3 people dfdb0438ad fix(auth): only auto-link the account the external identity points to (#40121) (#40137) ...

Backport https://github.com/go-gitea/gitea/pull/40121

With `[oauth2_client].ACCOUNT_LINKING = auto`, the link account sign-up
form linked the external identity to an existing account matching the
submitted user name or email and signed in as it. Automatic linking now
only happens when the existing user matches the external identity,
otherwise the linking login page asks for the account's password.

`release/v28` lacks `TestOAuth2AvatarFromPicture`, so only the new test
is added.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: Giteabot <teabot@gitea.io>

2026-10-31 22:33:10 +00:00

..

admin

refactor(api): convert bot accounts through the admin user edit endpoint (#39355)

2026-09-18 17:11:56 +02:00

auth

fix(auth): only auto-link the account the external identity points to (#40121) (#40137)

2026-10-31 22:33:10 +00:00

devtest

fix(mail): preserve outer spacing in notification emails (#40104) (#40111)

2026-10-31 09:29:48 +00:00

explore

refactor: pagination/pager (#39162)

2026-08-29 08:20:46 +02:00

feed

fix: harden context user access scope (#39945) (#40115)

2026-10-31 17:40:49 +01:00

healthcheck

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

misc

chore: apply golangci "forbidigo" to all packages (#39151)

2026-08-27 16:34:44 +00:00

org

fix(projects): hide linked pull requests the viewer cannot read (#40016) (#40134)

2026-10-31 18:14:26 +01:00

repo

fix(projects): hide linked pull requests the viewer cannot read (#40016) (#40134)

2026-10-31 18:14:26 +01:00

shared

fix: enforce public-only token scope on more routes (#39690) (#39853)

2026-10-21 05:58:07 +00:00

user

perf: speed up the issue and pull request dashboards and fix table indices (#40001) (#40096)

2026-10-31 07:38:45 +00:00

websocket

feat: Replace SSE with WebSocket for UI notifications (#36965)

2026-07-27 07:46:00 +00:00

base.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

githttp.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

goget.go

fix: correct "go get" URL ssh scheme, fix form binding (#39674, #39528) (#39676)

2026-10-08 12:30:59 +00:00

home.go

fix(api): allow bots with pending password changes (#39551) (#39566)

2026-10-03 19:19:44 +00:00

metrics.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

nodeinfo.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

passkey.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

swagger_json.go

refactor: serve the api specs as plain json (#38715)

2026-07-31 14:16:27 +00:00

web.go

fix: harden context user access scope (#39945) (#40115)

2026-10-31 17:40:49 +01:00

webfinger.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00