AllowedUserVisibilityModesMap[structs.VisibleTypePrivate] = true
+	}
 	Service.DefaultOrgVisibility = sec.Key("DEFAULT_ORG_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultOrgVisibilityMode = structs.VisibilityModes[Service.DefaultOrgVisibility]
 	Service.DefaultOrgMemberVisible = sec.Key("DEFAULT_ORG_MEMBER_VISIBLE").MustBool()

From 0bc0c977a79b929ce1865c90b1e582a961703ca3 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 14:39:46 +0200
Subject: [PATCH 03/13] validate user on update too

---
 models/user.go | 37 +++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/models/user.go b/models/user.go
index fd18d3a49fdf1..988ec9d584180 100644
--- a/models/user.go
+++ b/models/user.go
@@ -884,6 +884,10 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 
 	// validate data
 
+	if err := validateUser(u); err != nil {
+		return err
+	}
+
 	isExist, err := isUserExist(sess, 0, u.Name)
 	if err != nil {
 		return err
@@ -891,11 +895,6 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return ErrUserAlreadyExist{u.Name}
 	}
 
-	u.Email = strings.ToLower(u.Email)
-	if err = ValidateEmail(u.Email); err != nil {
-		return err
-	}
-
 	isExist, err = isEmailUsed(sess, u.Email)
 	if err != nil {
 		return err
@@ -903,10 +902,6 @@ func CreateUser(u *User, overwriteDefault ...*CreateUserOverwriteOptions) (err e
 		return ErrEmailAlreadyUsed{u.Email}
 	}
 
-	if !setting.Service.AllowedUserVisibilityModesMap[u.Visibility] {
-		return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
-	}
-
 	// prepare for database
 
 	u.LowerName = strings.ToLower(u.Name)
@@ -1067,12 +1062,26 @@ func checkDupEmail(e Engine, u *User) error {
 	return nil
 }
 
-func updateUser(e Engine, u *User) (err error) {
+// validateUser check if user is valide to insert / update into database
+func validateUser(u *User) error {
+	if !setting.Service.AllowedUserVisibilityModesMap[u.Visibility] {
+		return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
+	}
+
 	u.Email = strings.ToLower(u.Email)
-	if err = ValidateEmail(u.Email); err != nil {
+	if err := ValidateEmail(u.Email); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func updateUser(e Engine, u *User) error {
+	if err := validateUser(u); err != nil {
 		return err
 	}
-	_, err = e.ID(u.ID).AllCols().Update(u)
+
+	_, err := e.ID(u.ID).AllCols().Update(u)
 	return err
 }
 
@@ -1087,6 +1096,10 @@ func UpdateUserCols(u *User, cols ...string) error {
 }
 
 func updateUserCols(e Engine, u *User, cols ...string) error {
+	if err := validateUser(u); err != nil {
+		return err
+	}
+
 	_, err := e.ID(u.ID).Cols(cols...).Update(u)
 	return err
 }

From 6b49fc499ed49df32d23a04b36addc2003cec314 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 15:20:13 +0200
Subject: [PATCH 04/13] Apply to UI

---
 models/user_test.go                  | 22 +++++++++++++++++++
 modules/setting/service.go           |  2 +-
 routers/web/admin/users.go           |  2 ++
 routers/web/user/setting/profile.go  |  1 +
 templates/admin/user/edit.tmpl       | 30 +++++++++++++-------------
 templates/admin/user/new.tmpl        | 18 ++++++++++------
 templates/user/settings/profile.tmpl | 32 ++++++++++++++--------------
 7 files changed, 69 insertions(+), 38 deletions(-)

diff --git a/models/user_test.go b/models/user_test.go
index 39a1b3c989c05..726b068ad6e07 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
 
 	"github.com/stretchr/testify/assert"
@@ -467,3 +468,24 @@ ssh-dss AAAAB3NzaC1kc3MAAACBAOChCC7lf6Uo9n7BmZ6M8St19PZf4Tn59NriyboW2x/DZuYAz3ib
 		}
 	}
 }
+
+func TestUpdateUser(t *testing.T) {
+	assert.NoError(t, PrepareTestDatabase())
+	user := AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
+
+	user.KeepActivityPrivate = true
+	assert.NoError(t, UpdateUser(user))
+	user = AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
+	assert.True(t, user.KeepActivityPrivate)
+
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	user.KeepActivityPrivate = false
+	user.Visibility = structs.VisibleTypePrivate
+	assert.Error(t, UpdateUser(user))
+	user = AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
+	assert.True(t, user.KeepActivityPrivate)
+
+	user.Email = "no mail@mail.org"
+	assert.Error(t, UpdateUser(user))
+}
diff --git a/modules/setting/service.go b/modules/setting/service.go
index cea32f09d619b..129b0656ab771 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -124,7 +124,7 @@ func newService() {
 	Service.AutoWatchOnChanges = sec.Key("AUTO_WATCH_ON_CHANGES").MustBool(false)
 	Service.DefaultUserVisibility = sec.Key("DEFAULT_USER_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultUserVisibilityMode = structs.VisibilityModes[Service.DefaultUserVisibility]
-	Service.AllowedUserVisibilityModes = sec.Key("AllowedUserVisibilityModes").Strings(",")
+	Service.AllowedUserVisibilityModes = sec.Key("ALLOWED_USER_VISIBILITY_MODES").Strings(",")
 	Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
 	for _, modes := range Service.AllowedUserVisibilityModes {
 		Service.AllowedUserVisibilityModesMap[structs.VisibilityModes[modes]] = true
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index dc2a97e5261d1..ccffdf73b7ddf 100644
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -52,6 +52,7 @@ func NewUser(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DefaultUserVisibilityMode"] = setting.Service.DefaultUserVisibilityMode
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
 
 	ctx.Data["login_type"] = "0-0"
 
