Fix database inconsistent when admin change user email (#17549)

diff --git a/models/user/user.go b/models/user/user.go
index f8ccee0b38907e9328bdabdb6b6e861677da6abc..62f2aa472d22e721751a75e9288c0d07945e8c8e 100644 (file)
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -796,18 +796,48 @@ func validateUser(u *User) error {
        return ValidateEmail(u.Email)
 }
 
-func updateUser(e db.Engine, u *User) error {
+func updateUser(ctx context.Context, u *User, changePrimaryEmail bool) error {
        if err := validateUser(u); err != nil {
                return err
        }
 
+       e := db.GetEngine(ctx)
+
+       if changePrimaryEmail {
+               var emailAddress EmailAddress
+               has, err := e.Where("lower_email=?", strings.ToLower(u.Email)).Get(&emailAddress)
+               if err != nil {
+                       return err
+               }
+               if !has {
+                       // 1. Update old primary email
+                       if _, err = e.Where("uid=? AND is_primary=?", u.ID, true).Cols("is_primary").Update(&EmailAddress{
+                               IsPrimary: false,
+                       }); err != nil {
+                               return err
+                       }
+
+                       emailAddress.Email = u.Email
+                       emailAddress.UID = u.ID
+                       emailAddress.IsActivated = true
+                       emailAddress.IsPrimary = true
+                       if _, err := e.Insert(&emailAddress); err != nil {
+                               return err
+                       }
+               } else if _, err := e.ID(emailAddress).Cols("is_primary").Update(&EmailAddress{
+                       IsPrimary: true,
+               }); err != nil {
+                       return err
+               }
+       }
+
        _, err := e.ID(u.ID).AllCols().Update(u)
        return err
 }
 
 // UpdateUser updates user's information.
-func UpdateUser(u *User) error {
-       return updateUser(db.GetEngine(db.DefaultContext), u)
+func UpdateUser(u *User, emailChanged bool) error {
+       return updateUser(db.DefaultContext, u, emailChanged)
 }
 
 // UpdateUserCols update user according special columns
@@ -836,14 +866,13 @@ func UpdateUserSetting(u *User) (err error) {
                return err
        }
        defer committer.Close()
-       sess := db.GetEngine(ctx)
 
        if !u.IsOrganization() {
-               if err = checkDupEmail(sess, u); err != nil {
+               if err = checkDupEmail(db.GetEngine(ctx), u); err != nil {
                        return err
                }
        }
-       if err = updateUser(sess, u); err != nil {
+       if err = updateUser(ctx, u, false); err != nil {
                return err
        }
        return committer.Commit()

diff --git a/models/user/user_test.go b/models/user/user_test.go
index ac49852254c2b3c4cd5d640b6c837f117b3f64a6..f4acb923788fbb4fd20be7b1df1d544554abb933 100644 (file)
--- a/models/user/user_test.go
+++ b/models/user/user_test.go
@@ -273,19 +273,19 @@ func TestUpdateUser(t *testing.T) {
        user := unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
 
        user.KeepActivityPrivate = true
-       assert.NoError(t, UpdateUser(user))
+       assert.NoError(t, UpdateUser(user, false))
        user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
        assert.True(t, user.KeepActivityPrivate)
 
        setting.Service.AllowedUserVisibilityModesSlice = []bool{true, false, false}
        user.KeepActivityPrivate = false
        user.Visibility = structs.VisibleTypePrivate
-       assert.Error(t, UpdateUser(user))
+       assert.Error(t, UpdateUser(user, false))
        user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
        assert.True(t, user.KeepActivityPrivate)
 
        user.Email = "no mail@mail.org"
-       assert.Error(t, UpdateUser(user))
+       assert.Error(t, UpdateUser(user, true))
 }
 
 func TestNewUserRedirect(t *testing.T) {

diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
index e50abb59376418b00d7e85fa9c6e9a8df6e50a4d..b93c628072f678be9751926adc55b33688bcdeca 100644 (file)
--- a/routers/api/v1/admin/user.go
+++ b/routers/api/v1/admin/user.go
@@ -9,6 +9,7 @@ import (
        "errors"
        "fmt"
        "net/http"
+       "strings"
 
