mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
Basavaraj S mandwxiaoguang
18d0ee174d
Incoming email reply tokens are embedded in every notification email and stay valid for a year. `DecodeToken` verifies them with `user.Rands`, which is not rotated when an admin disables sign-in or the account is deactivated, and `ReplyHandler` only checks repo read permission. A suspended user could therefore keep posting comments, review comments and attachments on any public repo by replying to old notifications, while the web, API, git and package paths all refuse them. `DecodeToken` now rejects tokens of users who are inactive or prohibited from signing in, which covers every incoming mail handler. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
35 lines
883 B
Go
35 lines
883 B
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package token
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
|
|
_ "gitea.dev/models"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
unittest.MainTest(m)
|
|
}
|
|
|
|
func TestDecodeTokenRejectsUserWhoCannotSignIn(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
for id, expectedErr := range map[int64]string{2: "", 3: "not a doer", 9: "inactive", 37: "prohibited"} {
|
|
token, err := CreateToken(ReplyHandlerType, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: id}), []byte{1})
|
|
require.NoError(t, err)
|
|
_, _, _, err = DecodeToken(t.Context(), token)
|
|
if expectedErr == "" {
|
|
assert.NoError(t, err)
|
|
} else {
|
|
assert.ErrorContains(t, err, expectedErr)
|
|
}
|
|
}
|
|
}
|