tomas/pocketbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

updated the rules when linking OAuth2 by email

Browse Source
This commit is contained in:
Gani Georgiev
2024-06-18 16:15:53 +03:00
parent af9cf33553
commit 58ace5d5e7
53 changed files with 637 additions and 351 deletions
Download Patch File Download Diff File Expand all files Collapse all files
forms/record_oauth2_login.go
+18 -9
View File
@@ -222,15 +222,11 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
// load custom data
createForm.LoadData(form.CreateData)
// load the OAuth2 profile data as fallback
if createForm.Email == "" {
createForm.Email = data.OAuth2User.Email
}
createForm.Verified = false
if createForm.Email == data.OAuth2User.Email {
// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
createForm.Verified = true
}
// load the OAuth2 user data
createForm.Email = data.OAuth2User.Email
createForm.Verified = true // mark as verified as long as it matches the OAuth2 data (even if the email is empty)
// generate a random password if not explicitly set
if createForm.Password == "" {
createForm.Password = security.RandomString(30)
createForm.PasswordConfirm = createForm.Password
@@ -247,6 +243,19 @@ func (form *RecordOAuth2Login) submit(data *RecordOAuth2LoginData) error {
return err
}
} else {
isLoggedAuthRecord := form.loggedAuthRecord != nil &&
form.loggedAuthRecord.Id == data.Record.Id &&
form.loggedAuthRecord.Collection().Id == data.Record.Collection().Id
// set random password for users with unverified email
// (this is in case a malicious actor has registered via password using the user email)
if !isLoggedAuthRecord && data.Record.Email() != "" && !data.Record.Verified() {
data.Record.SetPassword(security.RandomString(30))
if err := txDao.SaveRecord(data.Record); err != nil {
return err
}
}
// update the existing auth record empty email if the data.OAuth2User has one
// (this is in case previously the auth record was created
// with an OAuth2 provider that didn't return an email address)