Files
Oxicloud/src/application
BillionClaw 0c4290261e fix(auth): sanitize claims.sub when padding/truncating OIDC usernames
When OIDC providers (e.g. Keycloak) use email addresses as usernames or
when claims.sub contains @ or other invalid characters, the username
padding and collision-suffix logic could introduce invalid characters.

The fix filters claims.sub through the same allowed-character filter
before using it in username construction.

Fixes DioCrafts/OxiCloud#259
2026-04-18 07:26:36 +00:00
..