upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-20 22:00:39 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 15

fix: Avoid internal error when logging in with the wrong account to verify email address

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2025-08-26 14:26:05 +02:00 committed by Côme Chilliet
parent bfb5db8f21
commit 6d72ca74f7
1 changed files with 13 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
apps/provisioning_api/lib/Controller/VerificationController.php
View file

@ -51,11 +51,18 @@ class VerificationController extends Controller {
#[NoAdminRequired]
#[NoCSRFRequired]
public function showVerifyMail(string $token, string $userId, string $key): TemplateResponse {
if ($this->userSession->getUser()->getUID() !== $userId) {
// not a public page, hence getUser() must return an IUser
throw new InvalidArgumentException('Logged in account is not mail address owner');
try {
if ($this->userSession->getUser()?->getUID() !== $userId) {
// not a public page, hence getUser() must return an IUser
throw new InvalidArgumentException($this->l10n->t('Logged in account is not mail address owner'));
}
$email = $this->crypto->decrypt($key);
} catch (\Exception $e) {
return new TemplateResponse(
'core', 'error', [
'errors' => [['error' => $e->getMessage()]]
], TemplateResponse::RENDER_AS_GUEST);
}
$email = $this->crypto->decrypt($key);
return new TemplateResponse(
'core', 'confirmation', [
@ -73,8 +80,8 @@ class VerificationController extends Controller {
public function verifyMail(string $token, string $userId, string $key): TemplateResponse {
$throttle = false;
try {
if ($this->userSession->getUser()->getUID() !== $userId) {
throw new InvalidArgumentException('Logged in account is not mail address owner');
if ($this->userSession->getUser()?->getUID() !== $userId) {
throw new InvalidArgumentException($this->l10n->t('Logged in account is not mail address owner'));
}
$email = $this->crypto->decrypt($key);
$ref = \substr(hash('sha256', $email), 0, 8);