Merge pull request #8796 from pelson/honour_user_site

Disallow --user installs if site.ENABLE_USER_SITE is False.

Author: notatallshaw

news/8794.bugfix.rst

@@ -0,0 +1 @@
+Prevent --user installs if site.ENABLE_USER_SITE is set to False.

src/pip/_internal/commands/install.py

@@ -687,6 +687,7 @@ def decide_user_install(
         logger.debug("Non-user install by explicit request")
         return False
 
+    # If we have been asked for a user install explicitly, check compatibility.
     if use_user_site:
         if prefix_path:
             raise CommandError(
@@ -698,6 +699,13 @@ def decide_user_install(
                 "Can not perform a '--user' install. User site-packages "
                 "are not visible in this virtualenv."
             )
+        # Catch all remaining cases which honour the site.ENABLE_USER_SITE
+        # value, such as a plain Python installation (e.g. no virtualenv).
+        if not site.ENABLE_USER_SITE:
+            raise InstallationError(
+                "Can not perform a '--user' install. User site-packages "
+                "are disabled for this Python."
+            )
         logger.debug("User install by explicit request")
         return True
 

tests/functional/test_install_user.py

@@ -328,3 +328,51 @@ def test_install_user_in_global_virtualenv_with_conflict_fails(
             f"Will not install to the user site because it will lack sys.path "
             f"precedence to pkg in {dist_location}"
         ) in result2.stderr
+
+    def test_install_user_nositepkgs_fails(
+        self,
+        script: PipTestEnvironment,
+        data: TestData,
+    ) -> None:
+        """
+        Test that --user install fails when user site-packages are disabled.
+        """
+        create_basic_wheel_for_package(script, "pkg", "0.1")
+
+        # Create a custom Python script that disables user site and runs pip via exec
+        test_script = script.scratch_path / "test_disable_user_site.py"
+        test_script.write_text(
+            textwrap.dedent(
+                f"""
+            import site
+            import sys
+
+            # Make sys.base_prefix equal to sys.prefix to simulate not being in a venv
+            # This ensures virtualenv_no_global() returns False, so we test the
+            # site.ENABLE_USER_SITE path
+            sys.base_prefix = sys.prefix
+            site.ENABLE_USER_SITE = False
+
+            # Set up sys.argv to simulate running pip install --user
+            sys.argv = [
+                "pip", "install",
+                "--no-cache-dir",
+                "--no-index",
+                "--find-links",
+                r"{script.scratch_path}",
+                "pkg",
+                "--user"
+            ]
+
+            # Import and run pip's main
+            from pip._internal.cli.main import main
+            sys.exit(main())
+            """
+            )
+        )
+
+        result = script.run("python", str(test_script), expect_error=True)
+        assert (
+            "Can not perform a '--user' install. User site-packages are "
+            "disabled for this Python." in result.stderr
+        )