Miroslav Šedivý 23d8a2718e oauth: ignore email when provider reports email_verified=false. ...

An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.

Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)

2026-10-28 17:05:56 +01:00

..

cmd

Remove legacy mode.

2026-10-16 20:23:56 +02:00

dev

feat: remove default configuration to prevend accidental override.

2026-08-15 15:36:06 +02:00

internal

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

pkg

Remove legacy mode.

2026-10-16 20:23:56 +02:00

plugins

move server to server directory.

2024-09-06 22:56:24 +02:00

.gitignore

split base build to multiple dockerfiles.

2024-09-08 17:22:49 +02:00

build

remove -d from go get.

2025-03-31 23:09:39 +02:00

Dockerfile

Update Go version to 1.26.

2026-10-20 10:34:54 +02:00

go.mod

Update Go version to 1.26.

2026-10-20 10:34:54 +02:00

go.sum

Update Go version to 1.26.

2026-10-20 10:34:54 +02:00

neko.go

move server to server directory.

2024-09-06 22:56:24 +02:00

openapi.yaml

feat(auth): add OIDC-only member authentication (#686)

2026-09-24 00:15:46 +02:00