From 820564826e99791b1dae361f3efb6106146d4bd0 Mon Sep 17 00:00:00 2001 From: David Taylor Date: Thu, 20 Jan 2022 10:54:38 +0000 Subject: [PATCH] FIX: Ensure that login does not fail for users with invite records (#15647) In the unlikely, but possible, scenario where a user has no email_tokens, and has an invite record for their email address, login would fail. This commit fixes the `Invite` `user_doesnt_already_exist` validation so that it only applies to new invites, or when changing the email address. This regressed in d8fe0f4199b5bb44fa79fa489586b4029289242c (based on `git bisect`) --- app/models/invite.rb | 2 +- .../requests/omniauth_callbacks_controller_spec.rb | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/app/models/invite.rb b/app/models/invite.rb index e64f4c69bd2..1594a109ab4 100644 --- a/app/models/invite.rb +++ b/app/models/invite.rb @@ -32,7 +32,7 @@ class Invite < ActiveRecord::Base validates :email, email: true, allow_blank: true validate :ensure_max_redemptions_allowed validate :valid_domain, if: :will_save_change_to_domain? - validate :user_doesnt_already_exist + validate :user_doesnt_already_exist, if: :will_save_change_to_email? before_create do self.invite_key ||= SecureRandom.base58(10) diff --git a/spec/requests/omniauth_callbacks_controller_spec.rb b/spec/requests/omniauth_callbacks_controller_spec.rb index 4f7cbd4fe07..46f81b1d997 100644 --- a/spec/requests/omniauth_callbacks_controller_spec.rb +++ b/spec/requests/omniauth_callbacks_controller_spec.rb @@ -411,6 +411,20 @@ RSpec.describe Users::OmniauthCallbacksController do expect(user.confirm_password?("securepassword")).to eq(false) end + it "should work if the user has no email_tokens, and an invite" do + # Confirming existing email_tokens has a side effect of redeeming invites. + # Pretend we don't have any email_tokens + user.email_tokens.destroy_all + + invite = Fabricate(:invite, invited_by: Fabricate(:admin)) + invite.update_column(:email, user.email) # (avoid validation) + + get "/auth/google_oauth2/callback.json" + expect(response.status).to eq(302) + + expect(invite.reload.invalidated_at).not_to eq(nil) + end + it "should update name/username/email when SiteSetting.auth_overrides_* are enabled" do SiteSetting.email_editable = false SiteSetting.auth_overrides_email = true