Duplicated and obsolete email change on user profile page

[WildCryptoFox]

REDACTED. See email to security@gitea.io.

[ashimokawa]

What we did on codeberg.org is to just forbid to change the email there, it must be done in the account settings and then the primary email can be switched after confirming. So we just patched out the feature to do it in the settings directly.

We did not open an issue here but contacted you in January via the official way of reporting security problems.

[WildCryptoFox]

(Whoops.) Thank you @ashimokawa for the information (and hint there is an official channel for this which I admit I should have checked for...)

[WildCryptoFox]

(Redacted and history deleted. Too late... but hopefully this will be fixed soon. At least the issue is relatively minor.)

[zeripath]

Do you know if the API is similarly affected?