From bf385a169dde8056308e4fd2eccaa142b9d46987 Mon Sep 17 00:00:00 2001
From: Jack Hay <jack@allspice.io>
Date: Wed, 3 May 2023 21:21:58 -0400
Subject: [PATCH] Prevent a user with a different email from accepting the team
 invite (#24491)

## Changes
- Fixes the case where a logged in user can accept an email invitation
even if their email address does not match the address in the invitation
---
 options/locale/locale_en-US.ini |  1 +
 routers/web/org/teams.go        |  8 ++++++++
 templates/org/team/invite.tmpl  | 28 +++++++++++++++++-----------
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 8169cba10845a..30de16217093b 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -2490,6 +2490,7 @@ teams.all_repositories_admin_permission_desc = This team grants <strong>Admin</s
 teams.invite.title = You've been invited to join team <strong>%s</strong> in organization <strong>%s</strong>.
 teams.invite.by = Invited by %s
 teams.invite.description = Please click the button below to join the team.
+teams.invite.email_mismatch = Your email address does not match this invite.
 
 [admin]
 dashboard = Dashboard
diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go
index 1ed7980145491..d4c2eb844b1e9 100644
--- a/routers/web/org/teams.go
+++ b/routers/web/org/teams.go
@@ -536,6 +536,7 @@ func TeamInvite(ctx *context.Context) {
 	ctx.Data["Organization"] = org
 	ctx.Data["Team"] = team
 	ctx.Data["Inviter"] = inviter
+	ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email
 
 	ctx.HTML(http.StatusOK, tplTeamInvite)
 }
@@ -552,6 +553,13 @@ func TeamInvitePost(ctx *context.Context) {
 		return
 	}
 
+	// check that the Doer is the invitee
+	if ctx.Doer.Email != invite.Email {
+		log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID)
+		ctx.NotFound("ErrTeamInviteNotFound", err)
+		return
+	}
+
 	if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil {
 		ctx.ServerError("AddTeamMember", err)
 		return
diff --git a/templates/org/team/invite.tmpl b/templates/org/team/invite.tmpl
index 55ecd049b39d0..8d1fad0141657 100644
--- a/templates/org/team/invite.tmpl
+++ b/templates/org/team/invite.tmpl
@@ -6,17 +6,23 @@
 			<div class="image">
 				{{avatar $.Context .Organization 140}}
 			</div>
-			<div class="content">
-				<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
-				<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
-				<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
-			</div>
-			<div class="extra content">
-				<form class="ui form" action="" method="post">
-					{{.CsrfTokenHtml}}
-					<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
-				</form>
-			</div>
+			{{if .EmailMismatch}}
+				<div class="content">
+					<div class="header">{{.locale.Tr "org.teams.invite.email_mismatch"}}</div>
+				</div>
+			{{else}}
+				<div class="content">
+					<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
+					<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
+					<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
+				</div>
+				<div class="extra content">
+					<form class="ui form" action="" method="post">
+						{{.CsrfTokenHtml}}
+						<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
+					</form>
+				</div>
+			{{end}}
 		</div>
 	</div>
 </div>