1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-10-10 19:32:02 +00:00
forgejo/routers/api
forgejo-backport-action 1bc42842ba [v12.0/forgejo] fix: email comments are removed from email addresses (#9083)
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9074

When registering with an email account including a comment (e.g. `me@example.com (a comment here)`), the comment is removed from the email address. It was possible to include an email address in the comment to bypass the block list. For instance if registering with `me@evilcorp.com (me@example.com)` the mail would incorrectly be verified against the block list using the comment instead of `@evilcorp.com`. This is a regression introduced in Forgejo v12.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9074): <!--number 9074 --><!--line 0 --><!--description ZW1haWwgY29tbWVudHMgYXJlIHJlbW92ZWQgZnJvbSBlbWFpbCBhZGRyZXNzZXM=-->email comments are removed from email addresses<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: famfo <famfo@famfo.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9083
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
2025-08-30 18:45:30 +02:00
..
actions chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
forgejo/v1 chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
packages [v12.0/forgejo] fix(packages): skip another stack frame from logging (#8532) 2025-07-16 19:33:28 +02:00
shared [v12.0/forgejo] fix: query token auth version mismatch (#8670) 2025-07-26 00:45:07 +02:00
v1 [v12.0/forgejo] fix: email comments are removed from email addresses (#9083) 2025-08-30 18:45:30 +02:00