search

ma1uta / ma1sd

Federated Matrix Identity Server (formerly fork of kamax/mxisd)
GNU Affero General Public License v3.0
167 stars 56 forks source link

Email capitalization issues #31

Closed enzingerm closed 4 years ago

enzingerm commented 4 years ago

Not performing sanitization (decapitalization) on email addresses consistently when storing/retrieving email invitations leads to very bad UX in certain cases.

Consider the following scenario in a email invite-only configuration:

  1. An invitation to User@example.com is causing ma1sd to send an invitation mail to the user.
  2. The user tries to register with the email address user@example.com
  3. The user gets the notification: "Your email address cannot be used for registration"

This can be even extended by the following:

  1. The inviting user assumes the error has something to do with the initial invite sent to an address with a captial letter in it and re-invites user@example.com
  2. The user tries to register again with user@example.com and it doesn't work either.

I suppose consistently performing decapitalization

  1. before storing it as a pending invite
  2. when comparing a registration attempt to the value stored in the database

would solve this issue.

NullIsNot0 commented 4 years ago

@enzingerm, if you are using docker, can you please try this with image nullisnot0/ma1sd:2.3.0? I tried to set all e-mail addresses to lowercase.

ma1uta commented 4 years ago

Fixed in the https://github.com/ma1uta/ma1sd/pull/38