fix: email validation flow, so that it actually works, fixed event logging bug, new email verification template

public/language/en-GB/email.json

@@ -9,7 +9,9 @@
 	"greeting_with_name": "Hello %1",
 
 	"email.verify-your-email.subject": "Please verify your email",
-	"email.verify.text1": "Your email address has changed!",
+	"email.verify.text1": "You've requested that we change or confirm your email address",
+	"email.verify.text2": "For security purposes, we only change or confirm the email address on file once its ownership has been confirmed via email. <strong>If you did not request this, no action is required on your part.</strong>",
+	"email.verify.text3": "Once you confirm this email address, we will replace your current email address with this one (%1).",
 
 	"welcome.text1": "Thank you for registering with %1!",
 	"welcome.text2": "To fully activate your account, we need to verify that you own the email address you registered with.",

src/socket.io/admin/email.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const meta = require('../../meta');
 const userDigest = require('../../user/digest');
 const userEmail = require('../../user/email');
 const notifications = require('../../notifications');
@@ -13,6 +14,7 @@ Email.test = async function (socket, data) {
 		...(data.payload || {}),
 		subject: '[[email:test-email.subject]]',
 	};
+	let template;
 
 	switch (data.template) {
 		case 'digest':
@@ -31,9 +33,16 @@ Email.test = async function (socket, data) {
 			await emailer.send(data.template, socket.uid, payload);
 			break;
 
+		case 'verify-email':
+			template = 'verify-email';
+			// falls through
+
 		case 'welcome':
 			await userEmail.sendValidationEmail(socket.uid, {
 				force: 1,
+				email: 'test@example.org',
+				template: template || 'welcome',
+				subject: !template ? `[[email:welcome-to, ${meta.config.title || meta.config.browserTitle || 'NodeBB'}]]` : undefined,
 			});
 			break;
 

src/user/create.js

@@ -114,6 +114,8 @@ module.exports = function (User) {
 		if (userData.email && userData.uid > 1) {
 			User.email.sendValidationEmail(userData.uid, {
 				email: userData.email,
+				template: 'welcome',
+				subject: `[[email:welcome-to, ${meta.config.title || meta.config.browserTitle || 'NodeBB'}]]`,
 			}).catch(err => winston.error(`[user.create] Validation email failed to send\n[emailer.send] ${err.stack}`));
 		}
 		if (userNameChanged) {

src/user/email.js

@@ -99,13 +99,14 @@ UserEmail.sendValidationEmail = async function (uid, options) {
 	});
 
 	const data = {
-		username: username,
+		uid,
-		confirm_link: confirm_link,
+		username,
-		confirm_code: confirm_code,
+		confirm_link,
+		confirm_code,
+		email: options.email,
 
-		subject: options.subject || `[[email:welcome-to, ${meta.config.title || meta.config.browserTitle || 'NodeBB'}]]`,
+		subject: options.subject || '[[email:email.verify-your-email.subject]]',
-		template: options.template || 'welcome',
+		template: options.template || 'verify-email',
-		uid: uid,
 	};
 
 	if (plugins.hooks.hasListeners('action:user.verify')) {
@@ -134,8 +135,8 @@ UserEmail.confirmByCode = async function (code) {
 		}
 	}
 
+	await user.setUserField(confirmObj.uid, 'email', confirmObj.email);
 	await Promise.all([
-		user.setUserField('email', confirmObj.email),
 		UserEmail.confirmByUid(confirmObj.uid),
 		db.delete(`confirm:${code}`),
 	]);

src/user/index.js

@@ -262,8 +262,14 @@ User.addInterstitials = function (callback) {
 								const [isAdminOrGlobalMod, canEdit] = await Promise.all([
 									User.isAdminOrGlobalMod(data.req.uid),
 									privileges.users.canEdit(data.req.uid, userData.uid),
+
 								]);
-								if (isAdminOrGlobalMod || canEdit) {
+
+								// Admins editing will auto-confirm, unless editing their own email
+								if (isAdminOrGlobalMod && userData.uid !== data.req.uid) {
+									await User.setUserField(userData.uid, 'email', formData.email);
+									await User.email.confirmByUid(userData.uid);
+								} else if (canEdit) {
 									await User.email.sendValidationEmail(userData.uid, {
 										email: formData.email,
 										force: true,

src/user/profile.js

@@ -246,8 +246,6 @@ module.exports = function (User) {
 		if (newEmail) {
 			await User.email.sendValidationEmail(uid, {
 				email: newEmail,
-				subject: '[[email:email.verify-your-email.subject]]',
-				template: 'verify_email',
 				force: 1,
 			}).catch(err => winston.error(`[user.create] Validation email failed to send\n[emailer.send] ${err.stack}`));
 		}

src/views/emails/verify-email.tpl

@@ -9,7 +9,7 @@
 			<table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%">
 				<tr>
 					<td style="padding: 40px 40px 6px 40px; font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol; font-size: 15px; line-height: 20px; color: #555555;">
-						<h1 style="margin: 0; font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol; font-size: 24px; line-height: 27px; color: #333333; font-weight: normal;">[[email:greeting_no_name]]</h1>
+						<h1 style="margin: 0; font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol; font-size: 24px; line-height: 27px; color: #333333; font-weight: normal;">[[email:greeting_with_name, {username}]]</h1>
 					</td>
 				</tr>
 				<tr>
@@ -20,7 +20,14 @@
 				<tr>
 					<td style="padding: 20px 40px; font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol; font-size: 15px; line-height: 20px; color: #555555;">
 						<p style="margin: 0;">
-							[[email:welcome.text2]]
+							[[email:email.verify.text2]]
+						</p>
+					</td>
+				</tr>
+				<tr>
+					<td style="padding: 20px 40px; font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol; font-size: 15px; line-height: 20px; color: #555555;">
+						<p style="margin: 0;">
+							[[email:email.verify.text3, {email}]]
 						</p>
 					</td>
 				</tr>