From 4de40ad4acda885a23790b48718ac9ca0bdae2ff Mon Sep 17 00:00:00 2001 From: Benjamin Tan Date: Thu, 26 Feb 2026 17:10:57 +0800 Subject: [PATCH] fix(admin): generate_link: Return correct token for "email_change_new" link I attempted to use the `hashed_token` returned in the `/admin/generate_link` response to verify the email change, however it appears that the token returned is invalid since it references the previous email instead of the new one. --- internal/api/mail.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/internal/api/mail.go b/internal/api/mail.go index 87c4841c34..a0243206c5 100644 --- a/internal/api/mail.go +++ b/internal/api/mail.go @@ -258,7 +258,8 @@ func (a *API) adminGenerateLink(w http.ResponseWriter, r *http.Request) error { if params.Type == "email_change_current" { user.EmailChangeTokenCurrent = hashedToken } else if params.Type == "email_change_new" { - user.EmailChangeTokenNew = crypto.GenerateTokenHash(params.NewEmail, otp) + hashedToken = crypto.GenerateTokenHash(params.NewEmail, otp) + user.EmailChangeTokenNew = hashedToken } terr = tx.UpdateOnly(user, "email_change_token_current", "email_change_token_new", "email_change", "email_change_sent_at", "email_change_confirm_status") if terr != nil {