mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
1eee73e9bd
Backport #39833 by @basavaraj-sm05 Incoming email reply tokens stay valid for a year and are verified with `user.Rands`, which is not rotated when an account is deactivated or prohibited from signing in. A suspended user could therefore keep commenting on public repos by replying to old notifications. `DecodeToken` now rejects tokens of organizations, inactive users and users prohibited from signing in, which covers every incoming mail handler. Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
35 lines
883 B
Go
35 lines
883 B
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package token
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
|
|
_ "gitea.dev/models"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
unittest.MainTest(m)
|
|
}
|
|
|
|
func TestDecodeTokenRejectsUserWhoCannotSignIn(t *testing.T) {
|
|
require.NoError(t, unittest.PrepareTestDatabase())
|
|
for id, expectedErr := range map[int64]string{2: "", 3: "not a doer", 9: "inactive", 37: "prohibited"} {
|
|
token, err := CreateToken(ReplyHandlerType, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: id}), []byte{1})
|
|
require.NoError(t, err)
|
|
_, _, _, err = DecodeToken(t.Context(), token)
|
|
if expectedErr == "" {
|
|
assert.NoError(t, err)
|
|
} else {
|
|
assert.ErrorContains(t, err, expectedErr)
|
|
}
|
|
}
|
|
}
|