I can sign in by the account of non-register-user

[keisukemizuno]

I can sign in by the account of non-register-user, in this way.

1. I register the account of 'test@example.com', in the /users/register
2. I ignore the notification sent by activation email
3. I input the account of 'test@example.com', in the /users/request-reset-password
4. I click the link in email of reset-password
5. I change the password

This case is almost no.
But, in this conditions, ( activation_date = NULL & active = 0 & token = '' )
there is no guarantee that it does not effect other functions, does it ?

The sorry please English is in poor.

[steinkel]

Hi @keisukemizuno I was not able to login following your use case, because even if I use the "reset password" feature, user is never activated.

About step 4, the reset password feature will send the email only to the original user, in this case it will possibly make sense to block this feature is user is not already activated, we'll check this option.

Please reopen this ticket if you are able to login, as this would be a bug we need to fix. I'll open a new ticket to check the reset password only for active users.

Thanks!