feat: adds "actor" as a protected / forbidden username (#13077)

The username used for the activitypub server actor, "actor" (internal userid -3), was freely available to be registered for any user.
With this patch, it's added to the reversed username list to prevent future creations of such accounts.
Existing users will not be impacted and need to be manually resolved.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13077
This commit is contained in:
Mai-Lapyst 2026-07-04 16:01:31 +02:00 committed by Gusted
commit 7a3d9b486e

View file

@ -677,6 +677,7 @@ var (
"ghost", // reserved name for deleted users (id: -1)
"gitea-actions", // gitea builtin user (id: -2)
"forgejo-actions", // forgejo builtin user (id: -2)
"actor", // user for activitypub / federation (id: -3)
}
// These names are reserved for user accounts: user's keys, user's rss feed, user's avatar, etc.