You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/10/01 17:59:15 UTC
(allura) 08/17: [#8627] primary email must be one of the user's confirmed addresses
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch db/8627
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 0ef06e660ac8aa1a57537128df0b35cf2230d965
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Mon Sep 28 18:06:14 2026 -0400
[#8627] primary email must be one of the user's confirmed addresses
Co-Authored-By: Claude Opus 5.5 (1M context) <no...@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S13yNaBk5K5EefQXbbJPsT
---
Allura/allura/controllers/auth.py | 4 ++++
Allura/allura/tests/functional/test_auth.py | 17 ++++++++++++++---
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py
index 9ae744f3b..9cec45921 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -811,6 +811,10 @@ def _update_emails(self, user, admin=False, form_params={}):
if not admin and (not kw.get('password') or not provider.validate_password(user, kw.get('password'))):
flash('You must provide your current password to change primary address', 'error')
return
+ addr_obj = user.address_object(primary_addr)
+ if not admin and (not addr_obj or not addr_obj.confirmed):
+ flash('Primary address must be one of your confirmed email addresses', 'error')
+ return
h.auditlog_user(
'Primary email changed: %s => %s',
user.get_pref('email_address'),
diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py
index be83f3356..eeebe6198 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -512,7 +512,7 @@ def test_user_added_claimed_address_by_other_user_not_confirmed(self, gen_messag
params={
'new_addr.addr': email_address,
'new_addr.claim': 'Claim Address',
- 'primary_addr': 'test-user-1@users.localhost',
+ 'primary_addr': 'test-user-1@allura.local',
'preferences.email_format': 'plain',
'password': 'foo',
'_csrf_token': self.app.cookies['_csrf_token'],
@@ -536,7 +536,7 @@ def test_user_cannot_claim_more_than_max_limit(self, gen_message_id, sendsimplem
params={
'new_addr.addr': 'test_abcd_1@domain.net',
'new_addr.claim': 'Claim Address',
- 'primary_addr': 'test-user-1@users.localhost',
+ 'primary_addr': 'test-user-1@allura.local',
'preferences.email_format': 'plain',
'password': 'foo',
'_csrf_token': self.app.cookies['_csrf_token'],
@@ -548,7 +548,7 @@ def test_user_cannot_claim_more_than_max_limit(self, gen_message_id, sendsimplem
params={
'new_addr.addr': 'test_abcd_2@domain.net',
'new_addr.claim': 'Claim Address',
- 'primary_addr': 'test-user-1@users.localhost',
+ 'primary_addr': 'test-user-1@allura.local',
'preferences.email_format': 'plain',
'password': 'foo',
'_csrf_token': self.app.cookies['_csrf_token'],
@@ -919,6 +919,17 @@ def test_email_prefs_change_requires_password(self, gen_message_id, sendsimplema
assert M.User.by_username('test-admin').get_pref('email_address') == 'test-admin@users.localhost'
change_primary_params['password'] = 'foo' # valid password
+ # must be a confirmed address of this user
+ for addr in ['someone-else@example.com', 'test@example.com']:
+ self.app.get('/auth/preferences/') # let previous 'flash' message cookie get used up
+ r = self.app.post('/auth/preferences/update_emails',
+ params=dict(change_primary_params, primary_addr=addr),
+ extra_environ=dict(username='test-admin'))
+ assert 'Primary address must be one of your confirmed email addresses' in self.webflash(r)
+ assert M.User.by_username('test-admin').get_pref('email_address') == 'test-admin@users.localhost'
+ M.User.by_username('test-admin').address_object('test@example.com').confirmed = True
+ ThreadLocalODMSession.flush_all()
+
self.app.get('/auth/preferences/') # let previous 'flash' message cookie get used up
r = self.app.post('/auth/preferences/update_emails',
params=change_primary_params,