sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: Avoid internal error when logging in with the wrong account to verify email address 

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
pull/54973/head
Côme Chilliet 2025-08-26 14:26:05 +07:00 committed by backportbot[bot]
parent 8f0126752f
commit 289c7b493c
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
apps/provisioning_api/lib/Controller/VerificationController.php
Unescape Escape View File

@ -51,11 +51,18 @@ class VerificationController extends Controller {
#[NoAdminRequired]
#[NoCSRFRequired]
public function showVerifyMail(string $token, string $userId, string $key): TemplateResponse {
if ($this->userSession->getUser()->getUID() !== $userId) {
// not a public page, hence getUser() must return an IUser
throw new InvalidArgumentException('Logged in account is not mail address owner');
try {
if ($this->userSession->getUser()?->getUID() !== $userId) {
// not a public page, hence getUser() must return an IUser
throw new InvalidArgumentException($this->l10n->t('Logged in account is not mail address owner'));
}
$email = $this->crypto->decrypt($key);
} catch (\Exception $e) {
return new TemplateResponse(
'core', 'error', [
'errors' => [['error' => $e->getMessage()]]
], TemplateResponse::RENDER_AS_GUEST);
}
$email = $this->crypto->decrypt($key);
return new TemplateResponse(
'core', 'confirmation', [
@ -73,8 +80,8 @@ class VerificationController extends Controller {
public function verifyMail(string $token, string $userId, string $key): TemplateResponse {
$throttle = false;
try {
if ($this->userSession->getUser()->getUID() !== $userId) {
throw new InvalidArgumentException('Logged in account is not mail address owner');
if ($this->userSession->getUser()?->getUID() !== $userId) {
throw new InvalidArgumentException($this->l10n->t('Logged in account is not mail address owner'));
}
$email = $this->crypto->decrypt($key);
$ref = \substr(hash('sha256', $email), 0, 8);