[api] exclude unlisted repos from repo search

and thereby from being accidentally discovered or searched

routes/api/v1/repo/repo.go

@@ -70,11 +70,13 @@ func Search(c *context.APIContext) {
 
 	results := make([]*api.Repository, len(repos))
 	for i := range repos {
-		rep := repos[i].APIFormat(nil)
-		if ! c.IsLogged {
-			rep.Owner.Email = ""
+		if !repos[i].Unlisted {
+			rep := repos[i].APIFormat(nil)
+			if ! c.IsLogged {
+				rep.Owner.Email = ""
+			}
+			results[i] = rep
 		}
-		results[i] = rep
 	}
 
 	c.SetLinkHeader(int(count), setting.API.MaxResponseItems)