delete user with its repositories & organization memberships

[a1batross]

• Gitea version (or commit ref): 1.14.1 from GitHub Releases
• Git version: 2.25.1
• Operating system: Ubuntu 20.04.2
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No

I recently had a spam attack on my open Gitea instance.

Spammers seems are targeted for the Gitea instances, as some accounts created several repositories or created and joined organizations. The problem is, I can't delete these accounts with one command or click.

Nor CLI, nor Web admin panel gives me anything to purge everything made by these bots.

[6543]

I would propose a "purge user" function for admins ...
-> delete user, deletes a user & his membership
-> purge user, deletes all a user has done ...

[a1batross]

@6543 that seems fine to me.

Anything better than deleting repositories one by one.

[lunny]

Or a flag --force.

[silverwind]

I too would like such an option on the admin UI to delete a user along with all its memberships.

[mewalig]

Is there any back-end administrative script that can do this (e.g. a script that runs a few lines of SQL)?

[fnetX]

Does it already help anyone to provide an API function here? Either an option to remove a user including everything, or a separate that removes a user with all the data that can be run after some kind of confirmation.

[mewalig]

API would be great.

As far as options: even better would be the option for the account deletion to merely disable the account without deleting it, so that all of the data related to the user account remains intact. Perhaps such an option exists that I'm not aware of, in which case please disregard this comment. If not, there are a wide range of business, operational and/or legal reasons why disabling may be preferable-- or necessary-- in lieu of deleting.

Also important to consider is that it may be desirable for peripheral content created under that account-- such as, for example, comments to some issue related to someone else's repo-- to remain (imagine trying to read an issue history with a key participant's comments removed). There are surely also regulatory considerations related to users' control of content as well, and in a world where regulatory requirements can quickly change, flexibility is even more valuable.

Worth making the connection as well that related to these considerations is the ability to export data related to a specific account i.e. #1446 and #4351

[fnetX]

By the way, because the link doesn't exist, there is #18064.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

[MightyPork]

Hi, can I ask how to use this feature? I'm using 1.17.3

A common pattern of spam on my gitea is that a user signs up and creates an empty repository (or several) with ads and links. The user can't be deleted through the admin UI, because it has repositories. The spam repositories have to be deleted one at a time.

This spam vector greatly dropped in popularity when I disabled sign-ups other than through github, but it's still happening.

[zeripath]

The feature is in 1.18 so would be in dev, 1.18-dev or 1.18-rc0