690cc018255362c9d1af6ed5f4fa15ae7a0fc81d
max
  Wed Aug 5 11:26:22 2026 -0700
changes after automated code review

hgLogin: sign the pending social identity with hmacMd5() instead of a hand-built
cookieSalt-prefix + MD5. The salt now keys the HMAC rather than being prepended to
the hashed message. This is the signature that closes the account-takeover hole in
the OAuth account chooser, so it should use a real MAC. It also now fails closed:
with login.cookieSalt unset the old code hashed an empty salt, so anyone could
compute a valid signature and the protection was silently absent - hgLogin refuses
to run a social login without the salt. Ordinary login pages never reach this check.
Pending identities in flight across the upgrade no longer validate; those users are
asked to sign in again.

lib/hmac.c: hmacSha1() and hmacMd5() sized their hex buffers at exactly 40 and 32
chars, so the last sprintf wrote its terminating zero one byte past the array and
the following strlen read out of bounds. Grow both by one and use cloneString().
Output is unchanged, verified against openssl dgst -hmac.

userAccounts.css: drop the #helpBox rule, unused since the last id="helpBox" was
removed from hgLogin.c.

mirrorManual, ex.hg.conf: the login section claimed "three" extra ways to sign in
when there are two (external provider, one-time email link). Also document that
login.cookieSalt is required for social sign-in, now that the check fails closed.
Edited mirrorManual.txt and regenerated the html with mirrorDocs/make, since the
html is pandoc output and hand edits there do not survive.

refs #37984

diff --git src/product/ex.hg.conf src/product/ex.hg.conf
index 9c191b6b7d4..6b8e975e324 100644
--- src/product/ex.hg.conf
+++ src/product/ex.hg.conf
@@ -186,30 +186,33 @@
 # login.emailLink=on
 
 # Optional social login buttons on the hgLogin signup and login pages.
 #
 # List the providers to offer, then give each one a block of settings.  A provider's button
 # appears only when both its clientId and clientSecret are set, so leaving these unset hides
 # it.  Register an OAuth 2.0 / OpenID Connect client with each provider and set its "redirect
 # URI" to your hgLogin URL exactly, e.g. https://yourbrowser.university.edu/cgi-bin/hgLogin
 # When a login supplies a verified email that matches an existing account, that account is
 # automatically linked to the new identity.
 #
 # For UCSC: clientId and clientSecret are secrets - put them in hg.conf.private, not here
 # (this file, hg.conf, is public).  The non-secret settings (the providers list, labels,
 # issuer/endpoints) can live in either file.
 #
+# login.cookieSalt above must be set: it is the key that signs the identity handed back from
+# the provider, so hgLogin refuses to run a social login without it.
+#
 # login.oauth.providers=google,orcid,github,myuni
 #
 # google, orcid and github are "known" providers with built-in endpoints, so they only need
 # a clientId and clientSecret:
 # login.oauth.google.clientId=xxxxxxxx.apps.googleusercontent.com
 # login.oauth.google.clientSecret=xxxxxxxx
 # login.oauth.orcid.clientId=APP-XXXXXXXXXXXXXXXX
 # login.oauth.orcid.clientSecret=xxxxxxxx
 # login.oauth.github.clientId=Iv1.xxxxxxxx
 # login.oauth.github.clientSecret=xxxxxxxx
 #
 # Any other OpenID Connect server works too.  Give it a label, credentials, and either an
 # issuer (its endpoints are discovered from <issuer>/.well-known/openid-configuration) or the
 # three endpoint URLs spelled out explicitly:
 # login.oauth.myuni.label=My University