From: Robin Appelman <robin@icewind.nl>
Date: Wed, 14 Sep 2022 12:04:13 +0000 (+0200)
Subject: dont try email login if the provider username is not a valid email
X-Git-Tag: v23.0.10rc1~8^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=35cc27ed2139d4182f43f79f0773d9b2df8e7141;p=nextcloud-server.git

dont try email login if the provider username is not a valid email

Signed-off-by: Robin Appelman <robin@icewind.nl>
---

diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 7aea219b608..8f910113078 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -461,6 +461,9 @@ class Session implements IUserSession, Emitter {
 		if (!$this->login($user, $password)) {
 
 			// Failed, maybe the user used their email address
+			if (!filter_var($user, FILTER_VALIDATE_EMAIL)) {
+				return false;
+			}
 			$users = $this->manager->getByEmail($user);
 			if (!(\count($users) === 1 && $this->login($users[0]->getUID(), $password))) {
 				$this->logger->warning('Login failed: \'' . $user . '\' (Remote IP: \'' . \OC::$server->getRequest()->getRemoteAddress() . '\')', ['app' => 'core']);