CodeMirror/appwrite
1
0
Fork 0
mirror of synced 2024-06-28 19:20:25 +12:00
Code Issues Projects Releases Wiki Activity

Fix user identity attaching to wrong user

Browse source 
Suppose a user has 2 accounts on Appwrite:

1. joe@example.com
2. joe@gmail.com

Prior to this PR, if joe@example.com created a Google OAuth2 session
using his joe@gmail.com email, a new joe@gmail.com identity would be
created linked to joe@example.com.

This is especially problematic because if the user tried to create a
Google OAuth2 session using joe@gmail.com, Appwrite would lookup the
user via email and find the joe@gmail.com user, but then find an
identity from joe@example.com. This mismatching user ID would then
cause an error.

This PR prevents an identity from being created if the email from the
OAuth2 provider matches another user's email.
This commit is contained in:
Steven Nguyen 2023-12-13 18:45:05 +00:00
parent 5a715ff68c
commit 92a307c164
No known key found for this signature in database
GPG key ID: 22EB8611C67E9E5C
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
app/controllers/api/account.php
View file

@ -550,11 +550,19 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect')
if (!$user->isEmpty()) {
$userId = $user->getId();
$identitiesWithMatchingEmail = $dbForProject->find('identities', [
$identityWithMatchingEmail = $dbForProject->findOne('identities', [
Query::equal('providerEmail', [$email]),
Query::notEqual('userId', $userId),
]);
if (!empty($identitiesWithMatchingEmail)) {
if (!empty($identityWithMatchingEmail)) {
throw new Exception(Exception::USER_ALREADY_EXISTS);
}
$userWithMatchingEmail = $dbForProject->find('users', [
Query::equal('email', [$email]),
Query::notEqual('$id', $userId),
]);
if (!empty($userWithMatchingEmail)) {
throw new Exception(Exception::USER_ALREADY_EXISTS);
}
}