Subversion Repositories SmartDukaan

Last modification

• Rev 37913 2026-10-19 08:45:45
• Author: amit

• Log message:

  fix(security): fofo /login no longer trusts a request email when Google verification fails
  
  LoginController.login fell back to emailId = emailIdOrMobileNumber whenever
  googleTokenUtil.getEmailId(token) threw, so any bogus token plus any email
  logged the caller in as that user. Verification failure now fails the login.
  GoogleTokenUtil also requires tokeninfo aud == google.api.key (our web client
  id, same value the login page uses) and email_verified == true.
  Password login is unchanged.