@@ -211,6 +212,7 @@ func EditUser(ctx *context.Context) {
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DisableRegularOrgCreation"] = setting.Admin.DisableRegularOrgCreation
 	ctx.Data["DisableMigrations"] = setting.Repository.DisableMigrations
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
 
 	prepareUserInfo(ctx)
 	if ctx.Written() {
diff --git a/routers/web/user/setting/profile.go b/routers/web/user/setting/profile.go
index 463c4ec2038c8..857f5776e0eee 100644
--- a/routers/web/user/setting/profile.go
+++ b/routers/web/user/setting/profile.go
@@ -38,6 +38,7 @@ const (
 func Profile(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("settings")
 	ctx.Data["PageIsSettingsProfile"] = true
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
 
 	ctx.HTML(http.StatusOK, tplSettingsProfile)
 }
diff --git a/templates/admin/user/edit.tmpl b/templates/admin/user/edit.tmpl
index dba24d9837df0..659df9d5f267a 100644
--- a/templates/admin/user/edit.tmpl
+++ b/templates/admin/user/edit.tmpl
@@ -32,25 +32,25 @@
 				<div class="inline field {{if .Err_Visibility}}error{{end}}">
 					<span class="inline required field"><label for="visibility">{{.i18n.Tr "settings.visibility"}}</label></span>
 					<div class="ui selection type dropdown">
-						{{if .User.Visibility.IsPublic}}
-						<input type="hidden" id="visibility" name="visibility" value="0">
-						{{end}}
-						{{if .User.Visibility.IsLimited}}
-						<input type="hidden" id="visibility" name="visibility" value="1">
-						{{end}}
-						{{if .User.Visibility.IsPrivate}}
-						<input type="hidden" id="visibility" name="visibility" value="2">
-						{{end}}
+						{{if .User.Visibility.IsPublic}}<input type="hidden" id="visibility" name="visibility" value="0">{{end}}
+						{{if .User.Visibility.IsLimited}}<input type="hidden" id="visibility" name="visibility" value="1">{{end}}
+						{{if .User.Visibility.IsPrivate}}<input type="hidden" id="visibility" name="visibility" value="2">{{end}}
 						<div class="text">
-						{{if .User.Visibility.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
-						{{if .User.Visibility.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
-						{{if .User.Visibility.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
+							{{if .User.Visibility.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
+							{{if .User.Visibility.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
+							{{if .User.Visibility.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{.i18n.Tr "settings.visibility.public"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{.i18n.Tr "settings.visibility.limited"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{.i18n.Tr "settings.visibility.private"}}</div>
+							{{range $key, $value := .AllowedUserVisibilityModes}}
+								{{if $key.IsPublic}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
+								{{else if $key.IsLimited}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
+								{{else if $key.IsPrivate}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
+								{{end}}
+							{{end}}
 						</div>
 					</div>
 				</div>
diff --git a/templates/admin/user/new.tmpl b/templates/admin/user/new.tmpl
index 2e391725353a7..5468cdd5e8316 100644
--- a/templates/admin/user/new.tmpl
+++ b/templates/admin/user/new.tmpl
@@ -30,15 +30,21 @@
 					<div class="ui selection type dropdown">
 						<input type="hidden" id="visibility" name="visibility" value="{{.visibility}}">
 						<div class="text">
-						{{if .DefaultUserVisibilityMode.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
-						{{if .DefaultUserVisibilityMode.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
-						{{if .DefaultUserVisibilityMode.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
+							{{if .DefaultUserVisibilityMode.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
+							{{if .DefaultUserVisibilityMode.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
+							{{if .DefaultUserVisibilityMode.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{.i18n.Tr "settings.visibility.public"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{.i18n.Tr "settings.visibility.limited"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{.i18n.Tr "settings.visibility.private"}}</div>
+							{{range $key, $value := .AllowedUserVisibilityModes}}
+								{{if $key.IsPublic}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
+								{{else if $key.IsLimited}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
+								{{else if $key.IsPrivate}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
+								{{end}}
+							{{end}}
 						</div>
 					</div>
 				</div>
diff --git a/templates/user/settings/profile.tmpl b/templates/user/settings/profile.tmpl
index 4b860049d8323..a15408432dd5a 100644
--- a/templates/user/settings/profile.tmpl
+++ b/templates/user/settings/profile.tmpl
@@ -71,26 +71,26 @@
 				<div class="inline field {{if .Err_Visibility}}error{{end}}">
 					<span class="inline required field"><label for="visibility">{{.i18n.Tr "settings.visibility"}}</label></span>
 					<div class="ui selection type dropdown">
-						{{if .SignedUser.Visibility.IsPublic}}
-						<input type="hidden" id="visibility" name="visibility" value="0">
-						{{end}}
-						{{if .SignedUser.Visibility.IsLimited}}
-						<input type="hidden" id="visibility" name="visibility" value="1">
-						{{end}}
-						{{if .SignedUser.Visibility.IsPrivate}}
-						<input type="hidden" id="visibility" name="visibility" value="2">
-						{{end}}
+						{{if .SignedUser.Visibility.IsPublic}}<input type="hidden" id="visibility" name="visibility" value="0">{{end}}
+						{{if .SignedUser.Visibility.IsLimited}}<input type="hidden" id="visibility" name="visibility" value="1">{{end}}
+						{{if .SignedUser.Visibility.IsPrivate}}<input type="hidden" id="visibility" name="visibility" value="2">{{end}}
 						<div class="text">
-						{{if .SignedUser.Visibility.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
-						{{if .SignedUser.Visibility.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
-						{{if .SignedUser.Visibility.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
+							{{if .SignedUser.Visibility.IsPublic}}{{.i18n.Tr "settings.visibility.public"}}{{end}}
+							{{if .SignedUser.Visibility.IsLimited}}{{.i18n.Tr "settings.visibility.limited"}}{{end}}
+							{{if .SignedUser.Visibility.IsPrivate}}{{.i18n.Tr "settings.visibility.private"}}{{end}}
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{.i18n.Tr "settings.visibility.public"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{.i18n.Tr "settings.visibility.limited"}}</div>
-							<div class="item poping up" data-content="{{.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{.i18n.Tr "settings.visibility.private"}}</div>
-						</div>
+							{{range $key, $value := .AllowedUserVisibilityModes}}
+								{{if $key.IsPublic}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
+								{{else if $key.IsLimited}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
+								{{else if $key.IsPrivate}}
+									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
+								{{end}}
+							{{end}}
+            </div>
 					</div>
 				</div>
 

