mirror of
https://github.com/open-webui/open-webui.git
synced 2026-11-05 07:57:06 +00:00
785f95679a
The merge-by-email path bound a new (provider, sub) identity to an existing account looked up by email claim alone, on both the OAuth callback (utils/oauth.py) and the token-exchange endpoint (routers/auths.py). An identity provider that lets users assert arbitrary unverified email addresses could hand any matching account, including admin accounts, to an attacker. Track provider verification during email extraction (OIDC email_verified claim in bool or string form, GitHub /user/emails per-address verified flag) and refuse the merge when the provider explicitly reports the email as unverified: the callback redirects with the standard invalid-credentials error, and token exchange returns 403. Providers that send no verification signal keep current behavior. Rebased and extended after #28191 was closed: the same merge-by-email path exists in the token-exchange endpoint; this commit covers both. |
||
|---|---|---|
| .. | ||
| data | ||
| open_webui | ||
| .dockerignore | ||
| .gitignore | ||
| dev.sh | ||
| requirements-min.txt | ||
| requirements.txt | ||
| start.sh | ||
| start_windows.bat | ||