geforkt von mirrored/vaultwarden
Make org owner invitations respect the email domain whitelist
This closes a loophole where org owners can invite new users from any domain.
Dieser Commit ist enthalten in:
Ursprung
c2a324e5da
Commit
e4d08836e2
1 geänderte Dateien mit 6 neuen und 2 gelöschten Zeilen
|
@ -485,7 +485,11 @@ fn send_invite(org_id: String, data: JsonUpcase<InviteData>, headers: AdminHeade
|
|||
let user = match User::find_by_mail(&email, &conn) {
|
||||
None => {
|
||||
if !CONFIG.invitations_allowed() {
|
||||
err!(format!("User email does not exist: {}", email))
|
||||
err!(format!("User does not exist: {}", email))
|
||||
}
|
||||
|
||||
if !CONFIG.signups_domains_whitelist().is_empty() && !CONFIG.is_email_domain_whitelisted(&email) {
|
||||
err!("Email domain not eligible for invitations")
|
||||
}
|
||||
|
||||
if !CONFIG.mail_enabled() {
|
||||
|
|
Laden …
In neuem Issue referenzieren