[v8.5.x] Chore: Release 8.5.14 (#56698)

* remove support for v1

(cherry picked from commit 8630a7a991af74edc4030f57d37a4bc263202fde)

* Security: Make proxy endpoints not leak sensitive HTTP headers

Fixes CVE-2022-31130

(cherry picked from commit 2974574a53ab6d26be7b706e76271173a91fea3a)

* Security: Fix do not forward login cookie in outgoing requests

(cherry picked from commit 54a32fc83b233f5910495b5fcca0b4f881221538)

* Add test for username/login field conflict

(cherry picked from commit 7aabcf2694)

* Swap order of login fields

(cherry picked from commit 5ec176cada)

* "Release: Updated versions in package to 8.5.14" (#547)

Co-authored-by: Will Browne <will.browne@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
Co-authored-by: Grot (@grafanabot) <43478413+grafanabot@users.noreply.github.com>

pkg/services/sqlstore/user.go

@@ -295,20 +295,25 @@ func (ss *SQLStore) GetUserByLogin(ctx context.Context, query *models.GetUserByL
 			return models.ErrUserNotFound
 		}
 
-		// Try and find the user by login first.
-		// It's not sufficient to assume that a LoginOrEmail with an "@" is an email.
+		var has bool
+		var err error
 		user := &models.User{Login: query.LoginOrEmail}
-		has, err := sess.Where(notServiceAccountFilter(ss)).Get(user)
 
-		if err != nil {
-			return err
-		}
-
-		if !has && strings.Contains(query.LoginOrEmail, "@") {
-			// If the user wasn't found, and it contains an "@" fallback to finding the
-			// user by email.
+		// Since username can be an email address, attempt login with email address
+		// first if the login field has the "@" symbol.
+		if strings.Contains(query.LoginOrEmail, "@") {
 			user = &models.User{Email: query.LoginOrEmail}
 			has, err = sess.Get(user)
+
+			if err != nil {
+				return err
+			}
+		}
+
+		// Lookup the login field instead of email field
+		if !has {
+			user = &models.User{Login: query.LoginOrEmail}
+			has, err = sess.Where(notServiceAccountFilter(ss)).Get(user)
 		}
 
 		if err != nil {