From 3d14b8f28f96eb4da352f615ee5b9c06ecdcc269 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Mon, 16 Sep 2019 20:42:29 +0200 Subject: [PATCH] Fix SSO login not using existing account when e-mail is verified (#11862) Fix #11472 --- app/models/concerns/omniauthable.rb | 30 ++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/app/models/concerns/omniauthable.rb b/app/models/concerns/omniauthable.rb index b9c124841..960784222 100644 --- a/app/models/concerns/omniauthable.rb +++ b/app/models/concerns/omniauthable.rb @@ -4,7 +4,7 @@ module Omniauthable extend ActiveSupport::Concern TEMP_EMAIL_PREFIX = 'change@me' - TEMP_EMAIL_REGEX = /\Achange@me/ + TEMP_EMAIL_REGEX = /\A#{TEMP_EMAIL_PREFIX}/.freeze included do devise :omniauthable @@ -28,8 +28,8 @@ module Omniauthable # to prevent the identity being locked with accidentally created accounts. # Note that this may leave zombie accounts (with no associated identity) which # can be cleaned up at a later date. - user = signed_in_resource || identity.user - user = create_for_oauth(auth) if user.nil? + user = signed_in_resource || identity.user + user ||= create_for_oauth(auth) if identity.user.nil? identity.user = user @@ -45,7 +45,18 @@ module Omniauthable # exists, we assign a temporary email and ask the user to verify it on # the next step via Auth::SetupController.show - user = User.new(user_params_from_auth(auth)) + strategy = Devise.omniauth_configs[auth.provider.to_sym].strategy + assume_verified = strategy&.security&.assume_email_is_verified + email_is_verified = auth.info.verified || auth.info.verified_email || assume_verified + email = auth.info.verified_email || auth.info.email + email = nil unless email_is_verified + + user = User.find_by(email: email) if email_is_verified + + return user unless user.nil? + + user = User.new(user_params_from_auth(email, auth)) + user.account.avatar_remote_url = auth.info.image if auth.info.image =~ /\A#{URI.regexp(%w(http https))}\z/ user.skip_confirmation! user.save! @@ -54,14 +65,7 @@ module Omniauthable private - def user_params_from_auth(auth) - strategy = Devise.omniauth_configs[auth.provider.to_sym].strategy - assume_verified = strategy.try(:security).try(:assume_email_is_verified) - email_is_verified = auth.info.verified || auth.info.verified_email || assume_verified - email = auth.info.verified_email || auth.info.email - email = email_is_verified && !User.exists?(email: auth.info.email) && email - display_name = auth.info.full_name || [auth.info.first_name, auth.info.last_name].join(' ') - + def user_params_from_auth(email, auth) { email: email || "#{TEMP_EMAIL_PREFIX}-#{auth.uid}-#{auth.provider}.com", password: Devise.friendly_token[0, 20], @@ -69,7 +73,7 @@ module Omniauthable external: true, account_attributes: { username: ensure_unique_username(auth.uid), - display_name: display_name, + display_name: auth.info.full_name || [auth.info.first_name, auth.info.last_name].join(' '), }, } end