Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/discourse-oauth2-basic/lib
History
Exact
Mark VanLandingham 550b717279
 FIX: Ensure email_verified is properly checked for true values in OAuth2 Basic (#42319) 
## Summary

Correctly treat only Boolean true or the string "true"
(case-insensitively) as an email-verified claim in the OAuth2 Basic
authenticator. Previously any truthy non-boolean value (e.g., "pending",
0, arrays) was accepted as verified, which allowed external provider
identities with non-verified email states to auto-link to existing
Discourse accounts. The fix applies a strict whitelist matching the
pattern used by the sibling OpenID Connect authenticator.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1505
2026-08-04 13:14:48 -05:00
..
omniauth/strategies DEV: Improve OIDC and OAuth2 plugin timeout handling (#42136) 2026-07-29 18:22:40 +01:00
validators/oauth2_basic
oauth2_basic_authenticator.rb FIX: Ensure email_verified is properly checked for true values in OAuth2 Basic (#42319) 2026-08-04 13:14:48 -05:00
oauth2_faraday_formatter.rb