Can't link Github/Gitlab to existing account

[SkYNewZ]

• Gitea version (or commit ref): 1.10.0
• Git version: 2.20.1
• Operating system: Debian GNU/Linux 10 (buster) amd64
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: only SQL queries in gitea.log

Description

Hi! I enabled Gitlab and Github authentication. Its works because I can comme back on Gitea from Github/Gitlab login. Its asks me to link to existing account. I fill it, but I'm redirected to "Register New Account". I can't log in with Github and Gitlab.

Screenshots

[BaxAndrei]

same as #8923

[blueworrybear]

It seems to me that it's because external account sign in currently requires password.
Looking at the router:

routers.go:306

m.Post("/link_account_signin", bindIgnErr(auth.SignInForm{}), user.LinkAccountPostSignIn)

LinkAccountPostSignIn binds with auth.SignInForm, which force password must exist with binding:"Required;MaxSize(255)".

type SignInForm struct {
	UserName string `binding:"Required;MaxSize(254)"`
	// TODO remove required from password for SecondFactorAuthentication
	Password string `binding:"Required;MaxSize(255)"`
	Remember bool
}

As the result, LinkAccountPostSignIn always redirects to register new account due to the context error:

func LinkAccountPostSignIn(ctx *context.Context, signInForm auth.SignInForm) {
// ...
	if ctx.HasError() {
		ctx.HTML(200, tplLinkAccount)
		return
	}
//...

The context error flag is set in modules/auth/auth.go:112, function validate

The possible solution may be creating a new ExternalSignInForm and make Password optional. But it requires to check Password field within LinkAccountPostSignIn.

Let me know if this is an acceptable solution. I could create a PR to solve this issue.

[BaxAndrei]

But don't you think that if you eliminate the need to request the password for verification when connecting with oAuth2, users may abuse to acquire accounts that do not belong to them?

[blueworrybear]

But don't you think that if you eliminate the need to request the password for verification when connecting with oAuth2, users may abuse to acquire accounts that do not belong to them?

You are right. The problem is Gitea removes Password form field if you set app.ini REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = false. Both Register New Account and Link to Existing Account use REQUIRE_EXTERNAL_REGISTRATION_PASSWORD to decide whether to show Password field. It seems to me that it's confused. IMO, we should always check user's password when linking to existing account.

So the other solution would be always showing Password field on Link to Existing Account tab. However, this solution conflicts with what #6606 wants to do. I am not sure if it's acceptable. 😕

[BaxAndrei]

after I changed REQUIRE_EXTERNAL_REGISTRATION_PASSWORD = true I can confirm that everything is completely normal.