GetUserByEmailContext erroneous handling of email case #8586

New Issue

GiteaMirror · 2025-11-02T08:11:46-06:00

GiteaMirror commented

2025-11-02 08:11:46 -06:00

Originally created by @smunaut on GitHub (Feb 19, 2022).

Gitea Version

1.16.1

Git Version

No response

Operating System

No response

How are you running Gitea?

Irrelevant, I can see the bug in the code ...

Database

No response

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Description

The GetUserByEmailContext function lowers the case of the email before searching for it ( email = strings.ToLower(email) ), but the email stored in the DB is with whatever case the user entered it and is not necessarily lower case.

Also as a side note, technically only the host part of the email is case insensitive, there is nothing in the spec saying the part before the @ has to be insensitive AFAICT. It'd be dumb and confusing, but technically spec-compliant.

Screenshots

No response

Originally created by @smunaut on GitHub (Feb 19, 2022). ### Gitea Version 1.16.1 ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Irrelevant, I can see the bug in the code ... ### Database _No response_ ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Description The GetUserByEmailContext function lowers the case of the email before searching for it ( `email = strings.ToLower(email)` ), but the email stored in the DB is with whatever case the user entered it and is not necessarily lower case. Also as a side note, technically only the host part of the email is case insensitive, there is nothing in the spec saying the part before the @ has to be insensitive AFAICT. It'd be dumb and confusing, but technically spec-compliant. ### Screenshots _No response_

GiteaMirror added the type/bug label 2025-11-02 08:11:46 -06:00

GiteaMirror closed this issue

2025-11-02 08:11:47 -06:00

GiteaMirror commented

2025-11-02 08:11:48 -06:00

@lunny commented on GitHub (Feb 20, 2022):

Please paste the code here.

@lunny commented on GitHub (Feb 20, 2022): Please paste the code here.

GiteaMirror commented

2025-11-02 08:11:48 -06:00

@smunaut commented on GitHub (Feb 20, 2022):

func GetUserByEmailContext(ctx context.Context, email string) (*User, error) {
	if len(email) == 0 {
		return nil, ErrUserNotExist{0, email, 0}
	}

	email = strings.ToLower(email)
	// First try to find the user by primary email
	user := &User{Email: email}
	has, err := db.GetEngine(ctx).Get(user)
	if err != nil {
		return nil, err
	}
	if has {
		return user, nil
	}

	// Otherwise, check in alternative list for activated email addresses
	emailAddress := &EmailAddress{Email: email, IsActivated: true}
	has, err = db.GetEngine(ctx).Get(emailAddress)
	if err != nil {
		return nil, err
	}
	if has {
		return GetUserByIDCtx(ctx, emailAddress.UID)
	}

        ///......
}

@smunaut commented on GitHub (Feb 20, 2022): ```go func GetUserByEmailContext(ctx context.Context, email string) (*User, error) { if len(email) == 0 { return nil, ErrUserNotExist{0, email, 0} } email = strings.ToLower(email) // First try to find the user by primary email user := &User{Email: email} has, err := db.GetEngine(ctx).Get(user) if err != nil { return nil, err } if has { return user, nil } // Otherwise, check in alternative list for activated email addresses emailAddress := &EmailAddress{Email: email, IsActivated: true} has, err = db.GetEngine(ctx).Get(emailAddress) if err != nil { return nil, err } if has { return GetUserByIDCtx(ctx, emailAddress.UID) } ///...... } ```

GiteaMirror commented

2025-11-02 08:11:48 -06:00

@smunaut commented on GitHub (Feb 20, 2022):

AFAICT this has been introduced in b9d611e917 when instead of lowering the email manually a new LowerEmail was added, but here it still matches against Email.

@smunaut commented on GitHub (Feb 20, 2022): AFAICT this has been introduced in b9d611e917d9bd10e0d8be8fc61e057d5936993c when instead of lowering the email manually a new `LowerEmail` was added, but here it still matches against `Email`.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8586