mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Require email confirmation setting not ignored when domain restriction is in place #486
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tuaris on GitHub (Oct 26, 2017).
This setting does not do what it says.
However, I believe that the current behavior is correct and should be kept. The text should be corrected/removed. Additionally, the signup process should not prompt the user that email conformation is pending.
Expected Behavior
User log in is blocked, pending email confirmation
Current Behavior
User is able to log in.
Steps to Reproduce
Domain restriction is enabled.
Require email confirmation is disabled
User signs up, gets prompted to confirm email.
User attempts to log in
@ssddanbrown commented on GitHub (Nov 11, 2017):
Thank you for raising this issue.
I think its important that email confirmation is forced, At least for now, otherwise the domain restriction is essentially useless and it ensures a security-first approach.
The only place I can think where not-forcing email would be ideal is when only using social authentication options which is not yet a possible feature.