[go: up one dir, main page]

Skip to content

Gitlab Pages Access Control not working as documented

Summary

The Pages documentation states that enabling access_control=true should force users to authenticate before being able to view Pages.

However, based on this code, both access_control and the application setting force_pages_access_control are required to force access control to work.

I believe this option in the UI is responsible for setting force_pages_access_control

Is this a bug in the documentation or the code?

Steps to reproduce

Using the Helm Chart to install with the following Pages settings:

global:
  pages:
    enabled: true
    accessControl: true

What is the current bug behavior?

Setting accessControl: true alone does not enforce access control for Pages. The additional application config is also required to be set - which doesn't seem possible from the Helm Chart.

This has been observed in version 14.10 and 15.0

What is the expected correct behavior?

Setting accessControl: true should be the only value required to be set to enforce access control for Pages

Possible fixes

Change the logic here to require only the pages access_control property to be used, or alternatively, provide an option via the Helm Charts to set the application setting force_pages_access_control.

Edited by Phil Murphy