Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent a user with a different email from accepting the team invite #24491

Merged
merged 5 commits into from
May 4, 2023
Merged

Prevent a user with a different email from accepting the team invite #24491

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2296400
prevent a user with a different email from accepting the team invite
jackHay22 May 2, 2023
0427c58
formatting fix
jackHay22 May 2, 2023
5df30d9
Merge branch 'main' into jh/fix-prevent-different-email-invite
GiteaBot May 3, 2023
01e6665
Merge branch 'main' into jh/fix-prevent-different-email-invite
GiteaBot May 3, 2023
e7e8140
Merge branch 'main' into jh/fix-prevent-different-email-invite
GiteaBot May 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions options/locale/locale_en-US.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2559,6 +2559,7 @@ teams.all_repositories_admin_permission_desc = This team grants <strong>Admin</s
teams.invite.title = You've been invited to join team <strong>%s</strong> in organization <strong>%s</strong>.
teams.invite.by = Invited by %s
teams.invite.description = Please click the button below to join the team.
teams.invite.email_mismatch = Your email address does not match this invite.

[admin]
dashboard = Dashboard
Expand Down
8 changes: 8 additions & 0 deletions routers/web/org/teams.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -552,6 +552,7 @@ func TeamInvite(ctx *context.Context) {
ctx.Data["Organization"] = org
ctx.Data["Team"] = team
ctx.Data["Inviter"] = inviter
ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email

ctx.HTML(http.StatusOK, tplTeamInvite)
}
Expand All @@ -568,6 +569,13 @@ func TeamInvitePost(ctx *context.Context) {
return
}

// check that the Doer is the invitee
if ctx.Doer.Email != invite.Email {
log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID)
ctx.NotFound("ErrTeamInviteNotFound", err)
return
}

if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil {
ctx.ServerError("AddTeamMember", err)
return
Expand Down
28 changes: 17 additions & 11 deletions templates/org/team/invite.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,23 @@
<div class="image">
{{avatar $.Context .Organization 140}}
</div>
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
</div>
<div class="extra content">
<form class="ui form" action="" method="post">
{{.CsrfTokenHtml}}
<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
</form>
</div>
{{if .EmailMismatch}}
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.email_mismatch"}}</div>
</div>
{{else}}
<div class="content">
<div class="header">{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}</div>
<div class="meta">{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}</div>
<div class="description">{{.locale.Tr "org.teams.invite.description"}}</div>
</div>
<div class="extra content">
<form class="ui form" action="" method="post">
{{.CsrfTokenHtml}}
<button class="fluid ui green button">{{.locale.Tr "org.teams.join"}}</button>
</form>
</div>
{{end}}
</div>
</div>
</div>
Expand Down