admin777/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check oauthUser.Username length

Browse Source
This commit is contained in:
Seefs 2026-02-24 13:26:19 +08:00
parent 0427ddda03
commit 262ece0d71
2 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
controller/oauth.go
View File

@ -240,7 +240,10 @@ func findOrCreateOAuthUser(c *gin.Context, provider oauth.Provider, oauthUser *o
if oauthUser.Username != "" { if oauthUser.Username != "" {
if exists, err := model.CheckUserExistOrDeleted(oauthUser.Username, ""); err == nil && !exists { if exists, err := model.CheckUserExistOrDeleted(oauthUser.Username, ""); err == nil && !exists {
user.Username = oauthUser.Username // 防止索引退化
if len(oauthUser.Username) <= model.UserNameMaxLength {
user.Username = oauthUser.Username
}
} }
} }
@ -302,12 +305,12 @@ func findOrCreateOAuthUser(c *gin.Context, provider oauth.Provider, oauthUser *o
// Set the provider user ID on the user model and update // Set the provider user ID on the user model and update
provider.SetProviderUserID(user, oauthUser.ProviderUserID) provider.SetProviderUserID(user, oauthUser.ProviderUserID)
if err := tx.Model(user).Updates(map[string]interface{}{ if err := tx.Model(user).Updates(map[string]interface{}{
"github_id": user.GitHubId, "github_id": user.GitHubId,
"discord_id": user.DiscordId, "discord_id": user.DiscordId,
"oidc_id": user.OidcId, "oidc_id": user.OidcId,
"linux_do_id": user.LinuxDOId, "linux_do_id": user.LinuxDOId,
"wechat_id": user.WeChatId, "wechat_id": user.WeChatId,
"telegram_id": user.TelegramId, "telegram_id": user.TelegramId,
}).Error; err != nil { }).Error; err != nil {
return err return err
} }

2
model/user.go
View File

@ -15,6 +15,8 @@ import (
"gorm.io/gorm" "gorm.io/gorm"
) )
const UserNameMaxLength = 20
// User if you add sensitive fields, don't forget to clean them in setupLogin function. // User if you add sensitive fields, don't forget to clean them in setupLogin function.
// Otherwise, the sensitive information will be saved on local storage in plain text! // Otherwise, the sensitive information will be saved on local storage in plain text!
type User struct { type User struct {