ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

fix: treat email addresses case-insensitively (#37600)

Browse Source 
Fixes #36184 and three more discovered cases.

---
This PR was written with the help of Claude Opus 4.7

---------

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
This commit is contained in:
silverwind
2026-05-08 15:14:33 +00:00
committed by GitHub
co-authored by Claude wxiaoguang Nicolas
parent 7dc3087acd
commit 29676adfd3
7 changed files with 70 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/mailer/token/token.go
+8 -5
View File
@@ -9,6 +9,7 @@ import (
"crypto/sha256"
"encoding/base32"
"fmt"
"strings"
"time"
user_model "code.gitea.io/gitea/models/user"
@@ -73,9 +74,11 @@ func CreateToken(ht HandlerType, user *user_model.User, data []byte) (string, er
return encodingWithoutPadding.EncodeToString(append([]byte{tokenVersion1}, packagedData...)), nil
}
// ExtractToken extracts the action/user tuple from the token and verifies the content
func ExtractToken(ctx context.Context, token string) (HandlerType, *user_model.User, []byte, error) {
data, err := encodingWithoutPadding.DecodeString(token)
// DecodeToken decodes the handler, user and payload from the token and verifies the content
func DecodeToken(ctx context.Context, token string) (HandlerType, *user_model.User, []byte, error) {
// MTAs are permitted to alter the case of the local-part (RFC 5321 §2.4), so normalize
// to the base32 alphabet before decoding to survive a lowercased reply-to address.
data, err := encodingWithoutPadding.DecodeString(strings.ToUpper(token))
if err != nil {
return UnknownHandlerType, nil, nil, err
}
@@ -118,11 +121,11 @@ func ExtractToken(ctx context.Context, token string) (HandlerType, *user_model.U
return handlerType, user, innerPayload, nil
}
// generateHmac creates a trunkated HMAC for the given payload
// generateHmac creates a truncated HMAC for the given payload
func generateHmac(secret, payload []byte) []byte {
mac := crypto_hmac.New(sha256.New, secret)
mac.Write(payload)
hmac := mac.Sum(nil)
return hmac[:10] // RFC2104 recommends not using less then 80 bits
return hmac[:10] // RFC2104 recommends not using less than 80 bits
}