From 37b258810a55770367930b9a5966cfb6025a7c4f Mon Sep 17 00:00:00 2001 From: Gani Georgiev Date: Sun, 26 Apr 2026 14:23:23 +0300 Subject: [PATCH] updated gitea displayName --- CHANGELOG.md | 2 +- tools/auth/gitea.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bef3f4e1..6d771fd9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ - Added dummy bcrypt password check for the failure auth path to minimize enumaration timing attacks. - Adjusted Bitbucket, GitHub and Gitea/Forgejo OAuth2 providers to better reflect recent API updates and doc references. - _The providers also now always send their respective dedicated emails_list request to fetch only the verified primary email in order to minimize eventual linking security issues caused by specific onpremise setups._ + _The providers also now always send a sepatate emails list internal request since it contains more information about the fetched email than the userinfo endpoint in order to minimize eventual linking security issues caused by custom onpremise setups (e.g. Gitea/Forgejo allows skipping the emails verification if an ENV variable is configured)._ - ⚠️ Fixed a pre-hijacking OAuth2 linking vulnerability ([#7662](https://github.com/pocketbase/pocketbase/discussions/7662); thanks @Alardiians for reporting it privately). diff --git a/tools/auth/gitea.go b/tools/auth/gitea.go index 057e9864..12090d82 100644 --- a/tools/auth/gitea.go +++ b/tools/auth/gitea.go @@ -32,7 +32,7 @@ func NewGiteaProvider() *Gitea { ctx: context.Background(), order: 11, logo: ``, - displayName: "Gitea", + displayName: "Gitea/Forgejo", pkce: true, scopes: []string{"read:user", "user:email"}, authURL: "https://gitea.com/login/oauth/authorize",