diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini index b4d5ba00b..180fd1c18 100644 --- a/options/locale/locale_en-US.ini +++ b/options/locale/locale_en-US.ini @@ -2559,6 +2559,7 @@ teams.all_repositories_admin_permission_desc = This team grants Admin%s in organization %s. teams.invite.by = Invited by %s teams.invite.description = Please click the button below to join the team. +teams.invite.email_mismatch = Your email address does not match this invite. [admin] dashboard = Dashboard diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go index 2ce4bf532..9a0f49b68 100644 --- a/routers/web/org/teams.go +++ b/routers/web/org/teams.go @@ -552,6 +552,7 @@ func TeamInvite(ctx *context.Context) { ctx.Data["Organization"] = org ctx.Data["Team"] = team ctx.Data["Inviter"] = inviter + ctx.Data["EmailMismatch"] = ctx.Doer.Email != invite.Email ctx.HTML(http.StatusOK, tplTeamInvite) } @@ -568,6 +569,13 @@ func TeamInvitePost(ctx *context.Context) { return } + // check that the Doer is the invitee + if ctx.Doer.Email != invite.Email { + log.Info("invite %d does not apply to the current user %d", invite.ID, ctx.Doer.ID) + ctx.NotFound("ErrTeamInviteNotFound", err) + return + } + if err := models.AddTeamMember(team, ctx.Doer.ID); err != nil { ctx.ServerError("AddTeamMember", err) return diff --git a/templates/org/team/invite.tmpl b/templates/org/team/invite.tmpl index 55ecd049b..8d1fad014 100644 --- a/templates/org/team/invite.tmpl +++ b/templates/org/team/invite.tmpl @@ -6,17 +6,23 @@