From 7f084b2c70184bbdd004f90971614353d0567836 Mon Sep 17 00:00:00 2001 From: Etienne Stalmans Date: Tue, 3 Sep 2024 15:46:22 +0200 Subject: [PATCH] fix: sanitizeUser function should clean EmailChange The sanitizeUser function did not cleanup the EmailChange and EmailChangeSentAt properties on a User. If a User had a pending email address change, the new address could be leaked via a crafted signUp request. --- internal/api/signup.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/api/signup.go b/internal/api/signup.go index 22ac7dc022..1c74da6b69 100644 --- a/internal/api/signup.go +++ b/internal/api/signup.go @@ -336,9 +336,9 @@ func sanitizeUser(u *models.User, params *SignupParams) (*models.User, error) { u.ID = uuid.Must(uuid.NewV4()) - u.Role = "" + u.Role, u.EmailChange = "", "" u.CreatedAt, u.UpdatedAt, u.ConfirmationSentAt = now, now, &now - u.LastSignInAt, u.ConfirmedAt, u.EmailConfirmedAt, u.PhoneConfirmedAt = nil, nil, nil, nil + u.LastSignInAt, u.ConfirmedAt, u.EmailChangeSentAt, u.EmailConfirmedAt, u.PhoneConfirmedAt = nil, nil, nil, nil, nil u.Identities = make([]models.Identity, 0) u.UserMetaData = params.Data u.Aud = params.Aud