Skip to content

Commit 33431fc

Browse files
6543chrisshyizeripathlunnytechknowlogick
authored
Validate email before inserting/updating (#13475) (#13666)
* Add email validity check (#13475) * Improve error feedback for duplicate deploy keys Instead of a generic HTTP 500 error page, a flash message is rendered with the deploy key page template so inform the user that a key with the intended title already exists. * API returns 422 error when key with name exists * Add email validity checking Add email validity checking for the following routes: [Web interface] 1. User registration 2. User creation by admin 3. Adding an email through user settings [API] 1. POST /admin/users 2. PATCH /admin/users/:username 3. POST /user/emails * Add further tests * Add signup email tests * Add email validity check for linking existing account * Address PR comments * Remove unneeded DB session * Move email check to updateUser Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io> * skip email validation on empty string (#13627) - move validation into its own function - use a session for UpdateUserSetting * rm TODO for backport Co-authored-by: Chris Shyi <chrisshyi13@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
1 parent f2a3a91 commit 33431fc

13 files changed

Lines changed: 183 additions & 6 deletions

File tree

‎integrations/api_admin_test.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,3 +144,22 @@ func TestAPIListUsersNonAdmin(t *testing.T) {
144144
req := NewRequestf(t, "GET", "/api/v1/admin/users?token=%s", token)
145145
session.MakeRequest(t, req, http.StatusForbidden)
146146
}
147+
148+
func TestAPICreateUserInvalidEmail(t *testing.T) {
149+
defer prepareTestEnv(t)()
150+
adminUsername := "user1"
151+
session := loginUser(t, adminUsername)
152+
token := getTokenForLoggedInUser(t, session)
153+
urlStr := fmt.Sprintf("/api/v1/admin/users?token=%s", token)
154+
req := NewRequestWithValues(t, "POST", urlStr, map[string]string{
155+
"email": "invalid_email@domain.com\r\n",
156+
"full_name": "invalid user",
157+
"login_name": "invalidUser",
158+
"must_change_password": "true",
159+
"password": "password",
160+
"send_notify": "true",
161+
"source_id": "0",
162+
"username": "invalidUser",
163+
})
164+
session.MakeRequest(t, req, http.StatusUnprocessableEntity)
165+
}

‎integrations/signup_test.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@
55
package integrations
66

77
import (
8+
"fmt"
89
"net/http"
10+
"strings"
911
"testing"
1012

1113
"code.gitea.io/gitea/modules/setting"
14+
"github.com/stretchr/testify/assert"
15+
"github.com/unknwon/i18n"
1216
)
1317

1418
func TestSignup(t *testing.T) {
@@ -28,3 +32,37 @@ func TestSignup(t *testing.T) {
2832
req = NewRequest(t, "GET", "/exampleUser")
2933
MakeRequest(t, req, http.StatusOK)
3034
}
35+
36+
func TestSignupEmail(t *testing.T) {
37+
defer prepareTestEnv(t)()
38+
39+
setting.Service.EnableCaptcha = false
40+
41+
tests := []struct {
42+
email string
43+
wantStatus int
44+
wantMsg string
45+
}{
46+
{"exampleUser@example.com\r\n", http.StatusOK, i18n.Tr("en", "form.email_invalid", nil)},
47+
{"exampleUser@example.com\r", http.StatusOK, i18n.Tr("en", "form.email_invalid", nil)},
48+
{"exampleUser@example.com\n", http.StatusOK, i18n.Tr("en", "form.email_invalid", nil)},
49+
{"exampleUser@example.com", http.StatusFound, ""},
50+
}
51+
52+
for i, test := range tests {
53+
req := NewRequestWithValues(t, "POST", "/user/sign_up", map[string]string{
54+
"user_name": fmt.Sprintf("exampleUser%d", i),
55+
"email": test.email,
56+
"password": "examplePassword!1",
57+
"retype": "examplePassword!1",
58+
})
59+
resp := MakeRequest(t, req, test.wantStatus)
60+
if test.wantMsg != "" {
61+
htmlDoc := NewHTMLParser(t, resp.Body)
62+
assert.Equal(t,
63+
test.wantMsg,
64+
strings.TrimSpace(htmlDoc.doc.Find(".ui.message").Text()),
65+
)
66+
}
67+
}
68+
}

‎models/error.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,21 @@ func (err ErrEmailAlreadyUsed) Error() string {
193193
return fmt.Sprintf("e-mail already in use [email: %s]", err.Email)
194194
}
195195

