4b04bd017d7a36d460447d8552ecaf9c8a33db4a
max
  Tue Aug 4 02:51:56 2026 -0700
hgLogin: gate email-link sign-in and change-email behind login.emailLink (default off), refs #37929

Also: GitHub/OIDC token-format and robustness fixes, signed pending-identity to close
an account-takeover hole in the OAuth account chooser, account chooser for the email-link
flow, idx-based chooser to avoid a utf8/latin1 collation error on non-ASCII usernames, and
login/signup page UI polish (consistent buttons, fonts, cache-busted stylesheet, forgot
links, wording). refs #37984

diff --git src/hg/lib/wikiLink.c src/hg/lib/wikiLink.c
index c0ba08902c3..ee79aed564f 100644
--- src/hg/lib/wikiLink.c
+++ src/hg/lib/wikiLink.c
@@ -536,35 +536,38 @@
     }
 else
     {
     if (! wikiLinkEnabled())
         errAbort("wikiLinkUserLogoutUrl called when wiki is not enable (specified "
             "in hg.conf).");
     safef(buf, sizeof(buf),
         "http://%s/index.php?title=Special:UserlogoutUCSC&returnto=%s",
          wikiLinkHost(), retEnc);
     }
 freez(&retEnc);
 return(cloneString(buf));
 }
 
 char *wikiLinkChangeEmailUrl(char *hgsid)
-/* Return the URL for the user change email page.  Only supported by the hgLogin
- * login system; returns NULL when a remote wiki handles logins. */
+/* Return the URL for the user change email page, or NULL if unavailable.  Supported only by
+ * the hgLogin login system, and only when the login.emailLink feature is enabled in hg.conf
+ * (the same switch that controls the passwordless email-link sign-in). */
 {
 if (!loginSystemEnabled())
     return NULL;
+if (!cfgOptionBooleanDefault(CFG_LOGIN_EMAIL_LINK, FALSE))
+    return NULL;
 char buf[2048];
 char *retEnc = encodedHgSessionReturnUrl(hgsid);
 safef(buf, sizeof(buf),
     "%s?hgLogin.do.changeEmailPage=1&returnto=%s",
     loginUrl(), retEnc);
 freez(&retEnc);
 return(cloneString(buf));
 }
 
 void wikiFixLogoutLinkWithJs()
 /* HTTP Basic Auth requires a strange hack to logout. This code prints a script 
  * that fixes an html link with id=logoutLink */
 {
 struct dyString *dy = dyStringNew(4096);
 // logoutJs.h is a stringified .js file