Revert "Revert "Revert "SECURITY: Ensure oAuth authenticated email is the same as created user's email."""

This reverts commit e6d75f68449ba5cc57e0abcbaa8cc1d505dd4916.

This is why we should not be pushing directly to master.

app/services/user_authenticator.rb

@@ -21,10 +21,7 @@ class UserAuthenticator
   end
 
   def finish
-    if authenticator && authenticated?
-      authenticator.after_create_account(@user, @session)
-    end
-
+    authenticator.after_create_account(@user, @session) if authenticator
     @session = nil
   end
 

spec/components/auth/user_authenticator_spec.rb

@@ -1,36 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe UserAuthenticator do
-  let(:user) { Fabricate(:user, email: 'test@discourse.org') }
-
-  describe "#finish" do
-    before do
-      SiteSetting.enable_google_oauth2_logins = true
-    end
-
-    it "should execute provider's callback" do
-      user.update!(email: 'test@gmail.com')
-
-      authenticator = UserAuthenticator.new(user, { authentication: {
-        authenticator_name: Auth::GoogleOAuth2Authenticator.new.name,
-        email: user.email,
-        email_valid: true,
-        extra_data: { google_user_id: 1 }
-      }})
-
-      expect { authenticator.finish }.to change { GoogleUserInfo.count }.by(1)
-    end
-
-    describe "when session's email is different from user's email" do
-      it "should not execute provider's callback" do
-        authenticator = UserAuthenticator.new(user, { authentication: {
-          authenticator_name: Auth::GoogleOAuth2Authenticator.new.name,
-          email: 'test@gmail.com',
-          email_valid: true
-        }})
-
-        expect { authenticator.finish }.to_not change { GoogleUserInfo.count }
-      end
-    end
-  end
-end

spec/controllers/users_controller_spec.rb

@@ -611,8 +611,6 @@ describe UsersController do
           auth = session[:authentication] = {}
           auth[:authenticator_name] = 'twitter'
           auth[:extra_data] = twitter_auth
-          auth[:email_valid] = true
-          auth[:email] = @user.email
 
           post_user