196+
// ErrEmailInvalid represents an error where the email address does not comply with RFC 5322
197+
type ErrEmailInvalid struct {
198+
Email string
199+
}
200+
201+
// IsErrEmailInvalid checks if an error is an ErrEmailInvalid
202+
func IsErrEmailInvalid(err error) bool {
203+
_, ok := err.(ErrEmailInvalid)
204+
return ok
205+
}
206+
207+
func (err ErrEmailInvalid) Error() string {
208+
return fmt.Sprintf("e-mail invalid [email: %s]", err.Email)
209+
}
210+
196211
// ErrOpenIDAlreadyUsed represents a "OpenIDAlreadyUsed" kind of error.
197212
type ErrOpenIDAlreadyUsed struct {
198213
OpenID string

‎models/user.go‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -821,6 +821,10 @@ func CreateUser(u *User) (err error) {
821821
return ErrEmailAlreadyUsed{u.Email}
822822
}
823823

824+
if err = ValidateEmail(u.Email); err != nil {
825+
return err
826+
}
827+
824828
isExist, err = isEmailUsed(sess, u.Email)
825829
if err != nil {
826830
return err
@@ -963,8 +967,12 @@ func checkDupEmail(e Engine, u *User) error {
963967
return nil
964968
}
965969

966-
func updateUser(e Engine, u *User) error {
967-
_, err := e.ID(u.ID).AllCols().Update(u)
970+
func updateUser(e Engine, u *User) (err error) {
971+
u.Email = strings.ToLower(u.Email)
972+
if err = ValidateEmail(u.Email); err != nil {
973+
return err
974+
}
975+
_, err = e.ID(u.ID).AllCols().Update(u)
968976
return err
969977
}
970978

@@ -984,13 +992,21 @@ func updateUserCols(e Engine, u *User, cols ...string) error {
984992
}
985993

986994
// UpdateUserSetting updates user's settings.
987-
func UpdateUserSetting(u *User) error {
995+
func UpdateUserSetting(u *User) (err error) {
996+
sess := x.NewSession()
997+
defer sess.Close()
998+
if err = sess.Begin(); err != nil {
999+
return err
1000+
}
9881001
if !u.IsOrganization() {
989-
if err := checkDupEmail(x, u); err != nil {
1002+
if err = checkDupEmail(sess, u); err != nil {
9901003
return err
9911004
}
9921005
}
993-
return updateUser(x, u)
1006+
if err = updateUser(sess, u); err != nil {
1007+
return err
1008+
}
1009+
return sess.Commit()
9941010
}
9951011

9961012
// deleteBeans deletes all given beans, beans should contain delete conditions.

‎models/user_mail.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ package models
88
import (
99
"errors"
1010
"fmt"
11+
"net/mail"
1112
"strings"
1213

1314
"code.gitea.io/gitea/modules/log"
@@ -32,6 +33,19 @@ type EmailAddress struct {
3233
IsPrimary bool `xorm:"-"`
3334
}
3435

36+
// ValidateEmail check if email is a allowed address
37+
func ValidateEmail(email string) error {
38+
if len(email) == 0 {
39+
return nil
40+
}
41+
42+
if _, err := mail.ParseAddress(email); err != nil {
43+
return ErrEmailInvalid{email}
44+
}
45+
46+
return nil
47+
}
48+
3549
// GetEmailAddresses returns all email addresses belongs to given user.
3650
func GetEmailAddresses(uid int64) ([]*EmailAddress, error) {
3751
emails := make([]*EmailAddress, 0, 5)
@@ -143,6 +157,10 @@ func addEmailAddress(e Engine, email *EmailAddress) error {
143157
return ErrEmailAlreadyUsed{email.Email}
144158
}
145159

160+
if err = ValidateEmail(email.Email); err != nil {
161+
return err
162+
}
163+
146164
_, err = e.Insert(email)
147165
return err
148166
}
@@ -167,6 +185,9 @@ func AddEmailAddresses(emails []*EmailAddress) error {
167185
} else if used {
168186
return ErrEmailAlreadyUsed{emails[i].Email}
169187
}
188+
if err = ValidateEmail(emails[i].Email); err != nil {
189+
return err
190+
}
170191
}
171192

172193
if _, err := x.Insert(emails); err != nil {

‎models/user_test.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,21 @@ func TestCreateUser(t *testing.T) {
346346
assert.NoError(t, DeleteUser(user))
347347
}
348348