From 365ab6f49a613137e55a528fc777b4d8777ee63e Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 15:21:30 +0200
Subject: [PATCH 05/13] docu

---
 custom/conf/app.example.ini                           | 3 +++
 docs/content/doc/advanced/config-cheat-sheet.en-us.md | 1 +
 2 files changed, 4 insertions(+)

diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index e7fe9206ed960..33ff7a62c56b3 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -656,6 +656,9 @@ PATH =
 ;; Public is for users visible for everyone
 ;DEFAULT_USER_VISIBILITY = public
 ;;
+;; Set whitch visibibilty modes a user can have
+;ALLOWED_USER_VISIBILITY_MODES = public,limited,private
+;;
 ;; Either "public", "limited" or "private", default is "public"
 ;; Limited is for organizations visible only to signed users
 ;; Private is for organizations visible only to members of the organization
diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
index 21359dcab1445..d1d47bc89301d 100644
--- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
@@ -513,6 +513,7 @@ relation to port exhaustion.
 - `AUTO_WATCH_NEW_REPOS`: **true**: Enable this to let all organisation users watch new repos when they are created
 - `AUTO_WATCH_ON_CHANGES`: **false**: Enable this to make users watch a repository after their first commit to it
 - `DEFAULT_USER_VISIBILITY`: **public**: Set default visibility mode for users, either "public", "limited" or "private".
+- `ALLOWED_USER_VISIBILITY_MODES`: **public,limited,private**: Set whitch visibibilty modes a user can have
 - `DEFAULT_ORG_VISIBILITY`: **public**: Set default visibility mode for organisations, either "public", "limited" or "private".
 - `DEFAULT_ORG_MEMBER_VISIBLE`: **false** True will make the membership of the users visible when added to the organisation.
 - `ALLOW_ONLY_INTERNAL_REGISTRATION`: **false** Set to true to force registration only via gitea.

From e2dd97efb94589582b99357300b3bd77e78b9fed Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 15:31:34 +0200
Subject: [PATCH 06/13] init AllowedUserVisibilityModesMap for unit-tests if
 needed

---
 models/user_mail_test.go |  4 ++++
 models/user_test.go      | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/models/user_mail_test.go b/models/user_mail_test.go
index 829a38c18dbbf..198eec5575282 100644
--- a/models/user_mail_test.go
+++ b/models/user_mail_test.go
@@ -7,6 +7,8 @@ package models
 import (
 	"testing"
 
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
 
 	"github.com/stretchr/testify/assert"
@@ -166,6 +168,8 @@ func TestMakeEmailPrimary(t *testing.T) {
 
 func TestActivate(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
 
 	email := &EmailAddress{
 		ID:    int64(1),
diff --git a/models/user_test.go b/models/user_test.go
index 726b068ad6e07..5f49bbda3dd06 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -190,6 +190,9 @@ func TestDeleteUser(t *testing.T) {
 
 func TestEmailNotificationPreferences(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+
 	for _, test := range []struct {
 		expected string
 		userID   int64
@@ -309,6 +312,9 @@ func TestDisplayName(t *testing.T) {
 }
 
 func TestCreateUser(t *testing.T) {
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+
 	user := &User{
 		Name:               "GiteaBot",
 		Email:              "GiteaBot@gitea.io",
@@ -324,6 +330,9 @@ func TestCreateUser(t *testing.T) {
 }
 
 func TestCreateUserInvalidEmail(t *testing.T) {
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+
 	user := &User{
 		Name:               "GiteaBot",
 		Email:              "GiteaBot@gitea.io\r\n",
@@ -339,6 +348,9 @@ func TestCreateUserInvalidEmail(t *testing.T) {
 }
 
 func TestCreateUser_Issue5882(t *testing.T) {
+	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
+	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+
 	// Init settings
 	_ = setting.Admin
 

