(answer) 01/02: fix: normalize allowed email domains

[li...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

LinkinStars pushed a commit to branch fix/2.0.3/user
in repository https://gitbox.apache.org/repos/asf/answer.git

commit 7a7caac953cb1d980c2d496346421a059ca89e59
Author: LinkinStars <li...@foxmail.com>
AuthorDate: Tue Sep 8 14:30:12 2026 +0800

    fix: normalize allowed email domains
---
 i18n/en_US.yaml           |  3 +--
 i18n/zh_CN.yaml           |  3 +--
 pkg/checker/email.go      |  3 ++-
 pkg/checker/email_test.go | 45 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/i18n/en_US.yaml b/i18n/en_US.yaml
index 5d1faa3e..ac4191be 100644
--- a/i18n/en_US.yaml
+++ b/i18n/en_US.yaml
@@ -2247,7 +2247,7 @@ ui:
         text: When enabled, users must verify their email address before using the site.
       allowed_email_domains:
         title: Allowed email domains
-        text: Email domains that users must register accounts with. One domain per line. Ignored when empty.
+        text: Email domains users must use to register accounts. Enter one domain per line, including the @ symbol (for example, @example.com). Ignored when empty.
       private:
         title: Private
         label: Login required
@@ -2488,4 +2488,3 @@ ui:
     copy: Copy to clipboard
     copied: Copied
     external_content_warning: External images/media are not displayed.
-
diff --git a/i18n/zh_CN.yaml b/i18n/zh_CN.yaml
index f16ed9fa..2ee0c1a4 100644
--- a/i18n/zh_CN.yaml
+++ b/i18n/zh_CN.yaml
@@ -2205,7 +2205,7 @@ ui:
         text: 关闭以阻止任何人通过邮箱创建新账户。
       allowed_email_domains:
         title: 允许的邮箱域
-        text: 允许注册账户的邮箱域。每行一个域名。留空时忽略。
+        text: 允许用于注册账户的邮箱域。每行一个域名，须包含 @ 符号（例如 @example.com）。留空时忽略。
       private:
         title: 非公开的
         label: 需要登录
@@ -2447,4 +2447,3 @@ ui:
     copied: 已复制
     external_content_warning: 外部图像/媒体未显示。
 
-
diff --git a/pkg/checker/email.go b/pkg/checker/email.go
index a9732fdf..0eaebe9c 100644
--- a/pkg/checker/email.go
+++ b/pkg/checker/email.go
@@ -27,7 +27,8 @@ func EmailInAllowEmailDomain(email string, allowEmailDomains []string) bool {
 	}
 
 	for _, domain := range allowEmailDomains {
-		if strings.HasSuffix(email, domain) {
+		domain = strings.TrimPrefix(domain, "@")
+		if strings.HasSuffix(email, "@"+domain) {
 			return true
 		}
 	}
diff --git a/pkg/checker/email_test.go b/pkg/checker/email_test.go
new file mode 100644
index 00000000..b84c8e45
--- /dev/null
+++ b/pkg/checker/email_test.go
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package checker
+
+import "testing"
+
+func TestEmailInAllowEmailDomain(t *testing.T) {
+	tests := []struct {
+		name              string
+		email             string
+		allowEmailDomains []string
+		want              bool
+	}{
+		{name: "allow when no domains are configured", email: "user@example.com", want: true},
+		{name: "allow legacy domain configuration", email: "user@example.com", allowEmailDomains: []string{"example.com"}, want: true},
+		{name: "allow domain configuration with at sign", email: "user@example.com", allowEmailDomains: []string{"@example.com"}, want: true},
+		{name: "reject a domain with an allowed suffix", email: "attacker@notexample.com", allowEmailDomains: []string{"example.com"}, want: false},
+		{name: "reject a domain with an allowed suffix and at sign", email: "attacker@notexample.com", allowEmailDomains: []string{"@example.com"}, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := EmailInAllowEmailDomain(tt.email, tt.allowEmailDomains); got != tt.want {
+				t.Errorf("EmailInAllowEmailDomain() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}