Miroslav Šedivý 23d8a2718e oauth: ignore email when provider reports email_verified=false. ...

An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.

Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)

2026-10-28 17:05:56 +01:00

..

api

Remove legacy mode.

2026-10-16 20:23:56 +02:00

capture

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

config

refactor: v3 config options take precedence over v2 deprecated.

2026-10-16 20:34:40 +02:00

desktop

refactor: standardize constant names and improve goroutine handling across multiple files.

2026-04-08 15:16:47 +02:00

http

Remove legacy mode.

2026-10-16 20:23:56 +02:00

member

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

plugins

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

session

Remove legacy mode.

2026-10-16 20:23:56 +02:00

webrtc

Remove legacy mode.

2026-10-16 20:23:56 +02:00

websocket

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00