From aad443d5807b5fd6225e0dd226f1dbbbbaf9807e Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 15:36:07 +0200
Subject: [PATCH 07/13] fix lint

---
 models/user.go                       | 6 +-----
 templates/user/settings/profile.tmpl | 2 +-
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/models/user.go b/models/user.go
index 988ec9d584180..68378f9d1785d 100644
--- a/models/user.go
+++ b/models/user.go
@@ -1069,11 +1069,7 @@ func validateUser(u *User) error {
 	}
 
 	u.Email = strings.ToLower(u.Email)
-	if err := ValidateEmail(u.Email); err != nil {
-		return err
-	}
-
-	return nil
+	return ValidateEmail(u.Email)
 }
 
 func updateUser(e Engine, u *User) error {
diff --git a/templates/user/settings/profile.tmpl b/templates/user/settings/profile.tmpl
index a15408432dd5a..c3de322fc91df 100644
--- a/templates/user/settings/profile.tmpl
+++ b/templates/user/settings/profile.tmpl
@@ -90,7 +90,7 @@
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
 								{{end}}
 							{{end}}
-            </div>
+						</div>
 					</div>
 				</div>
 

From 4493a7945128b94ed769c93e331db33ab3d1b011 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:00:53 +0200
Subject: [PATCH 08/13] move from map too bool slice

---
 models/user.go                           |  2 +-
 models/user_mail_test.go                 |  4 +---
 models/user_test.go                      | 15 +++++--------
 modules/setting/service.go               | 27 ++++++++++++++++--------
 routers/web/admin/users.go               | 17 +++++++++++++--
 routers/web/user/setting/account_test.go |  2 ++
 routers/web/user/setting/profile.go      |  9 +++++++-
 templates/admin/user/edit.tmpl           |  8 +++----
 templates/admin/user/new.tmpl            |  8 +++----
 templates/user/settings/profile.tmpl     |  8 +++----
 10 files changed, 62 insertions(+), 38 deletions(-)

diff --git a/models/user.go b/models/user.go
index 68378f9d1785d..47d24aefd6aa4 100644
--- a/models/user.go
+++ b/models/user.go
@@ -1064,7 +1064,7 @@ func checkDupEmail(e Engine, u *User) error {
 
 // validateUser check if user is valide to insert / update into database
 func validateUser(u *User) error {
-	if !setting.Service.AllowedUserVisibilityModesMap[u.Visibility] {
+	if !setting.Service.AllowedUserVisibilityModesSlice.IsAllowedVisibility(u.Visibility) {
 		return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
 	}
 
diff --git a/models/user_mail_test.go b/models/user_mail_test.go
index 198eec5575282..88f478e908d73 100644
--- a/models/user_mail_test.go
+++ b/models/user_mail_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
 
 	"github.com/stretchr/testify/assert"
@@ -168,8 +167,7 @@ func TestMakeEmailPrimary(t *testing.T) {
 
 func TestActivate(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	email := &EmailAddress{
 		ID:    int64(1),
diff --git a/models/user_test.go b/models/user_test.go
index 5f49bbda3dd06..71632d9731637 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -190,8 +190,7 @@ func TestDeleteUser(t *testing.T) {
 
 func TestEmailNotificationPreferences(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	for _, test := range []struct {
 		expected string
@@ -312,8 +311,7 @@ func TestDisplayName(t *testing.T) {
 }
 
 func TestCreateUser(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	user := &User{
 		Name:               "GiteaBot",
@@ -330,8 +328,7 @@ func TestCreateUser(t *testing.T) {
 }
 
 func TestCreateUserInvalidEmail(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	user := &User{
 		Name:               "GiteaBot",
@@ -348,8 +345,7 @@ func TestCreateUserInvalidEmail(t *testing.T) {
 }
 
 func TestCreateUser_Issue5882(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	// Init settings
 	_ = setting.Admin
@@ -490,8 +486,7 @@ func TestUpdateUser(t *testing.T) {
 	user = AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
 	assert.True(t, user.KeepActivityPrivate)
 
-	setting.Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	setting.Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, false, false}
 	user.KeepActivityPrivate = false
 	user.Visibility = structs.VisibleTypePrivate
 	assert.Error(t, UpdateUser(user))
diff --git a/modules/setting/service.go b/modules/setting/service.go
index 129b0656ab771..c11053bb00ff0 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -18,7 +18,7 @@ var Service struct {
 	DefaultUserVisibility                   string
 	DefaultUserVisibilityMode               structs.VisibleType
 	AllowedUserVisibilityModes              []string
-	AllowedUserVisibilityModesMap           map[structs.VisibleType]bool `ini:"-"`
+	AllowedUserVisibilityModesSlice         AllowedVisibility `ini:"-"`
 	DefaultOrgVisibility                    string
 	DefaultOrgVisibilityMode                structs.VisibleType
 	ActiveCodeLives                         int
@@ -75,6 +75,16 @@ var Service struct {
 	} `ini:"service.explore"`
 }
 
