github-mirror/discourse
github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-03-20 05:25:31 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Ensure that login does not fail for users with invite records (#15647)

Browse Source 
In the unlikely, but possible, scenario where a user has no email_tokens, and has an invite record for their email address, login would fail. This commit fixes the `Invite` `user_doesnt_already_exist` validation so that it only applies to new invites, or when changing the email address.

This regressed in d8fe0f4199b5bb44fa79fa489586b4029289242c (based on `git bisect`)
This commit is contained in:
David Taylor 2022-01-20 10:54:38 +00:00 committed by GitHub
parent 5b7bddf966
commit 820564826e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/models/invite.rb
View File

@ -32,7 +32,7 @@ class Invite < ActiveRecord::Base
validates :email, email: true, allow_blank: true validates :email, email: true, allow_blank: true
validate :ensure_max_redemptions_allowed validate :ensure_max_redemptions_allowed
validate :valid_domain, if: :will_save_change_to_domain? validate :valid_domain, if: :will_save_change_to_domain?
validate :user_doesnt_already_exist validate :user_doesnt_already_exist, if: :will_save_change_to_email?
before_create do before_create do
self.invite_key ||= SecureRandom.base58(10) self.invite_key ||= SecureRandom.base58(10)

14
spec/requests/omniauth_callbacks_controller_spec.rb
View File

@ -411,6 +411,20 @@ RSpec.describe Users::OmniauthCallbacksController do
expect(user.confirm_password?("securepassword")).to eq(false) expect(user.confirm_password?("securepassword")).to eq(false)
end end
it "should work if the user has no email_tokens, and an invite" do
# Confirming existing email_tokens has a side effect of redeeming invites.
# Pretend we don't have any email_tokens
user.email_tokens.destroy_all
invite = Fabricate(:invite, invited_by: Fabricate(:admin))
invite.update_column(:email, user.email) # (avoid validation)
get "/auth/google_oauth2/callback.json"
expect(response.status).to eq(302)
expect(invite.reload.invalidated_at).not_to eq(nil)
end
it "should update name/username/email when SiteSetting.auth_overrides_* are enabled" do it "should update name/username/email when SiteSetting.auth_overrides_* are enabled" do
SiteSetting.email_editable = false SiteSetting.email_editable = false
SiteSetting.auth_overrides_email = true SiteSetting.auth_overrides_email = true