From 402df1d6b461824b197c2b29166df2d66cf9ae1e Mon Sep 17 00:00:00 2001 From: Jack Hay Date: Wed, 3 May 2023 21:21:58 -0400 Subject: Prevent a user with a different email from accepting the team invite (#24491) ## Changes - Fixes the case where a logged in user can accept an email invitation even if their email address does not match the address in the invitation --- routers/web/org/teams.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'routers/web/org') diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go index 2ce4bf5322..9a0f49b688 100644 --- a/routers/web/org/teams.go +++ b/routers/web/org/teams.go @@ -552,6 +552,7 @@ func TeamInvite(ctx *context.Context) { ctx.Data["Organization"] = org ctx.Data["Team"] = team ctx.Data["Inviter"] = inviter + ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email ctx.HTML(http.StatusOK, tplTeamInvite) } @@ -568,6 +569,13 @@ func TeamInvitePost(ctx *context.Context) { return } + // check that the Doer is the invitee + if ctx.Doer.Email != invite.Email { + log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID) + ctx.NotFound("ErrTeamInviteNotFound", err) + return + } + if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil { ctx.ServerError("AddTeamMember", err) return -- cgit v1.2.3