kevinveenbirkenbachandClaude Opus 5.5 e277edf6e7 fix(web-app-keycloak): close self-service email takeover ...

Users could change their Keycloak email without verification, and every deploy stamped any address an inventory user held as verified. An address no Keycloak account holds (for example erpnext-api-bot@) could thus be claimed and reach apps that link SSO logins by email. The user profile now lets only admins edit the email, and email_verified.py stamps only an address that equals the inventory address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 08:57:17 +01:00

..

files

fix(web-app-keycloak): close self-service email takeover

2026-11-01 08:57:17 +01:00

filter_plugins

…

templates

fix(web-app-keycloak): close self-service email takeover

2026-11-01 08:57:17 +01:00

__init__.py

…

test_async_kcadm_jobs.py

perf(web-app-keycloak): converge clients, scopes and realm mail settings in one admin REST pass

2026-10-29 01:43:13 +01:00

test_build_realm_rbac_groups.py

…

test_logout_i18n_catalogue.py

feat(env): switch the GPU-only tests with INFINITO_TEST_GPU

2026-10-29 11:50:26 +01:00

test_logout_panel_loader.py

…

test_logout_status_panel.py

Merge branch 'feature/updater' into feature/store-i18n

2026-10-29 02:28:16 +01:00

test_rbac_per_app.py

…