# Email change despite not confirming it
**URL:** https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891
**Category:** Bug
**Created:** [September 12, 2017, 12:42pm UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891 "2017-09-12T12:42:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@LeoMcA](https://meta.discourse.org/u/LeoMcA)
#### Post date: [September 12, 2017, 12:42pm UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891/1 "2017-09-12T12:42:40Z")
We’ve found a bit of a bizarre bug in our authentication provider, which seems to affect (at least one) core authentication provider, and I expect more.
> **Here's the crux of the problem:**
>
> 1. Create a new account
> 2. Change the email address on that account
> 3. Don’t click on the link in the email
> 4. Log out, log in with the old email
> 5. Observe the email address on that account is now the new email, despite you having not verified it
[https://global.discourse-cdn.com/meta/original/3X/3/9/3918dcfc6bd566e563b442c1e13c9aa3667f0fb5.mp4](https://global.discourse-cdn.com/meta/original/3X/3/9/3918dcfc6bd566e563b442c1e13c9aa3667f0fb5.mp4)
This change of email address despite the user not confirming it will then result in additional bugs depending on the authentication provider in question:
With the one we use in Mozilla, after the steps shown in the video above, a user will no longer be able to log in with their old email, and will have to start logging in with their new one.
With Google, the user will still be able to log in with their old email (because a `GoogleUserInfo` row still exists for it) and will never be able to log in with their new one because a duplicate `user_id` error will be thrown for the new `GoogleUserInfo` row that Discourse tries to create.
That problem can be [seen in a spec I wrote, which passes when it _ **really shouldn’t** _](https://github.com/LeoMcA/discourse/commit/a48bd121af1dc480691f581071de8e922ad966c6#diff-56d0337c547fbfea101cd1a1d250b6ccR196):
```ruby
updater = EmailUpdater.new(user.guardian, user)
updater.change_to(new_email)
user.reload
expect(user.email).to eq(old_email)
response = login(old_identity)
expect(response['authenticated']).to eq(true)
user.reload
expect(user.email).to eq(new_email)
expect { login(new_identity) }.to raise_error(ActiveRecord::RecordNotUnique)
```
I’m starting to attempt to find a fix, but I thought I’d post now that I’ve finally nailed down the actual bug, in case anyone else had any ideas.
---
### Author:  [@LeoMcA](https://meta.discourse.org/u/LeoMcA)
#### Post date: [September 12, 2017, 2:27pm UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891/3 "2017-09-12T14:27:31Z")
@zogstrip whoops, I assume from your unlisting that this has security implications. I assumed since this requires access to the account in the first place, there were none - but I guess I was wrong.
I’ve been eating lunch so I’m afraid that this point I’m no closer to finding a solution.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [September 12, 2017, 2:28pm UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891/4 "2017-09-12T14:28:07Z")
Not sure yet. Was merely a precaution.
_EDIT: @eviltrout [just fixed](https://github.com/discourse/discourse/commit/171d9e5aedd02129abd48826677100c3a477c8b5) a related bug. Note the "`should_validate_email = true"`)_
---
### Author:  [@LeoMcA](https://meta.discourse.org/u/LeoMcA)
#### Post date: [September 12, 2017, 2:41pm UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891/5 "2017-09-12T14:41:05Z")
This is the problem:
>
EDIT: and here’s the fix: [FIX: don't activate un-confirmed email on omniauth authentication by LeoMcA · Pull Request #5176 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/5176)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 17, 2017, 1:00am UTC](https://meta.discourse.org/t/email-change-despite-not-confirming-it/69891/7 "2017-09-17T01:00:13Z")
This topic was automatically closed after 4 days. New replies are no longer allowed.