mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
550b717279## Summary Correctly treat only Boolean true or the string "true" (case-insensitively) as an email-verified claim in the OAuth2 Basic authenticator. Previously any truthy non-boolean value (e.g., "pending", 0, arrays) was accepted as verified, which allowed external provider identities with non-verified email states to auto-link to existing Discourse accounts. The fix applies a strict whitelist matching the pattern used by the sibling OpenID Connect authenticator. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1505 |
||
|---|---|---|
| .. | ||
| integration | ||
| system | ||
| plugin_spec.rb | ||
