Jaymr/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(user): harden account email and password handling

Browse Source 
- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password
This commit is contained in:
CaIon
2026-07-05 13:15:41 +08:00
parent 1ae757475f
commit 5fc35e28a2
10 changed files with 416 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/misc.go
+21 -23
View File
@@ -2,12 +2,14 @@ package controller
import (
"encoding/json"
"errors"
"fmt"
"net/http"
"strings"
"github.com/QuantumNous/new-api/common"
"github.com/QuantumNous/new-api/constant"
"github.com/QuantumNous/new-api/i18n"
"github.com/QuantumNous/new-api/logger"
"github.com/QuantumNous/new-api/middleware"
"github.com/QuantumNous/new-api/model"
@@ -232,12 +234,9 @@ func GetHomePageContent(c *gin.Context) {
}
func SendEmailVerification(c *gin.Context) {
email := c.Query("email")
email := model.NormalizeEmail(c.Query("email"))
if err := common.Validate.Var(email, "required,email"); err != nil {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "无效的参数",
})
common.ApiErrorI18n(c, i18n.MsgInvalidParams)
return
}
parts := strings.Split(email, "@")
@@ -278,10 +277,7 @@ func SendEmailVerification(c *gin.Context) {
}
if model.IsEmailAlreadyTaken(email) {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "邮箱地址已被占用",
})
common.ApiErrorI18n(c, i18n.MsgUserEmailAlreadyTaken)
return
}
code := common.GenerateVerificationCode(6)
@@ -303,15 +299,12 @@ func SendEmailVerification(c *gin.Context) {
}
func SendPasswordResetEmail(c *gin.Context) {
email := c.Query("email")
email := model.NormalizeEmail(c.Query("email"))
if err := common.Validate.Var(email, "required,email"); err != nil {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "无效的参数",
})
common.ApiErrorI18n(c, i18n.MsgInvalidParams)
return
}
if model.IsEmailAlreadyTaken(email) {
if _, err := model.GetUniqueUserByEmail(email); err == nil {
code := common.GenerateVerificationCode(0)
common.RegisterVerificationCodeWithKey(email, code, common.PasswordResetPurpose)
link := fmt.Sprintf("%s/user/reset?email=%s&token=%s", system_setting.ServerAddress, email, code)
@@ -324,6 +317,8 @@ func SendPasswordResetEmail(c *gin.Context) {
if err != nil {
logger.LogError(c.Request.Context(), fmt.Sprintf("failed to send password reset email to %s: %s", email, err.Error()))
}
} else if err != nil && !errors.Is(err, model.ErrEmailNotFound) {
logger.LogWarn(c.Request.Context(), fmt.Sprintf("skip password reset email for %s: %s", email, err.Error()))
}
c.JSON(http.StatusOK, gin.H{
"success": true,
@@ -339,23 +334,26 @@ type PasswordResetRequest struct {
func ResetPassword(c *gin.Context) {
var req PasswordResetRequest
err := json.NewDecoder(c.Request.Body).Decode(&req)
if err != nil {
common.ApiError(c, err)
return
}
req.Email = model.NormalizeEmail(req.Email)
if req.Email == "" || req.Token == "" {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "无效的参数",
})
common.ApiErrorI18n(c, i18n.MsgInvalidParams)
return
}
if !common.VerifyCodeWithKey(req.Email, req.Token, common.PasswordResetPurpose) {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "重置链接非法或已过期",
})
common.ApiErrorI18n(c, i18n.MsgUserPasswordResetLinkInvalid)
return
}
password := common.GenerateVerificationCode(12)
err = model.ResetUserPasswordByEmail(req.Email, password)
if err != nil {
if errors.Is(err, model.ErrEmailNotFound) || errors.Is(err, model.ErrEmailAmbiguous) {
common.ApiErrorI18n(c, i18n.MsgUserPasswordResetLinkInvalid)
return
}
common.ApiError(c, err)
return
}