349+
func TestCreateUserInvalidEmail(t *testing.T) {
350+
user := &User{
351+
Name: "GiteaBot",
352+
Email: "GiteaBot@gitea.io\r\n",
353+
Passwd: ";p['////..-++']",
354+
IsAdmin: false,
355+
Theme: setting.UI.DefaultTheme,
356+
MustChangePassword: false,
357+
}
358+
359+
err := CreateUser(user)
360+
assert.Error(t, err)
361+
assert.True(t, IsErrEmailInvalid(err))
362+
}
363+
349364
func TestCreateUser_Issue5882(t *testing.T) {
350365

351366
// Init settings

‎options/locale/locale_en-US.ini‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,7 @@ org_name_been_taken = The organization name is already taken.
366366
team_name_been_taken = The team name is already taken.
367367
team_no_units_error = Allow access to at least one repository section.
368368
email_been_used = The email address is already used.
369+
email_invalid = The email address is invalid.
369370
openid_been_used = The OpenID address '%s' is already used.
370371
username_password_incorrect = Username or password is incorrect.
371372
password_complexity = Password does not pass complexity requirements:

‎routers/admin/users.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,9 @@ func NewUserPost(ctx *context.Context, form auth.AdminCreateUserForm) {
129129
case models.IsErrEmailAlreadyUsed(err):
130130
ctx.Data["Err_Email"] = true
131131
ctx.RenderWithErr(ctx.Tr("form.email_been_used"), tplUserNew, &form)
132+
case models.IsErrEmailInvalid(err):
133+
ctx.Data["Err_Email"] = true
134+
ctx.RenderWithErr(ctx.Tr("form.email_invalid"), tplUserNew, &form)
132135
case models.IsErrNameReserved(err):
133136
ctx.Data["Err_UserName"] = true
134137
ctx.RenderWithErr(ctx.Tr("user.form.name_reserved", err.(models.ErrNameReserved).Name), tplUserNew, &form)
@@ -277,6 +280,9 @@ func EditUserPost(ctx *context.Context, form auth.AdminEditUserForm) {
277280
if models.IsErrEmailAlreadyUsed(err) {
278281
ctx.Data["Err_Email"] = true
279282
ctx.RenderWithErr(ctx.Tr("form.email_been_used"), tplUserEdit, &form)
283+
} else if models.IsErrEmailInvalid(err) {
284+
ctx.Data["Err_Email"] = true
285+
ctx.RenderWithErr(ctx.Tr("form.email_invalid"), tplUserEdit, &form)
280286
} else {
281287
ctx.ServerError("UpdateUser", err)
282288
}

‎routers/admin/users_test.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,33 @@ func TestNewUserPost_MustChangePasswordFalse(t *testing.T) {
8787
assert.Equal(t, email, u.Email)
8888
assert.False(t, u.MustChangePassword)
8989
}
90+
91+
func TestNewUserPost_InvalidEmail(t *testing.T) {
92+
93+
models.PrepareTestEnv(t)
94+
ctx := test.MockContext(t, "admin/users/new")
95+
96+
u := models.AssertExistsAndLoadBean(t, &models.User{
97+
IsAdmin: true,
98+
ID: 2,
99+
}).(*models.User)
100+
101+
ctx.User = u
102+
103+
username := "gitea"
104+
email := "gitea@gitea.io\r\n"
105+
106+
form := auth.AdminCreateUserForm{
107+
LoginType: "local",
108+
LoginName: "local",
109+
UserName: username,
110+
Email: email,
111+
Password: "abc123ABC!=$",
112+
SendNotify: false,
113+
MustChangePassword: false,
114+
}
115+
116+
NewUserPost(ctx, form)
117+
118+
assert.NotEmpty(t, ctx.Flash.ErrorMsg)
119+
}

‎routers/api/v1/admin/user.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ func CreateUser(ctx *context.APIContext, form api.CreateUserOption) {
101101
models.IsErrEmailAlreadyUsed(err) ||
102102
models.IsErrNameReserved(err) ||
103103
models.IsErrNameCharsNotAllowed(err) ||
104+
models.IsErrEmailInvalid(err) ||
104105
models.IsErrNamePatternNotAllowed(err) {
105106
ctx.Error(http.StatusUnprocessableEntity, "", err)
106107
} else {
@@ -208,7 +209,7 @@ func EditUser(ctx *context.APIContext, form api.EditUserOption) {
208209
}
209210

210211
if err := models.UpdateUser(u); err != nil {
211-
if models.IsErrEmailAlreadyUsed(err) {
212+
if models.IsErrEmailAlreadyUsed(err) || models.IsErrEmailInvalid(err) {
212213
ctx.Error(http.StatusUnprocessableEntity, "", err)
213214
} else {
214215
ctx.Error(http.StatusInternalServerError, "UpdateUser", err)

0 commit comments

Comments
 (0)