+// AllowedVisibility store in a 3 item bool array what is allowed
+type AllowedVisibility []bool
+
+func (a AllowedVisibility) IsAllowedVisibility(t structs.VisibleType) bool {
+	if int(t) >= len(a) {
+		return false
+	}
+	return a[t]
+}
+
 func newService() {
 	sec := Cfg.Section("service")
 	Service.ActiveCodeLives = sec.Key("ACTIVE_CODE_LIVE_MINUTES").MustInt(180)
@@ -125,14 +135,13 @@ func newService() {
 	Service.DefaultUserVisibility = sec.Key("DEFAULT_USER_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultUserVisibilityMode = structs.VisibilityModes[Service.DefaultUserVisibility]
 	Service.AllowedUserVisibilityModes = sec.Key("ALLOWED_USER_VISIBILITY_MODES").Strings(",")
-	Service.AllowedUserVisibilityModesMap = make(map[structs.VisibleType]bool)
-	for _, modes := range Service.AllowedUserVisibilityModes {
-		Service.AllowedUserVisibilityModesMap[structs.VisibilityModes[modes]] = true
-	}
-	if len(Service.AllowedUserVisibilityModesMap) == 0 {
-		Service.AllowedUserVisibilityModesMap[structs.VisibleTypePublic] = true
-		Service.AllowedUserVisibilityModesMap[structs.VisibleTypeLimited] = true
-		Service.AllowedUserVisibilityModesMap[structs.VisibleTypePrivate] = true
+	if len(Service.AllowedUserVisibilityModes) == 0 {
+		Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
+	} else {
+		Service.AllowedUserVisibilityModesSlice = []bool{false, false, false}
+		for _, sMode := range Service.AllowedUserVisibilityModes {
+			Service.AllowedUserVisibilityModesSlice[structs.VisibilityModes[sMode]] = true
+		}
 	}
 	Service.DefaultOrgVisibility = sec.Key("DEFAULT_ORG_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultOrgVisibilityMode = structs.VisibilityModes[Service.DefaultOrgVisibility]
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index ccffdf73b7ddf..c6dcc67a35856 100644
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -17,6 +17,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/password"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/routers/web/explore"
 	router_user_setting "code.gitea.io/gitea/routers/web/user/setting"
@@ -52,7 +53,13 @@ func NewUser(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DefaultUserVisibilityMode"] = setting.Service.DefaultUserVisibilityMode
-	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
+	var allowedUserVisibilityModes []structs.VisibleType
+	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
+		if v {
+			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
+		}
+	}
+	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
 
 	ctx.Data["login_type"] = "0-0"
 
@@ -212,7 +219,13 @@ func EditUser(ctx *context.Context) {
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DisableRegularOrgCreation"] = setting.Admin.DisableRegularOrgCreation
 	ctx.Data["DisableMigrations"] = setting.Repository.DisableMigrations
-	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
+	var allowedUserVisibilityModes []structs.VisibleType
+	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
+		if v {
+			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
+		}
+	}
+	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
 
 	prepareUserInfo(ctx)
 	if ctx.Written() {
diff --git a/routers/web/user/setting/account_test.go b/routers/web/user/setting/account_test.go
index 25b68da762714..d71c46cd4ea9a 100644
--- a/routers/web/user/setting/account_test.go
+++ b/routers/web/user/setting/account_test.go
@@ -18,6 +18,8 @@ import (
 )
 
 func TestChangePassword(t *testing.T) {
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
+
 	oldPassword := "password"
 	setting.MinPasswordLength = 6
 	var pcALL = []string{"lower", "upper", "digit", "spec"}
diff --git a/routers/web/user/setting/profile.go b/routers/web/user/setting/profile.go
index 857f5776e0eee..3a8567d30b49f 100644
--- a/routers/web/user/setting/profile.go
+++ b/routers/web/user/setting/profile.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/typesniffer"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/modules/web"
@@ -38,7 +39,13 @@ const (
 func Profile(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("settings")
 	ctx.Data["PageIsSettingsProfile"] = true
-	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesMap
+	var allowedUserVisibilityModes []structs.VisibleType
+	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
+		if v {
+			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
+		}
+	}
+	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
 
