From 402df1d6b461824b197c2b29166df2d66cf9ae1e Mon Sep 17 00:00:00 2001 From: Jack Hay Date: Wed, 3 May 2023 21:21:58 -0400 Subject: [PATCH] Prevent a user with a different email from accepting the team invite (#24491) ## Changes - Fixes the case where a logged in user can accept an email invitation even if their email address does not match the address in the invitation --- options/locale/locale_en-US.ini | 1 + routers/web/org/teams.go | 8 ++++++++ templates/org/team/invite.tmpl | 28 +++++++++++++++++----------- 3 files changed, 26 insertions(+), 11 deletions(-) diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini index b4d5ba00bc..180fd1c18d 100644 --- a/options/locale/locale_en-US.ini +++ b/options/locale/locale_en-US.ini @@ -2559,6 +2559,7 @@ teams.all_repositories_admin_permission_desc = This team grants Admin%s in organization %s. teams.invite.by = Invited by %s teams.invite.description = Please click the button below to join the team. +teams.invite.email_mismatch = Your email address does not match this invite. [admin] dashboard = Dashboard diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go index 2ce4bf5322..9a0f49b688 100644 --- a/routers/web/org/teams.go +++ b/routers/web/org/teams.go @@ -552,6 +552,7 @@ func TeamInvite(ctx *context.Context) { ctx.Data["Organization"] = org ctx.Data["Team"] = team ctx.Data["Inviter"] = inviter + ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email ctx.HTML(http.StatusOK, tplTeamInvite) } @@ -568,6 +569,13 @@ func TeamInvitePost(ctx *context.Context) { return } + // check that the Doer is the invitee + if ctx.Doer.Email != invite.Email { + log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID) + ctx.NotFound("ErrTeamInviteNotFound", err) + return + } + if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil { ctx.ServerError("AddTeamMember", err) return diff --git a/templates/org/team/invite.tmpl b/templates/org/team/invite.tmpl index 55ecd049b3..8d1fad0141 100644 --- a/templates/org/team/invite.tmpl +++ b/templates/org/team/invite.tmpl @@ -6,17 +6,23 @@
{{avatar $.Context .Organization 140}}
-
-
{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}
-
{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}
-
{{.locale.Tr "org.teams.invite.description"}}
-
-
-
- {{.CsrfTokenHtml}} - -
-
+ {{if .EmailMismatch}} +
+
{{.locale.Tr "org.teams.invite.email_mismatch"}}
+
+ {{else}} +
+
{{.locale.Tr "org.teams.invite.title" .Team.Name .Organization.Name | Str2html}}
+
{{.locale.Tr "org.teams.invite.by" .Inviter.Name}}
+
{{.locale.Tr "org.teams.invite.description"}}
+
+
+
+ {{.CsrfTokenHtml}} + +
+
+ {{end}}