gitea

public/gitea

0 Fork 0

mirror of https://github.com/go-gitea/gitea.git synced 2026-11-02 13:44:16 +09:00

Files

T

History

4ed6f89b60 fix(auth): only auto-link the account the external identity points to (#40121 )

With `[oauth2_client].ACCOUNT_LINKING = auto`, submitting the link
account sign-up form with a user name or email that already exists
linked the external identity to that existing account and signed in as
it, without checking that the external identity belongs to that account.

Automatic linking now only happens when the existing user matches the
external identity: its email equals the provider email, or its name
equals the user name derived from the provider (per
`[oauth2_client].USERNAME`, same as auto registration). Otherwise the
linking login page is shown, which requires the existing account's
password.

Auto registration is unchanged, since the name and email there already
come from the provider.

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Giteabot <teabot@gitea.io>

2026-10-31 18:20:56 +01:00

2fa.go

feat: Add audit logging (#38189 )

2026-09-12 08:15:23 +00:00

auth_test.go

fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686 )

2026-10-12 08:44:52 +00:00

auth.go

fix(auth): only auto-link the account the external identity points to (#40121 )

2026-10-31 18:20:56 +01:00

linkaccount.go

refactor: move go-chi/captcha into Gitea (#39529 )