d33d0e1c19117a0347dbadb99a77e9f12483c735
max
  Tue Sep 1 06:56:09 2026 -0700
hgLogin: let users set or change their recovery email address, refs #38197

Adds a page where a signed-in user can set or change the recovery address on
their account, offered in the account menu next to "Change email" -- both in
the top right blue bar popup and on the session page. It is off by default:
set login.recovEmailChange=on in hg.conf to offer it. The page also needs
login.cookieSalt, working outbound mail and the recovEmailVerified column,
and stays hidden where any of those is missing.

The new address is confirmed by mail before it takes effect, so whatever is
on the account keeps working until the link is opened and a typo costs the
user nothing. An account that has a password must supply it, since a
confirmed recovery address can sign in. Once the address does change, the
account's main address is told, the same notice that a change of the main
address already sends.

One signature now covers both the address given at signup and a later
change, so there is a single confirmation path rather than two.

diff --git src/hg/hgMenubar/hgMenubar.c src/hg/hgMenubar/hgMenubar.c
index 7312685f8c5..4e2a59c770e 100644
--- src/hg/hgMenubar/hgMenubar.c
+++ src/hg/hgMenubar/hgMenubar.c
@@ -51,36 +51,39 @@
     {
     // Link straight to the login page (absolute URL from wikiLink), not through hgSession.
     char *loginUrl = retEnc ? wikiLinkUserLoginUrlReturning("", retEnc)
                             : wikiLinkUserLoginUrl("");
     dyStringPrintf(dy, "<a class='topRightLink' href=\"%s\" id='loginLink' "
         "title='Log in to save and share sessions'>Login</a>", loginUrl);
     }
 else
     {
     char *logoutUrl = retEnc ? wikiLinkUserLogoutUrlReturning("", retEnc)
                              : wikiLinkUserLogoutUrl("");
     char *changePwUrl = retEnc ? wikiLinkChangePasswordUrlReturning("", retEnc)
                                : wikiLinkChangePasswordUrl("");
     char *changeEmailUrl = retEnc ? wikiLinkChangeEmailUrlReturning("", retEnc)
                                   : wikiLinkChangeEmailUrl("");
+    char *changeRecovEmailUrl = retEnc ? wikiLinkChangeRecovEmailUrlReturning("", retEnc)
+                                       : wikiLinkChangeRecovEmailUrl("");
     dyStringPrintf(dy, "<a class='topRightLink' href='#' id='loginLink' "
         "title='Account info and sign out' "
         "data-username=\"%s\" data-logouturl=\"%s\" data-changepwurl=\"%s\" "
-        "data-changeemailurl=\"%s\">%s</a>",
+        "data-changeemailurl=\"%s\" data-changerecovemailurl=\"%s\">%s</a>",
         userName, logoutUrl, changePwUrl ? changePwUrl : "",
-        changeEmailUrl ? changeEmailUrl : "", userName);
+        changeEmailUrl ? changeEmailUrl : "",
+        changeRecovEmailUrl ? changeRecovEmailUrl : "", userName);
     }
 freez(&retEnc);
 return dyStringCannibalize(&dy);
 }
 
 char *incFilePath(char *cgiPath, char *filePath, char *docRoot)
 /* Replace CGI_NAME in cgiPath with docRoot/filePath.  filePath must begin with "/" eg "/inc/..." */
 {
 char *incPath = replaceChars(cgiPath, "/"CGI_NAME, filePath);
 return catTwoStrings(docRoot, incPath);
 }
 
 void printIncludes(char* baseDir, char *docRoot)
 {
 // Cache-buster for the menu-bar CSS/JS: append ?v=<file mtime> so browsers refetch these when