🐛 Bug Report: Test email sent to wrong address #417

New Issue

OVERLORD · 2025-10-07T00:14:09+03:00

OVERLORD commented

2025-10-07 00:14:09 +03:00

Originally created by @ethack on GitHub.

Reproduction steps

I logged into my admin account and configured SMTP settings. I hit the "Send Test Email" button.

Here is a screenshot showing the first characters of the email associated with the account I'm authenticated as.

Expected behavior

I expected the test email to be sent to my email address (the one configured on the account I'm logged in as).

Actual Behavior

The test email was sent to a different user's email address. The user is the only other user in Pocket ID and is a regular user (non-admin).

Here is a screenshot of the mail service logs showing the email was sent to the wrong address.

Originally created by @ethack on GitHub. ### Reproduction steps I logged into my admin account and configured SMTP settings. I hit the "Send Test Email" button. Here is a screenshot showing the first characters of the email associated with the account I'm authenticated as. ![image](https://github.com/user-attachments/assets/34cfd82d-53c2-4c73-90c3-8123466f7f11) ### Expected behavior I expected the test email to be sent to my email address (the one configured on the account I'm logged in as). ### Actual Behavior The test email was sent to a different user's email address. The user is the only other user in Pocket ID and is a regular user (non-admin). Here is a screenshot of the mail service logs showing the email was sent to the wrong address. ![image](https://github.com/user-attachments/assets/e11548a1-dc64-4d37-bac4-d9b77cbee04a)

OVERLORD added the bug label 2025-10-07 00:14:09 +03:00

OVERLORD closed this issue

2025-10-07 00:14:10 +03:00

OVERLORD commented

2025-10-07 00:14:12 +03:00

@ethack commented on GitHub:

If I'm understanding this correctly, it looks to be pulling the first user out of the database and sending to their email.

82e475a923/backend/internal/service/email_service.go (L49)

The gorm docs state that First orders by primary key.

I checked and table has a primary key set to id. It just so happens that my second user's id comes before mine.

sqlite> .schema users
CREATE TABLE users
(
    id         TEXT                  NOT NULL PRIMARY KEY,
    created_at DATETIME,
    username   TEXT                  NOT NULL UNIQUE,
    email      TEXT                  NOT NULL UNIQUE,
    first_name TEXT,
    last_name  TEXT,
    is_admin   NUMERIC DEFAULT FALSE NOT NULL
);
sqlite> select * from users order by id;
4a<<redacted>>fcf|1736404168|ash|ash<<redacted>>@<<redacted>>.com|Ash|<<redacted>>|0
a64<<redacted>>65e|1736404013|ethan|ethan<<redacted>>@<<redacted>>.com|Ethan|<<redacted>>|1

I suggest specifying the current logged in user in the query.

@ethack commented on GitHub: If I'm understanding this correctly, it looks to be pulling the first user out of the database and sending to their email. https://github.com/stonith404/pocket-id/blob/82e475a923c82efb1bef2d08b71742937bc7111b/backend/internal/service/email_service.go#L49 The [gorm docs state](https://gorm.io/docs/query.html#:~:text=The%20First%20and%20Last%20methods%20will%20find%20the%20first%20and%20last%20record%20(respectively)%20as%20ordered%20by%20primary%20key.) that `First` orders by primary key. I checked and table has a primary key set to `id`. It just so happens that my second user's `id` comes before mine. ``` sqlite> .schema users CREATE TABLE users ( id TEXT NOT NULL PRIMARY KEY, created_at DATETIME, username TEXT NOT NULL UNIQUE, email TEXT NOT NULL UNIQUE, first_name TEXT, last_name TEXT, is_admin NUMERIC DEFAULT FALSE NOT NULL ); sqlite> select * from users order by id; 4a<<redacted>>fcf|1736404168|ash|ash<<redacted>>@<<redacted>>.com|Ash|<<redacted>>|0 a64<<redacted>>65e|1736404013|ethan|ethan<<redacted>>@<<redacted>>.com|Ethan|<<redacted>>|1 ``` I suggest specifying the current logged in user in the query.

OVERLORD commented

2025-10-07 00:14:13 +03:00

@stonith404 commented on GitHub:

Thanks, yeah it took the first user. In v0.24.0 it should now send the email to the currently signed in user.

@stonith404 commented on GitHub: Thanks, yeah it took the first user. In `v0.24.0` it should now send the email to the currently signed in user.

OVERLORD referenced this issue

2025-10-07 00:22:45 +03:00

[PR #417] [MERGED] chore(deps-dev): bump vite from 6.2.4 to 6.2.5 in /frontend in the npm_and_yarn group across 1 directory #809

Sign in to join this conversation.