tabshift/pocketbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reordered change email validations to make enumerations slightly harder

Browse Source
This commit is contained in:
Gani Georgiev
2026-05-01 19:29:42 +03:00
parent d90aaedc00
commit 53ac0d29da
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@@ -6,7 +6,7 @@
- Reload trusted proxy info UI after settings save. - Reload trusted proxy info UI after settings save.
- Minor expand query optimization that skips the duplicated record ids from the `IN` list. - Other minor improvements (skips the duplicated record ids from the `IN` expand list, reordered confirm-email-change error checks to minimize enumeration attacks, etc.).
## v0.37.4 ## v0.37.4

12
apis/record_auth_email_change_confirm.go
View File

@@ -102,12 +102,6 @@ func (form *EmailChangeConfirmForm) parseToken() (*core.Record, string, error) {
return nil, "", validation.NewError("validation_invalid_token_payload", "Invalid token payload - newEmail must be set.") return nil, "", validation.NewError("validation_invalid_token_payload", "Invalid token payload - newEmail must be set.")
} }
// ensure that there aren't other users with the new email
_, err := form.app.FindAuthRecordByEmail(form.collection, newEmail)
if err == nil {
return nil, "", validation.NewError("validation_existing_token_email", "The new email address is already registered: "+newEmail)
}
// verify that the token is not expired and its signature is valid // verify that the token is not expired and its signature is valid
authRecord, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeEmailChange) authRecord, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeEmailChange)
if err != nil { if err != nil {
@@ -118,5 +112,11 @@ func (form *EmailChangeConfirmForm) parseToken() (*core.Record, string, error) {
return nil, "", validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.") return nil, "", validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
} }
// check if there are other users with the new email
_, err = form.app.FindAuthRecordByEmail(form.collection, newEmail)
if err == nil {
return nil, "", validation.NewError("validation_invalid_token_email", "The new email address is invalid.")
}
return authRecord, newEmail, nil return authRecord, newEmail, nil
} }