Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-10 07:55:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: add an additional check on page load to enforce requireEmailAddress setting

Browse Source 
The old behaviour would require that an email be entered, but did not block access to the forum (nor did it ensure that the email was verified).

The new behaviour (if the setting is enabled) will ensure that only those users with a confirmed email can continue through.

The only exceptions are super admins (so they don't get locked out).
This commit is contained in:
Julian Lam
2023-05-03 13:42:28 -04:00
parent 34730caf97
commit 84313712a2
4 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/middleware/user.js
View File

@@ -6,6 +6,7 @@ const nconf = require('nconf');
const path = require('path');
const util = require('util');
const meta = require('../meta');
const user = require('../user');
const privileges = require('../privileges');
const plugins = require('../plugins');
@@ -231,12 +232,27 @@ module.exports = function (middleware) {
};
middleware.registrationComplete = async function registrationComplete(req, res, next) {
// If the user's session contains registration data, redirect the user to complete registration
/**
* Redirect the user to complete registration if:
* * user's session contains registration data
* * email is required and they have no confirmed email (pending doesn't count, but admins are OK)
*/
const path = req.path.startsWith('/api/') ? req.path.replace('/api', '') : req.path;
if (!req.session.hasOwnProperty('registration')) {
if (req.uid && !path.endsWith('/edit/email')) {
const [confirmed, isAdmin] = await Promise.all([
user.getUserField(req.uid, 'email:confirmed'),
user.isAdministrator(req.uid),
]);
if (meta.config.requireEmailAddress && !confirmed && !isAdmin) {
controllers.helpers.redirect(res, '/me/edit/email');
}
}
return setImmediate(next);
}
const path = req.path.startsWith('/api/') ? req.path.replace('/api', '') : req.path;
const { allowed } = await plugins.hooks.fire('filter:middleware.registrationComplete', {
allowed: ['/register/complete'],
});