 	ctx.HTML(http.StatusOK, tplSettingsProfile)
 }
diff --git a/templates/admin/user/edit.tmpl b/templates/admin/user/edit.tmpl
index 659df9d5f267a..5e5bc75c9695c 100644
--- a/templates/admin/user/edit.tmpl
+++ b/templates/admin/user/edit.tmpl
@@ -42,12 +42,12 @@
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							{{range $key, $value := .AllowedUserVisibilityModes}}
-								{{if $key.IsPublic}}
+							{{range $mode := .AllowedUserVisibilityModes}}
+								{{if $mode.IsPublic}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
-								{{else if $key.IsLimited}}
+								{{else if $mode.IsLimited}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
-								{{else if $key.IsPrivate}}
+								{{else if $mode.IsPrivate}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
 								{{end}}
 							{{end}}
diff --git a/templates/admin/user/new.tmpl b/templates/admin/user/new.tmpl
index 5468cdd5e8316..a433c5a7cc865 100644
--- a/templates/admin/user/new.tmpl
+++ b/templates/admin/user/new.tmpl
@@ -36,12 +36,12 @@
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							{{range $key, $value := .AllowedUserVisibilityModes}}
-								{{if $key.IsPublic}}
+							{{range $mode := .AllowedUserVisibilityModes}}
+								{{if $mode.IsPublic}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
-								{{else if $key.IsLimited}}
+								{{else if $mode.IsLimited}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
-								{{else if $key.IsPrivate}}
+								{{else if $mode.IsPrivate}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
 								{{end}}
 							{{end}}
diff --git a/templates/user/settings/profile.tmpl b/templates/user/settings/profile.tmpl
index c3de322fc91df..1f1585a78773b 100644
--- a/templates/user/settings/profile.tmpl
+++ b/templates/user/settings/profile.tmpl
@@ -81,12 +81,12 @@
 						</div>
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 						<div class="menu">
-							{{range $key, $value := .AllowedUserVisibilityModes}}
-								{{if $key.IsPublic}}
+							{{range $mode := .AllowedUserVisibilityModes}}
+								{{if $mode.IsPublic}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.public_tooltip"}}" data-value="0">{{$.i18n.Tr "settings.visibility.public"}}</div>
-								{{else if $key.IsLimited}}
+								{{else if $mode.IsLimited}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.limited_tooltip"}}" data-value="1">{{$.i18n.Tr "settings.visibility.limited"}}</div>
-								{{else if $key.IsPrivate}}
+								{{else if $mode.IsPrivate}}
 									<div class="item poping up" data-content="{{$.i18n.Tr "settings.visibility.private_tooltip"}}" data-value="2">{{$.i18n.Tr "settings.visibility.private"}}</div>
 								{{end}}
 							{{end}}

From 139433ef09b57b31f979d349624e3413c9216eee Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:03:52 +0200
Subject: [PATCH 09/13] lint

---
 modules/setting/service.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/setting/service.go b/modules/setting/service.go
index c11053bb00ff0..4fb75299fbe4a 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -78,6 +78,7 @@ var Service struct {
 // AllowedVisibility store in a 3 item bool array what is allowed
 type AllowedVisibility []bool
 
+// IsAllowedVisibility check if a AllowedVisibility allow a specific VisibleType
 func (a AllowedVisibility) IsAllowedVisibility(t structs.VisibleType) bool {
 	if int(t) >= len(a) {
 		return false

From 5882b72572695bd160348b182adabba925b26175 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:22:26 +0200
Subject: [PATCH 10/13] dedub code

---
 modules/setting/service.go          | 10 ++++++++++
 routers/web/admin/users.go          | 17 ++---------------
 routers/web/user/setting/profile.go |  9 +--------
 3 files changed, 13 insertions(+), 23 deletions(-)

diff --git a/modules/setting/service.go b/modules/setting/service.go
index 4fb75299fbe4a..05609cc24ee70 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -86,6 +86,16 @@ func (a AllowedVisibility) IsAllowedVisibility(t structs.VisibleType) bool {
 	return a[t]
 }
 
+// ToVisibleTypeSlice convert a AllowedVisibility into a VisibleType slice
+func (a AllowedVisibility) ToVisibleTypeSlice() (result []structs.VisibleType) {
+	for i, v := range a {
+		if v {
+			result = append(result, structs.VisibleType(i))
+		}
+	}
+	return
+}
+
 func newService() {
 	sec := Cfg.Section("service")
 	Service.ActiveCodeLives = sec.Key("ACTIVE_CODE_LIVE_MINUTES").MustInt(180)
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index c6dcc67a35856..e1903ab1dfafc 100644
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -17,7 +17,6 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/password"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/routers/web/explore"
 	router_user_setting "code.gitea.io/gitea/routers/web/user/setting"
@@ -53,13 +52,7 @@ func NewUser(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DefaultUserVisibilityMode"] = setting.Service.DefaultUserVisibilityMode
-	var allowedUserVisibilityModes []structs.VisibleType
-	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
-		if v {
-			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
-		}
-	}
-	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice()
 
 	ctx.Data["login_type"] = "0-0"
 
