Reject star-related requests if stars are disabled

routers/api/v1/repo/star.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/routers/api/v1/utils"
 	"code.gitea.io/gitea/services/context"
@@ -44,6 +45,13 @@ func ListStargazers(ctx *context.APIContext) {
 	//     "$ref": "#/responses/UserList"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
 
 	stargazers, err := repo_model.GetStargazers(ctx, ctx.Repo.Repository, utils.GetListOptions(ctx))
 	if err != nil {

routers/api/v1/user/star.go

@@ -11,6 +11,7 @@ import (
 	access_model "code.gitea.io/gitea/models/perm/access"
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/routers/api/v1/utils"
 	"code.gitea.io/gitea/services/context"
@@ -66,6 +67,13 @@ func GetStarredRepos(ctx *context.APIContext) {
 	//     "$ref": "#/responses/RepositoryList"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
 
 	private := ctx.ContextUser.ID == ctx.Doer.ID
 	repos, err := getStarredRepos(ctx, ctx.ContextUser, private)
@@ -97,6 +105,13 @@ func GetMyStarredRepos(ctx *context.APIContext) {
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/RepositoryList"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
 
 	repos, err := getStarredRepos(ctx, ctx.Doer, true)
 	if err != nil {
@@ -128,6 +143,13 @@ func IsStarring(ctx *context.APIContext) {
 	//     "$ref": "#/responses/empty"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
 
 	if repo_model.IsStaring(ctx, ctx.Doer.ID, ctx.Repo.Repository.ID) {
 		ctx.Status(http.StatusNoContent)
@@ -160,6 +182,11 @@ func Star(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
+
 	err := repo_model.StarRepo(ctx, ctx.Doer, ctx.Repo.Repository, true)
 	if err != nil {
 		if errors.Is(err, user_model.ErrBlockedUser) {
@@ -193,6 +220,13 @@ func Unstar(ctx *context.APIContext) {
 	//     "$ref": "#/responses/empty"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+
+	if setting.Repository.DisableStars {
+		ctx.Error(http.StatusForbidden, "StarsDisabled", "Stars are disabled.")
+		return
+	}
 
 	err := repo_model.StarRepo(ctx, ctx.Doer, ctx.Repo.Repository, false)
 	if err != nil {

routers/web/repo/repo.go

@@ -347,10 +347,13 @@ func Action(ctx *context.Context) {
 		err = repo_model.WatchRepo(ctx, ctx.Doer, ctx.Repo.Repository, true)
 	case "unwatch":
 		err = repo_model.WatchRepo(ctx, ctx.Doer, ctx.Repo.Repository, false)
-	case "star":
-		err = repo_model.StarRepo(ctx, ctx.Doer, ctx.Repo.Repository, true)
-	case "unstar":
-		err = repo_model.StarRepo(ctx, ctx.Doer, ctx.Repo.Repository, false)
+	case "star", "unstar":
+		if setting.Repository.DisableStars {
+			err = errors.New("stars are disabled")
+		} else {
+			err = repo_model.StarRepo(ctx, ctx.Doer,
+				ctx.Repo.Repository, ctx.PathParam("action") == "star")
+		}
 	case "accept_transfer":
 		acceptTransfer(ctx)
 		return
@@ -377,7 +380,11 @@ func Action(ctx *context.Context) {
 	case "watch", "unwatch":
 		ctx.Data["IsWatchingRepo"] = repo_model.IsWatching(ctx, ctx.Doer.ID, ctx.Repo.Repository.ID)
 	case "star", "unstar":
-		ctx.Data["IsStaringRepo"] = repo_model.IsStaring(ctx, ctx.Doer.ID, ctx.Repo.Repository.ID)
+		if setting.Repository.DisableStars {
+			ctx.Data["IsStaringRepo"] = false
+		} else {
+			ctx.Data["IsStaringRepo"] = repo_model.IsStaring(ctx, ctx.Doer.ID, ctx.Repo.Repository.ID)
+		}
 	}
 
 	// see the `hx-trigger="refreshUserCards ..."` comments in tmpl

routers/web/repo/view.go

@@ -346,6 +346,10 @@ func Watchers(ctx *context.Context) {
 
 // Stars render repository's starred users
 func Stars(ctx *context.Context) {
+	if setting.Repository.DisableStars {
+		ctx.NotFound("Stars disabled", nil)
+		return
+	}
 	ctx.Data["Title"] = ctx.Tr("repo.stargazers")
 	ctx.Data["CardsTitle"] = ctx.Tr("repo.stargazers")
 	RenderUserCards(ctx, ctx.Repo.Repository.NumStars, func(opts db.ListOptions) ([]*user_model.User, error) {