mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

[MM-39205] Check that emails match during sign-up (#18635)

Просмотр исходного кода
Этот коммит содержится в:
Allan Guwatudde
2021-10-18 09:34:10 +03:00
коммит произвёл GitHub
родитель e6f36f0649
Коммит 609fea0002
3 изменённых файлов: 33 добавлений и 9 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

5
app/user.go
Просмотреть файл

@@ -72,6 +72,11 @@ func (a *App) CreateUserWithToken(c *request.Context, user *model.User, token *m
return nil, model.NewAppError("CreateUserWithToken", "app.channel.get_channels_by_ids.app_error", nil, nErr.Error(), http.StatusInternalServerError)
}
emailFromToken := tokenData["email"]
if emailFromToken != user.Email {
return nil, model.NewAppError("CreateUserWithToken", "api.user.create_user.bad_token_email_data.app_error", nil, "", http.StatusBadRequest)
}
user.Email = tokenData["email"]
user.EmailVerified = true

33
app/user_test.go
Просмотреть файл

@@ -743,6 +743,18 @@ func TestCreateUserWithToken(t *testing.T) {
require.NotNil(t, err, "Should fail on bad token type")
})
t.Run("token extra email does not match provided user data email", func(t *testing.T) {
invitationEmail := "attacker@test.com"
token := model.NewToken(
TokenTypeTeamInvitation,
model.MapToJSON(map[string]string{"teamId": th.BasicTeam.Id, "email": invitationEmail}),
)
require.NoError(t, th.App.Srv().Store.Token().Save(token))
_, err := th.App.CreateUserWithToken(th.Context, &user, token)
require.NotNil(t, err)
})
t.Run("expired token", func(t *testing.T) {
token := model.NewToken(
TokenTypeTeamInvitation,
@@ -767,13 +779,14 @@ func TestCreateUserWithToken(t *testing.T) {
})
t.Run("valid regular user request", func(t *testing.T) {
invitationEmail := model.NewId() + "other-email@test.com"
invitationEmail := strings.ToLower(model.NewId()) + "other-email@test.com"
u := model.User{Email: invitationEmail, Nickname: "Darth Vader", Username: "vader" + model.NewId(), Password: "passwd1", AuthService: ""}
token := model.NewToken(
TokenTypeTeamInvitation,
model.MapToJSON(map[string]string{"teamId": th.BasicTeam.Id, "email": invitationEmail}),
)
require.NoError(t, th.App.Srv().Store.Token().Save(token))
newUser, err := th.App.CreateUserWithToken(th.Context, &user, token)
newUser, err := th.App.CreateUserWithToken(th.Context, &u, token)
require.Nil(t, err, "Should add user to the team. err=%v", err)
assert.False(t, newUser.IsGuest())
require.Equal(t, invitationEmail, newUser.Email, "The user email must be the invitation one")
@@ -787,13 +800,14 @@ func TestCreateUserWithToken(t *testing.T) {
})
t.Run("valid guest request", func(t *testing.T) {
invitationEmail := model.NewId() + "other-email@test.com"
invitationEmail := strings.ToLower(model.NewId()) + "other-email@test.com"
token := model.NewToken(
TokenTypeGuestInvitation,
model.MapToJSON(map[string]string{"teamId": th.BasicTeam.Id, "email": invitationEmail, "channels": th.BasicChannel.Id}),
)
require.NoError(t, th.App.Srv().Store.Token().Save(token))
guest := model.User{Email: strings.ToLower(model.NewId()) + "success+test@example.com", Nickname: "Darth Vader", Username: "vader" + model.NewId(), Password: "passwd1", AuthService: ""}
guest := model.User{Email: invitationEmail, Nickname: "Darth Vader", Username: "vader" + model.NewId(), Password: "passwd1", AuthService: ""}
newGuest, err := th.App.CreateUserWithToken(th.Context, &guest, token)
require.Nil(t, err, "Should add user to the team. err=%v", err)
@@ -816,8 +830,8 @@ func TestCreateUserWithToken(t *testing.T) {
})
}()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.RestrictCreationToDomains = "restricted.com" })
forbiddenInvitationEmail := model.NewId() + "other-email@test.com"
grantedInvitationEmail := model.NewId() + "other-email@restricted.com"
forbiddenInvitationEmail := strings.ToLower(model.NewId()) + "other-email@test.com"
grantedInvitationEmail := strings.ToLower(model.NewId()) + "other-email@restricted.com"
forbiddenDomainToken := model.NewToken(
TokenTypeGuestInvitation,
model.MapToJSON(map[string]string{"teamId": th.BasicTeam.Id, "email": forbiddenInvitationEmail, "channels": th.BasicChannel.Id}),
@@ -829,7 +843,7 @@ func TestCreateUserWithToken(t *testing.T) {
require.NoError(t, th.App.Srv().Store.Token().Save(forbiddenDomainToken))
require.NoError(t, th.App.Srv().Store.Token().Save(grantedDomainToken))
guest := model.User{
Email: strings.ToLower(model.NewId()) + "+test@example.com",
Email: forbiddenInvitationEmail,
Nickname: "Darth Vader",
Username: "vader" + model.NewId(),
Password: "passwd1",
@@ -840,6 +854,7 @@ func TestCreateUserWithToken(t *testing.T) {
require.Nil(t, newGuest)
assert.Equal(t, "api.user.create_user.accepted_domain.app_error", err.Id)
guest.Email = grantedInvitationEmail
newGuest, err = th.App.CreateUserWithToken(th.Context, &guest, grantedDomainToken)
require.Nil(t, err)
assert.True(t, newGuest.IsGuest())
@@ -864,14 +879,14 @@ func TestCreateUserWithToken(t *testing.T) {
})
}()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.RestrictCreationToDomains = "restricted.com" })
invitationEmail := model.NewId() + "other-email@test.com"
invitationEmail := strings.ToLower(model.NewId()) + "other-email@test.com"
token := model.NewToken(
TokenTypeGuestInvitation,
model.MapToJSON(map[string]string{"teamId": th.BasicTeam.Id, "email": invitationEmail, "channels": th.BasicChannel.Id}),
)
require.NoError(t, th.App.Srv().Store.Token().Save(token))
guest := model.User{
Email: strings.ToLower(model.NewId()) + "+test@example.com",
Email: invitationEmail,
Nickname: "Darth Vader",
Username: "vader" + model.NewId(),
Password: "passwd1",

4
i18n/en.json
Просмотреть файл

@@ -3871,6 +3871,10 @@
"id": "api.user.create_user.accepted_domain.app_error",
"translation": "The email you provided does not belong to an accepted domain. Please contact your administrator or sign up with a different email."
},
{
"id": "api.user.create_user.bad_token_email_data.app_error",
"translation": "The email address in the token does not match the one in the user data."
},
{
"id": "api.user.create_user.disabled.app_error",
"translation": "User creation is disabled."