@@ -219,13 +212,7 @@ func EditUser(ctx *context.Context) {
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DisableRegularOrgCreation"] = setting.Admin.DisableRegularOrgCreation
 	ctx.Data["DisableMigrations"] = setting.Repository.DisableMigrations
-	var allowedUserVisibilityModes []structs.VisibleType
-	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
-		if v {
-			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
-		}
-	}
-	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice()
 
 	prepareUserInfo(ctx)
 	if ctx.Written() {
diff --git a/routers/web/user/setting/profile.go b/routers/web/user/setting/profile.go
index 3a8567d30b49f..682f9205784e3 100644
--- a/routers/web/user/setting/profile.go
+++ b/routers/web/user/setting/profile.go
@@ -19,7 +19,6 @@ import (
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/typesniffer"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/modules/web"
@@ -39,13 +38,7 @@ const (
 func Profile(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("settings")
 	ctx.Data["PageIsSettingsProfile"] = true
-	var allowedUserVisibilityModes []structs.VisibleType
-	for i, v := range setting.Service.AllowedUserVisibilityModesSlice {
-		if v {
-			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibleType(i))
-		}
-	}
-	ctx.Data["AllowedUserVisibilityModes"] = allowedUserVisibilityModes
+	ctx.Data["AllowedUserVisibilityModes"] = setting.Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice()
 
 	ctx.HTML(http.StatusOK, tplSettingsProfile)
 }

From ab9114a8e751a89f76197f862d04e86d83a8bfaf Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:25:53 +0200
Subject: [PATCH 11/13] init AllowedUserVisibilityModesSlice for unit-tests who
 need it

---
 modules/repository/create_test.go | 2 ++
 routers/web/admin/users_test.go   | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/modules/repository/create_test.go b/modules/repository/create_test.go
index 65ed7806a9b25..1ed77037af608 100644
--- a/modules/repository/create_test.go
+++ b/modules/repository/create_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/structs"
 
 	"github.com/stretchr/testify/assert"
@@ -16,6 +17,7 @@ import (
 
 func TestIncludesAllRepositoriesTeams(t *testing.T) {
 	assert.NoError(t, models.PrepareTestDatabase())
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	testTeamRepositories := func(teamID int64, repoIds []int64) {
 		team := models.AssertExistsAndLoadBean(t, &models.Team{ID: teamID}).(*models.Team)
diff --git a/routers/web/admin/users_test.go b/routers/web/admin/users_test.go
index 17c5a309b4d93..557ae336d704d 100644
--- a/routers/web/admin/users_test.go
+++ b/routers/web/admin/users_test.go
@@ -20,6 +20,7 @@ import (
 func TestNewUserPost_MustChangePassword(t *testing.T) {
 
 	models.PrepareTestEnv(t)
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -58,6 +59,7 @@ func TestNewUserPost_MustChangePassword(t *testing.T) {
 func TestNewUserPost_MustChangePasswordFalse(t *testing.T) {
 
 	models.PrepareTestEnv(t)
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -96,6 +98,7 @@ func TestNewUserPost_MustChangePasswordFalse(t *testing.T) {
 func TestNewUserPost_InvalidEmail(t *testing.T) {
 
 	models.PrepareTestEnv(t)
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -127,6 +130,7 @@ func TestNewUserPost_InvalidEmail(t *testing.T) {
 func TestNewUserPost_VisiblityDefaultPublic(t *testing.T) {
 
 	models.PrepareTestEnv(t)
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -166,6 +170,7 @@ func TestNewUserPost_VisiblityDefaultPublic(t *testing.T) {
 func TestNewUserPost_VisibilityPrivate(t *testing.T) {
 
 	models.PrepareTestEnv(t)
+	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{

From 580f4a3d7e445c2f291d5dd117e92a6b3296a581 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:28:12 +0200
Subject: [PATCH 12/13] Update modules/setting/service.go

Co-authored-by: zeripath <art27@cantab.net>
---
 modules/setting/service.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/setting/service.go b/modules/setting/service.go
index 05609cc24ee70..6751ea266ff25 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -73,6 +73,8 @@ var Service struct {
 		RequireSigninView bool `ini:"REQUIRE_SIGNIN_VIEW"`
 		DisableUsersPage  bool `ini:"DISABLE_USERS_PAGE"`
 	} `ini:"service.explore"`
+} {
+  AllowedUserVisibilityModesSlice: []bool{true, true, true},
 }
 
 // AllowedVisibility store in a 3 item bool array what is allowed

From 023ed7eeabd6b804323a5fda9d40ef02020c1124 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 27 Jun 2021 16:33:58 +0200
Subject: [PATCH 13/13] set default value at definition

---
 models/user_mail_test.go                 |  2 --
 models/user_test.go                      |  7 -------
 modules/repository/create_test.go        |  2 --
 modules/setting/service.go               | 10 ++++------
 routers/web/admin/users_test.go          |  9 ---------
 routers/web/user/setting/account_test.go |  2 --
 6 files changed, 4 insertions(+), 28 deletions(-)

diff --git a/models/user_mail_test.go b/models/user_mail_test.go
index 88f478e908d73..829a38c18dbbf 100644
--- a/models/user_mail_test.go
+++ b/models/user_mail_test.go
@@ -7,7 +7,6 @@ package models
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 
 	"github.com/stretchr/testify/assert"
@@ -167,7 +166,6 @@ func TestMakeEmailPrimary(t *testing.T) {
 
 func TestActivate(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	email := &EmailAddress{
 		ID:    int64(1),
diff --git a/models/user_test.go b/models/user_test.go
index 71632d9731637..34c465c586498 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -190,7 +190,6 @@ func TestDeleteUser(t *testing.T) {
 
 func TestEmailNotificationPreferences(t *testing.T) {
 	assert.NoError(t, PrepareTestDatabase())
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	for _, test := range []struct {
 		expected string
@@ -311,8 +310,6 @@ func TestDisplayName(t *testing.T) {
 }
 
