From 0220f5e71be6c97d76a1575d0c1761000386ad83 Mon Sep 17 00:00:00 2001 From: JakobDev Date: Tue, 6 Jun 2023 11:26:49 +0200 Subject: [PATCH 1/4] Fix API leaking Usermail if not logged in --- models/user/user.go | 7 ++++++- services/convert/user.go | 2 +- tests/integration/api_user_info_test.go | 16 ++++++++++++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/models/user/user.go b/models/user/user.go index 2077d55f513e..b6dc05ddd3c6 100644 --- a/models/user/user.go +++ b/models/user/user.go @@ -203,11 +203,16 @@ func UpdateUserTheme(u *User, themeName string) error { return UpdateUserCols(db.DefaultContext, u, "theme") } +// GetPlaceholderEmail returns an noreply email +func (u *User) GetPlaceholderEmail() string { + return fmt.Sprintf("%s@%s", u.LowerName, setting.Service.NoReplyAddress) +} + // GetEmail returns an noreply email, if the user has set to keep his // email address private, otherwise the primary email address. func (u *User) GetEmail() string { if u.KeepEmailPrivate { - return fmt.Sprintf("%s@%s", u.LowerName, setting.Service.NoReplyAddress) + return u.GetPlaceholderEmail() } return u.Email } diff --git a/services/convert/user.go b/services/convert/user.go index 79fcba0176f9..3521dd2f905c 100644 --- a/services/convert/user.go +++ b/services/convert/user.go @@ -51,7 +51,7 @@ func toUser(ctx context.Context, user *user_model.User, signed, authed bool) *ap ID: user.ID, UserName: user.Name, FullName: user.FullName, - Email: user.GetEmail(), + Email: user.GetPlaceholderEmail(), AvatarURL: user.AvatarLink(ctx), Created: user.CreatedUnix.AsTime(), Restricted: user.IsRestricted, diff --git a/tests/integration/api_user_info_test.go b/tests/integration/api_user_info_test.go index 82cd97e904c0..f4edfd8941cf 100644 --- a/tests/integration/api_user_info_test.go +++ b/tests/integration/api_user_info_test.go @@ -9,6 +9,8 @@ import ( "testing" auth_model "code.gitea.io/gitea/models/auth" + "code.gitea.io/gitea/models/unittest" + user_model "code.gitea.io/gitea/models/user" api "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/tests" @@ -21,6 +23,8 @@ func TestAPIUserInfo(t *testing.T) { user := "user1" user2 := "user31" + user3 := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user3"}) + session := loginUser(t, user) token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser) @@ -36,6 +40,18 @@ func TestAPIUserInfo(t *testing.T) { req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/users/%s", user2)) MakeRequest(t, req, http.StatusNotFound) + + // test if the placaholder Mail is returned if a User is not logged in + req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/users/%s", user3.Name)) + resp = MakeRequest(t, req, http.StatusOK) + DecodeJSON(t, resp, &u) + assert.Equal(t, user3.GetPlaceholderEmail(), u.Email) + + // Test if the correct Mail is returned if a User is logged in + req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/users/%s?token=%s", user3.Name, token)) + resp = MakeRequest(t, req, http.StatusOK) + DecodeJSON(t, resp, &u) + assert.Equal(t, user3.GetEmail(), u.Email) }) t.Run("GetAuthenticatedUser", func(t *testing.T) { From 41f5c4366a6f19c743b1aae5eac1a27457378363 Mon Sep 17 00:00:00 2001 From: JakobDev Date: Thu, 27 Jul 2023 08:44:17 +0200 Subject: [PATCH 2/4] Fix TestAPIUserSearchNotLoggedIn() --- tests/integration/api_user_search_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/integration/api_user_search_test.go b/tests/integration/api_user_search_test.go index be14d5a6b296..1ca33586dbe3 100644 --- a/tests/integration/api_user_search_test.go +++ b/tests/integration/api_user_search_test.go @@ -55,9 +55,9 @@ func TestAPIUserSearchNotLoggedIn(t *testing.T) { assert.Contains(t, user.UserName, query) modelUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}) if modelUser.KeepEmailPrivate { - assert.EqualValues(t, fmt.Sprintf("%s@%s", modelUser.LowerName, setting.Service.NoReplyAddress), user.Email) + assert.EqualValues(t, modelUser.GetPlaceholderEmail(), user.Email) } else { - assert.EqualValues(t, modelUser.Email, user.Email) + assert.EqualValues(t, modelUser.GetPlaceholderEmail(), user.Email) } } } From c60354f060e16a4731f8a270870840ced1fcb972 Mon Sep 17 00:00:00 2001 From: JakobDev Date: Thu, 27 Jul 2023 09:07:59 +0200 Subject: [PATCH 3/4] Remove imports --- tests/integration/api_user_search_test.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/tests/integration/api_user_search_test.go b/tests/integration/api_user_search_test.go index 1ca33586dbe3..418972f9a24b 100644 --- a/tests/integration/api_user_search_test.go +++ b/tests/integration/api_user_search_test.go @@ -4,14 +4,12 @@ package integration import ( - "fmt" "net/http" "testing" auth_model "code.gitea.io/gitea/models/auth" "code.gitea.io/gitea/models/unittest" user_model "code.gitea.io/gitea/models/user" - "code.gitea.io/gitea/modules/setting" api "code.gitea.io/gitea/modules/structs" "code.gitea.io/gitea/tests" From 8dc13c688d1fb94d82df1d73de3a5c26681bc351 Mon Sep 17 00:00:00 2001 From: JakobDev Date: Thu, 27 Jul 2023 09:19:23 +0200 Subject: [PATCH 4/4] Remove if --- tests/integration/api_user_search_test.go | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/tests/integration/api_user_search_test.go b/tests/integration/api_user_search_test.go index 418972f9a24b..c5b202b3193f 100644 --- a/tests/integration/api_user_search_test.go +++ b/tests/integration/api_user_search_test.go @@ -52,11 +52,7 @@ func TestAPIUserSearchNotLoggedIn(t *testing.T) { for _, user := range results.Data { assert.Contains(t, user.UserName, query) modelUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: user.ID}) - if modelUser.KeepEmailPrivate { - assert.EqualValues(t, modelUser.GetPlaceholderEmail(), user.Email) - } else { - assert.EqualValues(t, modelUser.GetPlaceholderEmail(), user.Email) - } + assert.EqualValues(t, modelUser.GetPlaceholderEmail(), user.Email) } }