Banned account can be reactivated by resending activation mail

[lovedigit]

▶ Reproduction steps

1. Create a test account with valid email address
2. Set status to banned. Save.
3. Now logout of admin account. Go to signup page > Click on "resend account activation" > enter banned account email ID.
4. Go to email > click on activation link.
5. Banned account status is set to valid again.

😢 Unexpected result

If account is banned, it shouldn't be activated by activation link or system should not send the email in the first place.

📃 Error log message

None.

 

[Rodolfo]

Bug confirmed, I'm very sorry about this.

 

[lovedigit]

Bug confirmed, I'm very sorry about this.

I can't tell you how many times this bug made my life harder.
I ended up adding everyone in global block list directly on my mail provider to avoid sending them activation link for the time being.
Thank you for looking into it.

 

[Rodolfo]

Banned users will be totally banned from now on, the response for these will be:



The banned status will be detected very early, just after login and any action will be completely denied.

 

[lovedigit]

Banned users will be totally banned from now on, the response for these will be:

View attachment 3897

The banned status will be detected very early, just after login and any action will be completely denied.

This is great. But, can they still resend activation link when they're logged out?

 

[Rodolfo]