From a4e0a0a29591098bd7e3903ab635e1d9c52eb916 Mon Sep 17 00:00:00 2001 From: support Date: Sat, 24 Oct 2026 07:38:13 +0200 Subject: [PATCH 1/2] Pin System.Security.Cryptography.Pkcs to 10.0.13 and keep e-mails out of OIDC sync logs MailKit 4.18.1 pulls System.Security.Cryptography.Pkcs 10.0.0 transitively; pin the serviced 10.0.13 release next to the existing Cryptography.Xml pin. The OpenID Connect profile synchronizer logged the customer's current and the identity provider's e-mail address when it refused to change it; the customer ids are enough. --- Directory.Packages.props | 1 + .../Grand.Business.Messages.csproj | 1 + .../Security/Oidc/OidcProfileSynchronizerTests.cs | 2 +- .../Security/Oidc/OidcProfileSynchronizer.cs | 12 ++++++------ 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index b82a1d2e1d..ba9602d228 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -43,6 +43,7 @@ + diff --git a/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj b/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj index 6eb8385ff6..e642e873c9 100644 --- a/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj +++ b/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj @@ -8,5 +8,6 @@ + diff --git a/src/Tests/Grand.Web.Common.Tests/Security/Oidc/OidcProfileSynchronizerTests.cs b/src/Tests/Grand.Web.Common.Tests/Security/Oidc/OidcProfileSynchronizerTests.cs index 8a0e947332..caf87abd49 100644 --- a/src/Tests/Grand.Web.Common.Tests/Security/Oidc/OidcProfileSynchronizerTests.cs +++ b/src/Tests/Grand.Web.Common.Tests/Security/Oidc/OidcProfileSynchronizerTests.cs @@ -134,7 +134,7 @@ public async Task Email_TakenByOther_Kept() VerifyEmail("new@shop.com", Times.Never()); Assert.AreEqual("old@shop.com", _customer.Email); _logger.Verify(x => x.Log(LogLevel.Warning, It.IsAny(), - It.Is((v, _) => v.ToString()!.Contains("keeps old@shop.com") && v.ToString()!.Contains("customer c2")), + It.Is((v, _) => v.ToString()!.Contains("customer c2") && !v.ToString()!.Contains("@shop.com")), It.IsAny(), It.IsAny>()), Times.Once); } diff --git a/src/Web/Grand.Web.Common/Security/Oidc/OidcProfileSynchronizer.cs b/src/Web/Grand.Web.Common/Security/Oidc/OidcProfileSynchronizer.cs index 105caa6d88..551c07071f 100644 --- a/src/Web/Grand.Web.Common/Security/Oidc/OidcProfileSynchronizer.cs +++ b/src/Web/Grand.Web.Common/Security/Oidc/OidcProfileSynchronizer.cs @@ -50,8 +50,8 @@ private async Task SyncEmail(Customer customer, ExternalRegistrationIdentity ide //emergency access if (loginConfig.IsBreakGlass(customer.Email)) { - logger.LogWarning("OpenID Connect profile sync: break-glass customer {CustomerId} keeps {OldEmail} " + - "(the identity provider has {NewEmail})", customer.Id, customer.Email, newEmail); + logger.LogWarning("OpenID Connect profile sync: break-glass customer {CustomerId} keeps its e-mail " + + "(the identity provider has a different one)", customer.Id); return; } @@ -59,16 +59,16 @@ private async Task SyncEmail(Customer customer, ExternalRegistrationIdentity ide //and keep it signed in past the provider if (loginConfig.IsBreakGlass(newEmail)) { - logger.LogWarning("OpenID Connect profile sync: customer {CustomerId} keeps {OldEmail}: {NewEmail} is a " + - "break-glass address", customer.Id, customer.Email, newEmail); + logger.LogWarning("OpenID Connect profile sync: customer {CustomerId} keeps its e-mail: the identity " + + "provider's one is a break-glass address", customer.Id); return; } var owner = await customerService.GetCustomerByEmail(newEmail, customerConfig.RegisterCustomersPerStore ? storeId : ""); if (owner != null && owner.Id != customer.Id) { - logger.LogWarning("OpenID Connect profile sync: customer {CustomerId} keeps {OldEmail}: {NewEmail} belongs to customer {OtherId}", - customer.Id, customer.Email, newEmail, owner.Id); + logger.LogWarning("OpenID Connect profile sync: customer {CustomerId} keeps its e-mail: the identity " + + "provider's one belongs to customer {OtherId}", customer.Id, owner.Id); return; } From 3f90f7fe5e94536f8e3632202322b9b45f71991f Mon Sep 17 00:00:00 2001 From: support Date: Sat, 24 Oct 2026 08:44:30 +0200 Subject: [PATCH 2/2] Update MailKit to 4.18.2 instead of pinning System.Security.Cryptography.Pkcs MailKit 4.18.2 depends on MimeKit 4.18.2, which requires System.Security.Cryptography.Pkcs 10.0.13, so the explicit pin is no longer needed. --- Directory.Packages.props | 3 +-- .../Grand.Business.Messages/Grand.Business.Messages.csproj | 1 - 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index ba9602d228..e0c9aceebb 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -13,7 +13,7 @@ - + @@ -43,7 +43,6 @@ - diff --git a/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj b/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj index e642e873c9..6eb8385ff6 100644 --- a/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj +++ b/src/Business/Grand.Business.Messages/Grand.Business.Messages.csproj @@ -8,6 +8,5 @@ -