Fix database inconsistent when admin change user email (#17549)

This commit is contained in:
Lunny Xiao 2021-11-26 09:56:16 +08:00 committed by GitHub
parent f23851f690
commit 371ebce252
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 62 additions and 15 deletions

View file

@ -796,18 +796,48 @@ func validateUser(u *User) error {
return ValidateEmail(u.Email) return ValidateEmail(u.Email)
} }
func updateUser(e db.Engine, u *User) error { func updateUser(ctx context.Context, u *User, changePrimaryEmail bool) error {
if err := validateUser(u); err != nil { if err := validateUser(u); err != nil {
return err return err
} }
e := db.GetEngine(ctx)
if changePrimaryEmail {
var emailAddress EmailAddress
has, err := e.Where("lower_email=?", strings.ToLower(u.Email)).Get(&emailAddress)
if err != nil {
return err
}
if !has {
// 1. Update old primary email
if _, err = e.Where("uid=? AND is_primary=?", u.ID, true).Cols("is_primary").Update(&EmailAddress{
IsPrimary: false,
}); err != nil {
return err
}
emailAddress.Email = u.Email
emailAddress.UID = u.ID
emailAddress.IsActivated = true
emailAddress.IsPrimary = true
if _, err := e.Insert(&emailAddress); err != nil {
return err
}
} else if _, err := e.ID(emailAddress).Cols("is_primary").Update(&EmailAddress{
IsPrimary: true,
}); err != nil {
return err
}
}
_, err := e.ID(u.ID).AllCols().Update(u) _, err := e.ID(u.ID).AllCols().Update(u)
return err return err
} }
// UpdateUser updates user's information. // UpdateUser updates user's information.
func UpdateUser(u *User) error { func UpdateUser(u *User, emailChanged bool) error {
return updateUser(db.GetEngine(db.DefaultContext), u) return updateUser(db.DefaultContext, u, emailChanged)
} }
// UpdateUserCols update user according special columns // UpdateUserCols update user according special columns
@ -836,14 +866,13 @@ func UpdateUserSetting(u *User) (err error) {
return err return err
} }
defer committer.Close() defer committer.Close()
sess := db.GetEngine(ctx)
if !u.IsOrganization() { if !u.IsOrganization() {
if err = checkDupEmail(sess, u); err != nil { if err = checkDupEmail(db.GetEngine(ctx), u); err != nil {
return err return err
} }
} }
if err = updateUser(sess, u); err != nil { if err = updateUser(ctx, u, false); err != nil {
return err return err
} }
return committer.Commit() return committer.Commit()

View file

@ -273,19 +273,19 @@ func TestUpdateUser(t *testing.T) {
user := unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User) user := unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
user.KeepActivityPrivate = true user.KeepActivityPrivate = true
assert.NoError(t, UpdateUser(user)) assert.NoError(t, UpdateUser(user, false))
user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User) user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
assert.True(t, user.KeepActivityPrivate) assert.True(t, user.KeepActivityPrivate)
setting.Service.AllowedUserVisibilityModesSlice = []bool{true, false, false} setting.Service.AllowedUserVisibilityModesSlice = []bool{true, false, false}
user.KeepActivityPrivate = false user.KeepActivityPrivate = false
user.Visibility = structs.VisibleTypePrivate user.Visibility = structs.VisibleTypePrivate
assert.Error(t, UpdateUser(user)) assert.Error(t, UpdateUser(user, false))
user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User) user = unittest.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
assert.True(t, user.KeepActivityPrivate) assert.True(t, user.KeepActivityPrivate)
user.Email = "no mail@mail.org" user.Email = "no mail@mail.org"
assert.Error(t, UpdateUser(user)) assert.Error(t, UpdateUser(user, true))
} }
func TestNewUserRedirect(t *testing.T) { func TestNewUserRedirect(t *testing.T) {

