forgejo/services
floss4good d5fa12ded1
Some checks failed
/ release (push) Has been cancelled
testing-integration / test-unit (push) Has been cancelled
testing-integration / test-sqlite (push) Has been cancelled
testing-integration / test-mariadb (v10.6) (push) Has been cancelled
testing-integration / test-mariadb (v11.8) (push) Has been cancelled
testing / backend-checks (push) Has been cancelled
testing / frontend-checks (push) Has been cancelled
testing / test-unit (push) Has been cancelled
testing / test-e2e (push) Has been cancelled
testing / test-remote-cacher (redis) (push) Has been cancelled
testing / test-remote-cacher (valkey) (push) Has been cancelled
testing / test-remote-cacher (garnet) (push) Has been cancelled
testing / test-remote-cacher (redict) (push) Has been cancelled
testing / test-mysql (push) Has been cancelled
testing / test-pgsql (push) Has been cancelled
testing / test-sqlite (push) Has been cancelled
testing / security-check (push) Has been cancelled
feat: add admin moderation actions for abuse reports and for reported abusive content (#8716)
- Implementation of milestone 6. from **Task F. Moderation features: Reporting** (part of [amendment of the workplan](https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet/2025-02-07-extended-workplan.md#task-f-moderation-features-reporting) for NLnet 2022-12-035):
  `6. Forgejo admins can perform common actions on the listed reports (content deletion, locking of user account)`

---

Follow-up of !7905 (and !6977)

---

This adds some action buttons within the _Moderation reports_ section (/admin/moderation/reports) within the _Site administration_ page, so that administrators can:
- mark a report as Handled or as Ignored (without performing any action on the reported content);
- mark a user account as suspended (set `prohibit_login` = true);
- delete (and purge) a user / organization and mark the linked reports as Handled;
- delete a repository and mark the linked reports as Handled;
- delete an issue / pull request and mark the linked reports as Handled;
- delete a comment and mark the linked reports as Handled;

The buttons were added on the sight side of each report from the overview, below the existing counter (that show how many times the content was reported and opens the details page). Only the buttons for updating the status of the report are directly visible - as `✓` and `✗` icons with some tooltips - while the content actions are hidden under a `⋯` dropdown.
The implementation was done using HTMX so that the page is not refreshed after each action.

Some discussions regarding the UI/UX started with https://codeberg.org/forgejo/design/issues/30#issuecomment-5958634

