Invalid domain used when ldap record doesn't have email field

[pezhovski]

Description

When syncing users from ldap, if user doesn't have email field, username@localhost is used https://github.com/go-gitea/gitea/blob/v1.17.2/services/auth/source/ldap/source_sync.go#L88

Later when trying to edit this user from admin page, I'm getting an error that email is invalid

Gitea Version

1.17.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Downloaded binary from release page, run with systemd

Database

No response

[lunny]

Maybe we should ignore this user with no email input?

[pezhovski]

@lunny I think it would be kinda unfair to ignore such users. In case some organizations may not have email set up, or it is a guest or automation user with no email within organization.

I remember investigating this a little bit more, and the root cause of this behavior was the go library that validates email addresses. When I last checked it required fqdn and, probably, just localhost is not a valid fqdn for this library, sorry for not mentioning this in the issue.

So, I believe faster approach would be to change localhost to localhost.local or localhost.localhost, but I am not sure if it could potentially lead to security or compatibility issues.

[Zettat123]

The Email field has an Email tag, so when we try to edit a user with the default email (username@localhost), the validation will fail.

gitea/services/forms/admin.go

Line 40 in 59d2189

Email string `binding:"Required;Email;MaxSize(254)"`

So, I believe faster approach would be to change localhost to localhost.local or localhost.localhost, but I am not sure if it could potentially lead to security or compatibility issues.

Since we shouldn't ignore the users with no email, I think changing the email suffix would be a solution.