Can't add secondary email address to acount containing a "+" character #8061

New Issue

GiteaMirror · 2025-11-02T07:52:39-06:00

GiteaMirror commented

2025-11-02 07:52:39 -06:00

Originally created by @laalsaas on GitHub (Nov 1, 2021).

Gitea Version

1.15

Git Version

No response

Operating System

No response

How are you running Gitea?

I'm using the hosted Gitea service Codeberg

Database

No response

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

I tried to add a new Email address to my account (under settings -> account). The Email address contains the "+" (plus) character. I recieved a verification email with a link looking like this:

https://codeberg.org/user/activate_email?code=>long-hex-number>&email=my+email@example.com

When i click on this Link, i just get forwarded to the account-page in the settings (no error message visible), where the second email address still has the "Requires activation"-status.

I think most of you already know where this is leading towards: (I have only surface-level-knowledge of http, so sorry if I use a wrong term) The email address gets submited as a string parameter to a GET-Request, which is probably just created by concatinating the code and the email string to the rest of the link. The "+"-characters are reserved characters in GET-Requests, to represent a space, they probably don't get escaped properly so it's not working. I haven't tried, but I assume this is also the case for all email addresses containing a Character which is allowed in the local-part(the part before the "@"-sign), but a reserved character in a URL (i.e."&")

When I manually substitute the "+" in the verification link for its URL escape character %2B i can add the email address to my account.

Screenshots

No response

Originally created by @laalsaas on GitHub (Nov 1, 2021). ### Gitea Version 1.15 ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? I'm using the hosted Gitea service [Codeberg](https://codeberg.org) ### Database _No response_ ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Description I tried to add a new Email address to my account (under settings -> account). The Email address contains the "+" (plus) character. I recieved a verification email with a link looking like this: https://codeberg.org/user/activate_email?code=>long-hex-number>&email=my+email@example.com When i click on this Link, i just get forwarded to the account-page in the settings (no error message visible), where the second email address still has the "Requires activation"-status. I think most of you already know where this is leading towards: (I have only surface-level-knowledge of http, so sorry if I use a wrong term) The email address gets submited as a string parameter to a GET-Request, which is probably just created by concatinating the code and the email string to the rest of the link. The "+"-characters are reserved characters in GET-Requests, to represent a space, they probably don't get escaped properly so it's not working. I haven't tried, but I assume this is also the case for all email addresses containing a Character which is allowed in the `local-part`(the part before the "@"-sign), but a reserved character in a URL (i.e."&") When I manually substitute the "+" in the verification link for its URL escape character %2B i can add the email address to my account. ### Screenshots _No response_

GiteaMirror added the type/bug label 2025-11-02 07:52:39 -06:00

GiteaMirror closed this issue

2025-11-02 07:52:39 -06:00

GiteaMirror commented

2025-11-02 07:52:40 -06:00

@zeripath commented on GitHub (Nov 1, 2021):

The problem is:

07284792d4/templates/mail/auth/activate_email.tmpl (L8)

The email needs to be Queryescaped.

Unfortunately the query escape isn't in the template helper so it would also need to be added to that.

@zeripath commented on GitHub (Nov 1, 2021): The problem is: https://github.com/go-gitea/gitea/blob/07284792d40c556ec4c9e1c92379a922e746e12b/templates/mail/auth/activate_email.tmpl#L8 The email needs to be `Queryescape`d. Unfortunately the query escape isn't in the template helper so it would also need to be added to that.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8061