Fix a bug user could change another user's primary email (#36586) (#36607)

backport #36586
This commit is contained in:
Lunny Xiao
2026-02-14 14:06:59 +02:00
committed by GitHub
parent 76b7306daa
commit e927a86586
5 changed files with 53 additions and 12 deletions
+6 -1
View File
@@ -113,7 +113,12 @@ func EmailPost(ctx *context.Context) {
// Make email address primary.
if ctx.FormString("_method") == "PRIMARY" {
if err := user_model.MakeActiveEmailPrimary(ctx, ctx.FormInt64("id")); err != nil {
if err := user_model.MakeActiveEmailPrimary(ctx, ctx.Doer.ID, ctx.FormInt64("id")); err != nil {
if user_model.IsErrEmailAddressNotExist(err) {
ctx.Flash.Error(ctx.Tr("settings.email_primary_not_found"))
ctx.Redirect(setting.AppSubURL + "/user/settings/account")
return
}
ctx.ServerError("MakeEmailPrimary", err)
return
}