### Manual testing
- First make sure that moderation in enabled ([moderation] ENABLED config is set as true within app.ini).
- Report multiple users, organizations, repositories, issues, pull requests and comments.
- Go to _Moderation reports_ overview section section and make sure the buttons are visible;
  - The `✓` and `✗` should be available for each shown report;
  - The horizontal dropdown menu (`⋯`) should not be visible for reports linked to already deleted content.
- The actions available within the dropdown menu should correspond to the reported content type (e.g. 'Suspend account' and 'Delete account' for users/organizations, 'Delete repository' for repositories, etc.).
- When an action is successful a flash message should be displayed above the overview.
- Warnings should be displayed (as flash messages) when trying to suspend or delete your account (in case someone reported you) or an organization.
- An info (flash message) should be displayed when trying to suspend a user that is already suspended.
- Mark a report as Handled / Ignored and observe that a success flash message confirms the action and the report is removed from the list without reloading the page;
  - Refresh the page to make sure the report will not be loaded again (also check in the DB that the status was updated and the resolved timestamp is correctly set).
- Suspend a user account and make sure the report remains in the list (it is not resolved);
  - Make sure the above user gets the 'Suspended account' notice after login.
- Delete a user account and observe that a success flash message confirms the action and the report is removed from the list without reloading the page;
  - Make sure that all owned organizations and repositories as well as all the issues, PRs and comments posted in other repositories were deleted;
  - Make sure the linked abuse reports are marked as Handled (and resolved timestamp is set).
- Delete an organization and make sure that owned repositories were also deleted.
- Similarly, delete a repository / issue / PR / comment and check that the contents are not available any more and the linked reports are resolved.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8716
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: floss4good <floss4good@disroot.org>
Co-committed-by: floss4good <floss4good@disroot.org>
2025-12-03 20:07:32 +01:00
..
actions refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
agit fix: correctly mark reviews as stale for AGit PRs (#8450) 2025-07-09 07:38:00 +02:00
asymkey chore: do not clobber ~/.ssh/authorized_keys in certain tests (#10163) 2025-11-19 16:14:16 +01:00
attachment fix: allow instance API URLs in release assets (#7644) 2025-06-09 10:01:59 +02:00
auth feat: allow sync quota groups with oauth2 auth source (#8554) 2025-12-01 14:12:00 +01:00
automerge fix: check PR reference on base repository (#8431) 2025-07-06 14:23:47 +02:00
context feat: UI for the pull request trust management panel 2025-11-06 11:07:39 +01:00
contexttest Replace the 'relative-time' element scripting with custom, translatable rewrite (#6154) 2025-05-03 14:11:01 +00:00
convert chore: ensure consistent import aliasing for services and models (#10253) 2025-11-30 17:00:57 +01:00
cron fix: garbage collect lingering actions logs (#10009) 2025-11-18 18:59:01 +01:00
doctor feat: ensure only expected ssh public keys are in authorized_keys file (#10010) 2025-11-09 01:06:04 +01:00
externalaccount chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
f3 chore: ensure consistent import aliasing for services and models (#10253) 2025-11-30 17:00:57 +01:00
federation bug: signature: modify URL after error check (#10204) 2025-12-03 16:53:19 +01:00
feed fix: very long commit messages cause pushed commits to fail to display on the action feed on MySQL (#9098) 2025-08-30 22:23:43 +02:00
forgejo chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
forms feat: allow sync quota groups with oauth2 auth source (#8554) 2025-12-01 14:12:00 +01:00
gitdiff feat: improve getting shortstat (#9587) 2025-10-10 14:15:38 +02:00
indexer chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
issue refactor: migrate from lib/pq to jackc/pgx (#10219) 2025-11-30 17:47:45 +01:00
lfs fix: return on error if an LFS token cannot be parsed 2025-10-25 10:41:49 -06:00
mailer chore: ensure consistent import aliasing for services and models (#10253) 2025-11-30 17:00:57 +01:00
markup chore: remove branding from context imports (#9628) 2025-10-11 01:52:51 +02:00
migrations fix: handle empty dates in pagure milestone migration (#10169) 2025-12-02 07:34:50 +01:00
mirror chore: two small refactors in git module (#10109) 2025-11-15 13:24:00 +01:00
moderation feat: add admin moderation actions for abuse reports and for reported abusive content (#8716) 2025-12-03 20:07:32 +01:00
notify chore: Dead Code: DeleteIssue Notify Topic (#10046) 2025-11-17 02:13:38 +01:00
org chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
packages fix: ensure deleted Debian package does not remain referenced in the apt repository files (#9386) 2025-10-01 03:11:03 +02:00
pull chore: move code for manual merges into merge_manual.go (#10141) 2025-11-28 07:57:31 +01:00
redirect chore: add repo redirect unit test 2025-08-30 09:37:38 +02:00
release 2025-11-21 combined security patches (#10037) 2025-11-21 05:23:43 +01:00
remote chore: tune down remote user promotion debug message shown as error (#7687) 2025-04-27 20:50:48 +00:00
repository chore: ensure consistent import aliasing for services and models (#10253) 2025-11-30 17:00:57 +01:00
secrets feat: migrate action secrets to keying to store them more securely (#8692) 2025-07-29 01:03:36 +02:00
shared/automerge fix: suppress false-positive error log when PR is already in the automerge queue (#9784) 2025-10-21 08:19:33 +02:00
stats fix: possible cause of invalid issue counts; cache invalidation occurs before a active transaction is committed (#10130) 2025-11-17 01:07:29 +01:00
task feat: cache derived keys for faster keying (#10114) 2025-11-16 14:29:14 +01:00
uinotification chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
user chore: ensure consistent import aliasing for services and models (#10253) 2025-11-30 17:00:57 +01:00
webhook feat: place user names into inline code blocks for Slack (#10147) 2025-11-25 23:24:05 +01:00
wiki chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00