mirror of
https://github.com/element-hq/matrix-authentication-service.git
synced 2026-10-14 19:48:46 +00:00
`POST /register` checks that a registration matches the username and email address its token pins, but the token step could attach any valid token to a registration afterwards. Registering as anyone, then attaching a pinned token, registered a username the token doesn't pin. Swapping a passwordless token for one that isn't left a registration with no password at all. The token step now refuses a token that doesn't fit the registration: one that pins another username or another email address than the registration's, or one that isn't passwordless for a registration without a password or an upstream link. Finishing a registration checks the same against the verified email address, and refuses a passwordless registration without one. Only a tampered registration gets that far, so these fail like the other last-minute checks there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF
122 lines
4.0 KiB
HTML
122 lines
4.0 KiB
HTML
{#
|
|
Copyright 2025, 2026 Element Creations Ltd.
|
|
Copyright 2024, 2025 New Vector Ltd.
|
|
Copyright 2021-2024 The Matrix.org Foundation C.I.C.
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
|
|
Please see LICENSE files in the repository root for full details.
|
|
-#}
|
|
|
|
{% set cnt = counter() %}
|
|
|
|
{% macro new_id() -%}
|
|
form-{{- cnt.next() -}}
|
|
{%- endmacro %}
|
|
|
|
{% macro attributes(field, default_value=None) -%}
|
|
{%- set value = field.value | default(default_value) -%}
|
|
name="{{ field.name }}" id="{{ field.id }}"
|
|
{%- if field.errors is not empty %} data-invalid{% endif %}
|
|
{%- if value %} value="{{ value }}" {% endif %}
|
|
{%- endmacro %}
|
|
|
|
{% macro error(error, field_name="", hidden=false) %}
|
|
<div class="cpd-form-message cpd-form-error-message
|
|
{%- if hidden %} hidden{% endif %}" data-error-kind="{{ error.kind }}"
|
|
{%- if error.code is defined %}data-error-code="{{ error.code }}"{% endif %}>
|
|
{% if error.kind == "required" %}
|
|
{{ _("mas.errors.field_required") }}
|
|
{% elif error.kind == "exists" and field_name == "username" %}
|
|
{{ _("mas.errors.username_taken") }}
|
|
{% elif error.kind == "mismatch" and field_name == "token" %}
|
|
{{ _("mas.errors.registration_token_mismatch") }}
|
|
{% elif error.kind == "policy" %}
|
|
{% if error.code == "username-too-short" %}
|
|
{{ _("mas.errors.username_too_short") }}
|
|
{% elif error.code == "username-too-long" %}
|
|
{{ _("mas.errors.username_too_long") }}
|
|
{% elif error.code == "username-invalid-chars" %}
|
|
{{ _("mas.errors.username_invalid_chars") }}
|
|
{% elif error.code == "username-all-numeric" %}
|
|
{{ _("mas.errors.username_all_numeric") }}
|
|
{% elif error.code == "username-banned" %}
|
|
{{ _("mas.errors.username_banned") }}
|
|
{% elif error.code == "username-not-allowed" %}
|
|
{{ _("mas.errors.username_not_allowed") }}
|
|
{% elif error.code == "email-domain-not-allowed" %}
|
|
{{ _("mas.errors.email_domain_not_allowed") }}
|
|
{% elif error.code == "email-domain-banned" %}
|
|
{{ _("mas.errors.email_domain_banned") }}
|
|
{% elif error.code == "email-not-allowed" %}
|
|
{{ _("mas.errors.email_not_allowed") }}
|
|
{% elif error.code == "email-banned" %}
|
|
{{ _("mas.errors.email_banned") }}
|
|
{% else %}
|
|
{{ _("mas.errors.denied_policy", policy=error.message) }}
|
|
{% endif %}
|
|
{% elif error.kind == "password_mismatch" %}
|
|
{{ _("mas.errors.password_mismatch") }}
|
|
{% elif error.kind == "invalid" %}
|
|
{{ _("mas.errors.field_invalid") }}
|
|
{% else %}
|
|
{{ error.kind }}
|
|
{% endif %}
|
|
</div>
|
|
{% endmacro %}
|
|
|
|
{% macro field(label, name, form_state=false, class="", inline=false) %}
|
|
{% set field_id = new_id() %}
|
|
{% if not form_state %}
|
|
{% set form_state = {"fields": {}} %}
|
|
{% endif %}
|
|
|
|
{% set state = form_state.fields[name] | default({"errors": [], "value": ""}) %}
|
|
{% set field = {
|
|
"id": new_id(),
|
|
"name": name,
|
|
"errors": state.errors,
|
|
"value": state.value,
|
|
} %}
|
|
|
|
<div class="{% if inline %}cpd-form-inline-field{% else %}cpd-form-field{% endif %} {{ class }}">
|
|
{% if not inline %}
|
|
<label class="cpd-form-label" for="{{ field.id }}"
|
|
{%- if field.errors is not empty %} data-invalid{% endif -%}
|
|
>{{ label }}</label>
|
|
|
|
{{ caller(field) }}
|
|
{% else %}
|
|
<div class="cpd-form-inline-field-control">
|
|
{{ caller(field) }}
|
|
</div>
|
|
|
|
<div class="cpd-form-inline-field-body">
|
|
<label class="cpd-form-label" for="{{ field.id }}"
|
|
{%- if field.errors is not empty %} data-invalid{% endif -%}
|
|
>{{ label }}</label>
|
|
{% endif %}
|
|
|
|
|
|
{% if field.errors is not empty %}
|
|
{% for field_error in field.errors %}
|
|
{% if field_error.kind != "unspecified" %}
|
|
{{ error(error=field_error, field_name=field.name) }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
{% if inline %}
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
{% endmacro %}
|
|
|
|
|
|
{% macro separator() %}
|
|
<div class="separator">
|
|
<hr />
|
|
<p>{{ _("mas.or_separator") }}</p>
|
|
<hr />
|
|
</div>
|
|
{% endmacro %}
|