        "code.gitea.io/gitea/models"
        "code.gitea.io/gitea/models/db"
@@ -203,12 +204,21 @@ func EditUser(ctx *context.APIContext) {
        if form.FullName != nil {
                u.FullName = *form.FullName
        }
+       var emailChanged bool
        if form.Email != nil {
-               u.Email = *form.Email
-               if len(u.Email) == 0 {
+               email := strings.TrimSpace(*form.Email)
+               if len(email) == 0 {
                        ctx.Error(http.StatusUnprocessableEntity, "", fmt.Errorf("email is not allowed to be empty string"))
                        return
                }
+
+               if err := user_model.ValidateEmail(email); err != nil {
+                       ctx.InternalServerError(err)
+                       return
+               }
+
+               emailChanged = !strings.EqualFold(u.Email, email)
+               u.Email = email
        }
        if form.Website != nil {
                u.Website = *form.Website
@@ -247,7 +257,7 @@ func EditUser(ctx *context.APIContext) {
                u.IsRestricted = *form.Restricted
        }
 
-       if err := user_model.UpdateUser(u); err != nil {
+       if err := user_model.UpdateUser(u, emailChanged); err != nil {
                if user_model.IsErrEmailAlreadyUsed(err) || user_model.IsErrEmailInvalid(err) {
                        ctx.Error(http.StatusUnprocessableEntity, "", err)
                } else {

diff --git a/routers/api/v1/user/settings.go b/routers/api/v1/user/settings.go
index 40bee566811bdf777b09d964e3d3b67abed4d63f..5f4d76ed721849a87175394eefadd132f737179c 100644 (file)
--- a/routers/api/v1/user/settings.go
+++ b/routers/api/v1/user/settings.go
@@ -74,7 +74,7 @@ func UpdateUserSettings(ctx *context.APIContext) {
                ctx.User.KeepActivityPrivate = *form.HideActivity
        }
 
-       if err := user_model.UpdateUser(ctx.User); err != nil {
+       if err := user_model.UpdateUser(ctx.User, false); err != nil {
                ctx.InternalServerError(err)
                return
        }

diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index b92c5cf01a8e45c394630dc94e2fab51eba41e51..044efa00991283cedb5e17b27bb464e63f4e7ce4 100644 (file)
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -298,6 +298,13 @@ func EditUserPost(ctx *context.Context) {
                        ctx.RenderWithErr(errMsg, tplUserNew, &form)
                        return
                }
+
+               if err := user_model.ValidateEmail(form.Email); err != nil {
+                       ctx.Data["Err_Email"] = true
+                       ctx.RenderWithErr(ctx.Tr("form.email_error"), tplUserNew, &form)
+                       return
+               }
+
                if u.Salt, err = user_model.GetUserSalt(); err != nil {
                        ctx.ServerError("UpdateUser", err)
                        return
@@ -332,6 +339,7 @@ func EditUserPost(ctx *context.Context) {
 
        u.LoginName = form.LoginName
        u.FullName = form.FullName
+       emailChanged := !strings.EqualFold(u.Email, form.Email)
        u.Email = form.Email
        u.Website = form.Website
        u.Location = form.Location
@@ -352,7 +360,7 @@ func EditUserPost(ctx *context.Context) {
                u.ProhibitLogin = form.ProhibitLogin
        }
 
-       if err := user_model.UpdateUser(u); err != nil {
+       if err := user_model.UpdateUser(u, emailChanged); err != nil {
                if user_model.IsErrEmailAlreadyUsed(err) {
                        ctx.Data["Err_Email"] = true
                        ctx.RenderWithErr(ctx.Tr("form.email_been_used"), tplUserEdit, &form)

diff --git a/routers/web/org/setting.go b/routers/web/org/setting.go
index de4fa05e4aaef8e8b23fa87cf8fbcc32b242e9fc..0a328dfa4e34a5aea1558905b9b63fc7034c80d9 100644 (file)
--- a/routers/web/org/setting.go
+++ b/routers/web/org/setting.go
@@ -104,7 +104,7 @@ func SettingsPost(ctx *context.Context) {
        visibilityChanged := form.Visibility != org.Visibility
        org.Visibility = form.Visibility
 
-       if err := user_model.UpdateUser(org.AsUser()); err != nil {
+       if err := user_model.UpdateUser(org.AsUser(), false); err != nil {
                ctx.ServerError("UpdateUser", err)
                return
        }