Fix: sanitized emails before access control check

noi-techpark · Mar 1, 2024 · dc3b1e4 · dc3b1e4
1 parent a88b241
commit dc3b1e4
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/app/src/main/java/it/bz/noi/community/oauth/AuthManager.kt b/app/src/main/java/it/bz/noi/community/oauth/AuthManager.kt
@@ -101,7 +101,15 @@ object AuthManager {
 		}
 	}
 
-	private fun Contact.matches(mail: String): Boolean = mail == email || mail == email2 || mail == email3
+	private fun Contact.matches(mail: String): Boolean {
+
+		// Mail can include garbage whitespaces.
+		fun String.sanitized() = trim()
+
+		return with (mail.sanitized()) {
+			equals(email?.sanitized(), true) || equals(email2?.sanitized(), true) || equals(email3?.sanitized(), true)
+		}
+	}
 
 	private suspend fun UserState.toStatus(): AuthStateStatus {
 		return when {

diff --git a/app/version.properties b/app/version.properties
@@ -1,2 +1,2 @@
-#Tue Sep 28 07:39:37 UTC 2021
-VERSION_CODE=20
+#Fri Mar 1 08:48:00 UTC 2024
+VERSION_CODE=21