From 6706ac2a0f5f2fe4f8e2555be7e2a8b4d5946398 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Tue, 28 Mar 2023 05:27:32 +0800
Subject: [PATCH] Fix profile page email display, respect settings (#23747)

Always respect the `setting.UI.ShowUserEmail` and `KeepEmailPrivate`
setting.

* It doesn't make sense to show user's own E-mail to themself.
* Always hide the E-mail if KeepEmailPrivate=true, then the user could
know how their profile page looks like for others.
* Revert the `setting.UI.ShowUserEmail` change from #4981 . This setting
is used to control the E-mail display, not only for the user list page.

ps: the incorrect `<div .../>` tag on the profile page has been fixed by
#23748 together, so this PR becomes simpler.
---
 routers/web/user/profile.go       |  2 +-
 tests/integration/setting_test.go | 53 +++++++++++++++++++------------
 2 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/routers/web/user/profile.go b/routers/web/user/profile.go
index f4d458c040..d690fa4d01 100644
--- a/routers/web/user/profile.go
+++ b/routers/web/user/profile.go
@@ -308,7 +308,7 @@ func Profile(ctx *context.Context) {
 	ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 
-	ctx.Data["ShowUserEmail"] = len(ctx.ContextUser.Email) > 0 && ctx.IsSigned && (!ctx.ContextUser.KeepEmailPrivate || ctx.ContextUser.ID == ctx.Doer.ID)
+	ctx.Data["ShowUserEmail"] = setting.UI.ShowUserEmail && ctx.ContextUser.Email != "" && ctx.IsSigned && !ctx.ContextUser.KeepEmailPrivate
 
 	ctx.HTML(http.StatusOK, tplProfile)
 }
diff --git a/tests/integration/setting_test.go b/tests/integration/setting_test.go
index 71b28a6258..54819c5b7d 100644
--- a/tests/integration/setting_test.go
+++ b/tests/integration/setting_test.go
@@ -45,38 +45,49 @@ func TestSettingShowUserEmailProfile(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
 	showUserEmail := setting.UI.ShowUserEmail
+
+	// user1: keep_email_private = false, user2: keep_email_private = true
+
 	setting.UI.ShowUserEmail = true
 
-	session := loginUser(t, "user2")
-	req := NewRequest(t, "GET", "/user2")
+	// user1 can see self
+	session := loginUser(t, "user1")
+	req := NewRequest(t, "GET", "/user1")
 	resp := session.MakeRequest(t, req, http.StatusOK)
 	htmlDoc := NewHTMLParser(t, resp.Body)
-	assert.Contains(t,
-		htmlDoc.doc.Find(".user.profile").Text(),
-		"user2@example.com",
-	)
+	assert.Contains(t, htmlDoc.doc.Find(".user.profile").Text(), "user1@example.com")
+
+	// user1 can not see user2
+	req = NewRequest(t, "GET", "/user2")
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc = NewHTMLParser(t, resp.Body)
+	// Should not contain even if the user visits their own profile page
+	assert.NotContains(t, htmlDoc.doc.Find(".user.profile").Text(), "user2@example.com")
+
+	// user2 can see user1
+	session = loginUser(t, "user2")
+	req = NewRequest(t, "GET", "/user1")
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc = NewHTMLParser(t, resp.Body)
+	assert.Contains(t, htmlDoc.doc.Find(".user.profile").Text(), "user1@example.com")
+
+	// user2 can not see self
+	session = loginUser(t, "user2")
+	req = NewRequest(t, "GET", "/user2")
+	resp = session.MakeRequest(t, req, http.StatusOK)
+	htmlDoc = NewHTMLParser(t, resp.Body)
+	assert.NotContains(t, htmlDoc.doc.Find(".user.profile").Text(), "user2@example.com")
 
 	setting.UI.ShowUserEmail = false
 
-	req = NewRequest(t, "GET", "/user2")
+	// user1 can not see self
+	session = loginUser(t, "user1")
+	req = NewRequest(t, "GET", "/user1")
 	resp = session.MakeRequest(t, req, http.StatusOK)
 	htmlDoc = NewHTMLParser(t, resp.Body)
-	// Should contain since this user owns the profile page
-	assert.Contains(t,
-		htmlDoc.doc.Find(".user.profile").Text(),
-		"user2@example.com",
-	)
+	assert.NotContains(t, htmlDoc.doc.Find(".user.profile").Text(), "user1@example.com")
 
 	setting.UI.ShowUserEmail = showUserEmail
-
-	session = loginUser(t, "user4")
-	req = NewRequest(t, "GET", "/user2")
-	resp = session.MakeRequest(t, req, http.StatusOK)
-	htmlDoc = NewHTMLParser(t, resp.Body)
-	assert.NotContains(t,
-		htmlDoc.doc.Find(".user.profile").Text(),
-		"user2@example.com",
-	)
 }
 
 func TestSettingLandingPage(t *testing.T) {