4 people 1eee73e9bd fix(mailer): reject incoming email tokens of users who cannot sign in (#39833) (#39841) ...

Backport #39833 by @basavaraj-sm05

Incoming email reply tokens stay valid for a year and are verified with
`user.Rands`, which is not rotated when an account is deactivated or
prohibited from signing in. A suspended user could therefore keep
commenting on public repos by replying to old notifications.

`DecodeToken` now rejects tokens of organizations, inactive users and
users prohibited from signing in, which covers every incoming mail
handler.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-18 12:28:08 +00:00

..

avatar_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

avatar.go

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

badge_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

badge.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

block.go

fix(user): allow unblocking users promoted to admin (#39192)

2026-09-23 16:54:12 +00:00

email_address_test.go

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

email_address.go

fix(user): unify email validation for registration and settings (#39304)

2026-09-16 17:34:41 +00:00

error.go

fix: use clearer message for ldap auth failure (#39392)

2026-09-23 16:30:58 +08:00

external_login_user.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

follow_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

follow.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

list.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

must_change_password.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

openid_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

openid.go

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

redirect_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

redirect.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

search.go

feat: manage bot accounts from the admin UI, API and CLI (#38966)

2026-09-18 12:43:36 +00:00

setting_options.go

feat: Add configurable permissions for Actions automatic tokens (#36173)

2026-03-21 15:39:47 -07:00

setting_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

setting.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

user_extdata.go

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

user_list.go

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

user_system_test.go

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

user_system.go

chore: fix system users (#39299)

2026-09-12 16:26:20 +00:00

user_test.go

fix(user): don't match a commit with an empty author email to a user (#39777) (#39780)

2026-10-14 21:00:10 +02:00

user_update.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

user.go

fix(mailer): reject incoming email tokens of users who cannot sign in (#39833) (#39841)

2026-10-18 12:28:08 +00:00