mirror of
https://github.com/discourse/discourse.git
synced 2025-01-19 14:22:52 +08:00
704778f448
Issue originally reported in https://meta.discourse.org/t/bypass-sso-by-adding-unkown-email-to-group/177339 Inviting people via email address to a group when SSO is enabled (or local logins are disabled) led to a situation where user records were being created bypassing single sign-on. We already prevent that in most places. This adds required checks to `GroupsController`. |
||
---|---|---|
.. | ||
assets | ||
controllers | ||
helpers | ||
jobs | ||
mailers | ||
models | ||
serializers | ||
services | ||
views |