Prevent a user with a different email from accepting the team invite (#24491)

## Changes
- Fixes the case where a logged in user can accept an email invitation
even if their email address does not match the address in the invitation

1 files changed, 8 insertions, 0 deletions

diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go
index 2ce4bf5322..9a0f49b688 100644
--- a/routers/web/org/teams.go
+++ b/routers/web/org/teams.go
@@ -552,6 +552,7 @@ func TeamInvite(ctx *context.Context) {
 	ctx.Data["Organization"] = org
 	ctx.Data["Team"] = team
 	ctx.Data["Inviter"] = inviter
+	ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email
 
 	ctx.HTML(http.StatusOK, tplTeamInvite)
 }
@@ -568,6 +569,13 @@ func TeamInvitePost(ctx *context.Context) {
 		return
 	}
 
+	// check that the Doer is the invitee
+	if ctx.Doer.Email != invite.Email {
+		log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID)
+		ctx.NotFound("ErrTeamInviteNotFound", err)
+		return
+	}
+
 	if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil {
 		ctx.ServerError("AddTeamMember", err)
 		return