 func TestCreateUser(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-
 	user := &User{
 		Name:               "GiteaBot",
 		Email:              "GiteaBot@gitea.io",
@@ -328,8 +325,6 @@ func TestCreateUser(t *testing.T) {
 }
 
 func TestCreateUserInvalidEmail(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-
 	user := &User{
 		Name:               "GiteaBot",
 		Email:              "GiteaBot@gitea.io\r\n",
@@ -345,8 +340,6 @@ func TestCreateUserInvalidEmail(t *testing.T) {
 }
 
 func TestCreateUser_Issue5882(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-
 	// Init settings
 	_ = setting.Admin
 
diff --git a/modules/repository/create_test.go b/modules/repository/create_test.go
index 1ed77037af608..65ed7806a9b25 100644
--- a/modules/repository/create_test.go
+++ b/modules/repository/create_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/models"
-	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/structs"
 
 	"github.com/stretchr/testify/assert"
@@ -17,7 +16,6 @@ import (
 
 func TestIncludesAllRepositoriesTeams(t *testing.T) {
 	assert.NoError(t, models.PrepareTestDatabase())
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 
 	testTeamRepositories := func(teamID int64, repoIds []int64) {
 		team := models.AssertExistsAndLoadBean(t, &models.Team{ID: teamID}).(*models.Team)
diff --git a/modules/setting/service.go b/modules/setting/service.go
index 6751ea266ff25..dbabfb8400ad0 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -14,7 +14,7 @@ import (
 )
 
 // Service settings
-var Service struct {
+var Service = struct {
 	DefaultUserVisibility                   string
 	DefaultUserVisibilityMode               structs.VisibleType
 	AllowedUserVisibilityModes              []string
@@ -73,8 +73,8 @@ var Service struct {
 		RequireSigninView bool `ini:"REQUIRE_SIGNIN_VIEW"`
 		DisableUsersPage  bool `ini:"DISABLE_USERS_PAGE"`
 	} `ini:"service.explore"`
-} {
-  AllowedUserVisibilityModesSlice: []bool{true, true, true},
+}{
+	AllowedUserVisibilityModesSlice: []bool{true, true, true},
 }
 
 // AllowedVisibility store in a 3 item bool array what is allowed
@@ -148,9 +148,7 @@ func newService() {
 	Service.DefaultUserVisibility = sec.Key("DEFAULT_USER_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
 	Service.DefaultUserVisibilityMode = structs.VisibilityModes[Service.DefaultUserVisibility]
 	Service.AllowedUserVisibilityModes = sec.Key("ALLOWED_USER_VISIBILITY_MODES").Strings(",")
-	if len(Service.AllowedUserVisibilityModes) == 0 {
-		Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-	} else {
+	if len(Service.AllowedUserVisibilityModes) != 0 {
 		Service.AllowedUserVisibilityModesSlice = []bool{false, false, false}
 		for _, sMode := range Service.AllowedUserVisibilityModes {
 			Service.AllowedUserVisibilityModesSlice[structs.VisibilityModes[sMode]] = true
diff --git a/routers/web/admin/users_test.go b/routers/web/admin/users_test.go
index 557ae336d704d..5ce20d8fa777c 100644
--- a/routers/web/admin/users_test.go
+++ b/routers/web/admin/users_test.go
@@ -20,7 +20,6 @@ import (
 func TestNewUserPost_MustChangePassword(t *testing.T) {
 
 	models.PrepareTestEnv(t)
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -57,9 +56,7 @@ func TestNewUserPost_MustChangePassword(t *testing.T) {
 }
 
 func TestNewUserPost_MustChangePasswordFalse(t *testing.T) {
-
 	models.PrepareTestEnv(t)
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -96,9 +93,7 @@ func TestNewUserPost_MustChangePasswordFalse(t *testing.T) {
 }
 
 func TestNewUserPost_InvalidEmail(t *testing.T) {
-
 	models.PrepareTestEnv(t)
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -128,9 +123,7 @@ func TestNewUserPost_InvalidEmail(t *testing.T) {
 }
 
 func TestNewUserPost_VisiblityDefaultPublic(t *testing.T) {
-
 	models.PrepareTestEnv(t)
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
@@ -168,9 +161,7 @@ func TestNewUserPost_VisiblityDefaultPublic(t *testing.T) {
 }
 
 func TestNewUserPost_VisibilityPrivate(t *testing.T) {
-
 	models.PrepareTestEnv(t)
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
 	ctx := test.MockContext(t, "admin/users/new")
 
 	u := models.AssertExistsAndLoadBean(t, &models.User{
diff --git a/routers/web/user/setting/account_test.go b/routers/web/user/setting/account_test.go
index d71c46cd4ea9a..25b68da762714 100644
--- a/routers/web/user/setting/account_test.go
+++ b/routers/web/user/setting/account_test.go
@@ -18,8 +18,6 @@ import (
 )
 
 func TestChangePassword(t *testing.T) {
-	setting.Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-
 	oldPassword := "password"
 	setting.MinPasswordLength = 6
 	var pcALL = []string{"lower", "upper", "digit", "spec"}