Invites keep getting error "not_matching_email"

EGreg · August 16, 2022, 9:18pm

You can reproduce this bug yourself. I send out invites on a forum, and they arrive with a link like this:

https://forum.mycoralapp.com/invites/9pWS22fPc5?t=8a34feb15bc72e1582cf8460837548aa

You click the link, and see:

So far, so good. But then when I click Continue, I get:

I googled it and saw the only mention is in github language files for the repo. Looking up the key, I found this is the relevant code:

github.com/discourse/discourse

app/models/invite_redeemer.rb

d600c3603


      
            existing_user = get_existing_user
          
            if existing_user.present? && InvitedUser.exists?(user_id: existing_user.id, invite_id: invite.id)
              return false
            end
          
            true
          end
          
          def validate_invite_email!
            return if email.blank?
          
            if invite.email.present? && email.downcase != invite.email.downcase
              raise ActiveRecord::RecordNotSaved.new(I18n.t('invite.not_matching_email'))
            end
          
            if invite.domain.present?
              username, domain = email.split('@')
          
              if domain.present? && invite.domain != domain
                raise ActiveRecord::RecordNotSaved.new(I18n.t('invite.domain_not_allowed'))

Somehow “email” is not empty, even though I am not logged in (try it yourself, in an incognito window). So where does “email” come from, in the code? Perhaps someone here would know.

Falco · August 16, 2022, 9:26pm

Is the site setting normalize_emails enabled on this site?

pfaffman · August 16, 2022, 9:34pm

And is DiscourseConnect still active on this site?

I thought that you couldn’t create invites if SSO was turned on. Did that get changed in that recent update to invites, @Falco ?

EGreg · August 16, 2022, 9:51pm

I tried it with regular emails too like foo@bar.com without +

Stephen · August 17, 2022, 12:37am

I think your site has a bigger problem. If I click to log in I am automatically signed in as this user:

Invites shouldn’t be possible with SSO, and your external auth is letting users straight into the site. In that case the email is probably invalid because it’s comparing the email in the invite to the user above?

pfaffman · August 17, 2022, 12:42am

That’s it. The user is hard coded in the SSO code to test things so anyone who goes there is logged in as that user. So things see broken.

I’m still confused how you can send invites when sso is enabled.

Topic		Replies	Views
Unable to save invite when email address field is filled in Bug invites	3	773	March 23, 2023
Invite by email not working with SSO Support	4	1196	July 24, 2015
Bypass SSO by adding unknown email to group Bug	7	1366	March 1, 2021
Invites compatibility with SSO Feature rfc	2	2345	October 13, 2016
Disable activation email requirement for invited users (SSO) Feature sso , wordpress , invites	10	611	April 26, 2024

Invites keep getting error "not_matching_email"

AI-generated summary

Related topics