Skip to content

Commit

Permalink
Prevent a user with a different email from accepting the team invite (g…
Browse files Browse the repository at this point in the history
…o-gitea#24491)

## Changes
- Fixes the case where a logged in user can accept an email invitation
even if their email address does not match the address in the invitation
  • Loading branch information
jackHay22 authored and GiteaBot committed May 4, 2023
1 parent 8ceb78c commit bf385a1
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 11 deletions.
1 change: 1 addition & 0 deletions options/locale/locale_en-US.ini
Original file line number Diff line number Diff line change
Expand Up @@ -2490,6 +2490,7 @@ teams.all_repositories_admin_permission_desc = This team grants <strong>Admin</s
teams.invite.title = You've been invited to join team <strong>%s</strong> in organization <strong>%s</strong>.
teams.invite.by = Invited by %s
teams.invite.description = Please click the button below to join the team.
teams.invite.email_mismatch = Your email address does not match this invite.
[admin]
dashboard = Dashboard
Expand Down
8 changes: 8 additions & 0 deletions routers/web/org/teams.go
Original file line number Diff line number Diff line change
Expand Up @@ -536,6 +536,7 @@ func TeamInvite(ctx *context.Context) {
ctx.Data["Organization"] = org
ctx.Data["Team"] = team
ctx.Data["Inviter"] = inviter
ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email

ctx.HTML(http.StatusOK, tplTeamInvite)
}
Expand All @@ -552,6 +553,13 @@ func TeamInvitePost(ctx *context.Context) {
return
}

// check that the Doer is the invitee
if ctx.Doer.Email != invite.Email {
log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID)
ctx.NotFound("ErrTeamInviteNotFound", err)
return
}

if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil {
ctx.ServerError("AddTeamMember", err)
return
Expand Down
28 changes: 17 additions & 11 deletions templates/org/team/invite.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,23 @@
<div class="image">
{{avatar $.Context .Organization 140}}
</div>
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
</div>
<div class="extra content">
<form class="ui form" action="" method="post">
{{.CsrfTokenHtml}}
<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
</form>
</div>
{{if .EmailMismatch}}
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.email_mismatch"}}</div>
</div>
{{else}}
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
</div>
<div class="extra content">
<form class="ui form" action="" method="post">
{{.CsrfTokenHtml}}
<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
</form>
</div>
{{end}}
</div>
</div>
</div>
Expand Down

0 comments on commit bf385a1

Please sign in to comment.