ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

Fix a bug user could change another user's primary email (#36586) (#36607)

Browse Source 
backport #36586
This commit is contained in:
Lunny Xiao
2026-02-14 14:06:59 +02:00
committed by GitHub
parent 76b7306daa
commit e927a86586
5 changed files with 53 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/user_settings_test.go
+30
View File
@@ -180,6 +180,36 @@ func TestUserSettingsUpdateEmail(t *testing.T) {
})
session.MakeRequest(t, req, http.StatusNotFound)
})
t.Run("primary email not found", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
session := loginUser(t, "user2")
req := NewRequestWithValues(t, "POST", "/user/settings/account/email", map[string]string{
"_method": "PRIMARY",
"id": "9999",
"_csrf": GetUserCSRFToken(t, session),
})
resp := session.MakeRequest(t, req, http.StatusSeeOther)
assert.Equal(t, "/user/settings/account", resp.Header().Get("Location"))
flashMsg := session.GetCookieFlashMessage()
assert.Equal(t, "The selected email address could not be found.", flashMsg.ErrorMsg)
})
t.Run("primary email not owned by user", func(t *testing.T) {
defer tests.PrintCurrentTest(t)()
session := loginUser(t, "user2")
req := NewRequestWithValues(t, "POST", "/user/settings/account/email", map[string]string{
"_method": "PRIMARY",
"id": "6",
"_csrf": GetUserCSRFToken(t, session),
})
resp := session.MakeRequest(t, req, http.StatusSeeOther)
assert.Equal(t, "/user/settings/account", resp.Header().Get("Location"))
flashMsg := session.GetCookieFlashMessage()
assert.Equal(t, "The selected email address could not be found.", flashMsg.ErrorMsg)
})
}
func TestUserSettingsDeleteEmail(t *testing.T) {