Use of an asterisk in blocked email domains prevents registration from any email address

Contribute Bug

AI-generated summary

A bug was discovered in Discourse where using an asterisk as a wildcard in blocked email domains prevents registration from any email address. Stephen replicated the issue by adding *.mail.ru as a blocked domain and found that registrations from other domains failed. He noted that wildcards are not necessary, as mail.ru would already block subdomains. Additionally, Stephen observed that inviting users is still possible, but the invite cannot be accepted, resulting in a 500 error. The issue has been tracked and fixed (selase) through a pull request on GitHub (https://github.com/discourse/discourse/pull/19922).

1

Per this topic: Users can't make new account (register error)

I’ve been testing various permutations of blocked email domains and ascertained that if an admin includes an asterisk as a wildcard then all registrations will fail.

To replicate I added *.mail.ru as a blocked domain on a test site. I tried to register from both a gmail account and a .co.uk - both attempts were met with: Something went wrong, perhaps this email is already registered, try the forgot password link

Wildcards aren’t necessary in that field, mail.ru will already block all subdomains *.mail.ru.

10 Likes
Users can't make new account (register error)
2

Two additional observations:

  • Inviting a user is still possible with the above, an email address is accepted and invite is sent

-but-

  • The invite can’t be accepted, instead returning a 500 error
3 Likes
5

Thanks @Stephen for the report. This is being tracked and is assigned to an engineer to disallow wildcard characters in this site settings.

3 Likes
7

@Stephen Thanks for the report. This has been fixed.

https://github.com/discourse/discourse/pull/19922

3 Likes
Blocking spammer.<random>.domain registration attempts