View file

@ -9,6 +9,7 @@ import (
"errors" "errors"
"fmt" "fmt"
"net/http" "net/http"
"strings"
"code.gitea.io/gitea/models" "code.gitea.io/gitea/models"
"code.gitea.io/gitea/models/db" "code.gitea.io/gitea/models/db"
@ -203,12 +204,21 @@ func EditUser(ctx *context.APIContext) {
if form.FullName != nil { if form.FullName != nil {
u.FullName = *form.FullName u.FullName = *form.FullName
} }
var emailChanged bool
if form.Email != nil { if form.Email != nil {
u.Email = *form.Email email := strings.TrimSpace(*form.Email)
if len(u.Email) == 0 { if len(email) == 0 {
ctx.Error(http.StatusUnprocessableEntity, "", fmt.Errorf("email is not allowed to be empty string")) ctx.Error(http.StatusUnprocessableEntity, "", fmt.Errorf("email is not allowed to be empty string"))
return return
} }
if err := user_model.ValidateEmail(email); err != nil {
ctx.InternalServerError(err)
return
}
emailChanged = !strings.EqualFold(u.Email, email)
u.Email = email
} }
if form.Website != nil { if form.Website != nil {
u.Website = *form.Website u.Website = *form.Website
@ -247,7 +257,7 @@ func EditUser(ctx *context.APIContext) {
u.IsRestricted = *form.Restricted u.IsRestricted = *form.Restricted
} }
if err := user_model.UpdateUser(u); err != nil { if err := user_model.UpdateUser(u, emailChanged); err != nil {
if user_model.IsErrEmailAlreadyUsed(err) || user_model.IsErrEmailInvalid(err) { if user_model.IsErrEmailAlreadyUsed(err) || user_model.IsErrEmailInvalid(err) {
ctx.Error(http.StatusUnprocessableEntity, "", err) ctx.Error(http.StatusUnprocessableEntity, "", err)
} else { } else {

View file

@ -74,7 +74,7 @@ func UpdateUserSettings(ctx *context.APIContext) {
ctx.User.KeepActivityPrivate = *form.HideActivity ctx.User.KeepActivityPrivate = *form.HideActivity
} }
if err := user_model.UpdateUser(ctx.User); err != nil { if err := user_model.UpdateUser(ctx.User, false); err != nil {
ctx.InternalServerError(err) ctx.InternalServerError(err)
return return
} }

View file

@ -298,6 +298,13 @@ func EditUserPost(ctx *context.Context) {
ctx.RenderWithErr(errMsg, tplUserNew, &form) ctx.RenderWithErr(errMsg, tplUserNew, &form)
return return
} }
if err := user_model.ValidateEmail(form.Email); err != nil {
ctx.Data["Err_Email"] = true
ctx.RenderWithErr(ctx.Tr("form.email_error"), tplUserNew, &form)
return
}
if u.Salt, err = user_model.GetUserSalt(); err != nil { if u.Salt, err = user_model.GetUserSalt(); err != nil {
ctx.ServerError("UpdateUser", err) ctx.ServerError("UpdateUser", err)
return return
@ -332,6 +339,7 @@ func EditUserPost(ctx *context.Context) {
u.LoginName = form.LoginName u.LoginName = form.LoginName
u.FullName = form.FullName u.FullName = form.FullName
emailChanged := !strings.EqualFold(u.Email, form.Email)
u.Email = form.Email u.Email = form.Email
u.Website = form.Website u.Website = form.Website
u.Location = form.Location u.Location = form.Location
@ -352,7 +360,7 @@ func EditUserPost(ctx *context.Context) {
u.ProhibitLogin = form.ProhibitLogin u.ProhibitLogin = form.ProhibitLogin
} }
if err := user_model.UpdateUser(u); err != nil { if err := user_model.UpdateUser(u, emailChanged); err != nil {
if user_model.IsErrEmailAlreadyUsed(err) { if user_model.IsErrEmailAlreadyUsed(err) {
ctx.Data["Err_Email"] = true ctx.Data["Err_Email"] = true
ctx.RenderWithErr(ctx.Tr("form.email_been_used"), tplUserEdit, &form) ctx.RenderWithErr(ctx.Tr("form.email_been_used"), tplUserEdit, &form)

View file

@ -104,7 +104,7 @@ func SettingsPost(ctx *context.Context) {
visibilityChanged := form.Visibility != org.Visibility visibilityChanged := form.Visibility != org.Visibility
org.Visibility = form.Visibility org.Visibility = form.Visibility
if err := user_model.UpdateUser(org.AsUser()); err != nil { if err := user_model.UpdateUser(org.AsUser(), false); err != nil {
ctx.ServerError("UpdateUser", err) ctx.ServerError("UpdateUser", err)
return return
} }