From d3323efbe22417e2e2bbda9d53d7138383e54a0f Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 15:06:54 +0200 Subject: [PATCH] test(19.5): complete UAT - 3 passed, 0 issues --- .../phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md index 766e9c50..982be751 100644 --- a/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md +++ b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md @@ -8,11 +8,7 @@ updated: 2026-10-21T13:40:00.000Z ## Current Test -number: 1 -name: Decide on the residual pre-account-takeover path left open by the T-19.5-38 fix. ownerVerifiedEmail treats has_self_set_password=true as proof the owner controls the address, but POST /register with golem15.user activation.activate_mode=auto (the default) creates an activated account with has_self_set_password=true and no email check. An attacker who registers victim@example.com with a password before the victim's first Google/GitHub sign-in gets the victim's verified identity auto-linked onto the attacker's account, and keeps password access. -expected: | - Either accept it explicitly (it is exactly PHP's D-10 behaviour, and the variant T-19.5-38 closed was the social-created one), or schedule a follow-up (for example: auto-link only when the account was activated by mail or set its password through the reset code, or require activate_mode=user for apps mounting sociallogin). Also correct 19.5-SECURITY-REVIEW.md / README wording that a self-set password means the owner 'proved the address'. -awaiting: user response +[testing complete] ## Tests