pprof is public accessible even when ENABLE_PPROF=false

[krombel]

• Gitea version (or commit ref): 364c029
• Can you reproduce the bug at https://try.gitea.io:
  • Yes: e.g. https://try.gitea.io/debug/pprof/heap?debug=1

Description

I do not expect to have those debug information public available.

Those get added in go-macaron/toolbox

gitea/vendor/github.com/go-macaron/toolbox/toolbox.go

Lines 136 to 140 in 364c029

	m.Any(path.Join(opt.PprofURLPrefix, "cmdline"), pprof.Cmdline)
	m.Any(path.Join(opt.PprofURLPrefix, "profile"), pprof.Profile)
	m.Any(path.Join(opt.PprofURLPrefix, "symbol"), pprof.Symbol)
	m.Any(opt.PprofURLPrefix, pprof.Index)
	m.Any(path.Join(opt.PprofURLPrefix, "*"), pprof.Index)

which got added in #1290:

gitea/routers/routes/routes.go

Lines 127 to 134 in 364c029

	m.Use(toolbox.Toolboxer(m, toolbox.Options{
	HealthCheckFuncs: []*toolbox.HealthCheckFuncDesc{
	{
	Desc: "Database connection",
	Func: models.Ping,
	},
	},
	}))

Badly there does not seem to be an option to disable this without removing the Toolbox completly.

//EDIT: As a temporary workaround I added this to my nginx config:

        location /debug {
                return 403;
        }

[L-P]

I can confirm this issue is present on the official v1.5.1 docker image.