Emails freed up by an admin email change can be reassigned to a new user (no history tracking)
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 需要澄清
- 活跃度
- 冷清
- 技术栈
- typescript
调研方向
Start by reading UsersController.createUser around lines 187–197, then compare the email-change paths in UsersController.updateUser and ProfilesController.updateProfileById. This issue asks the team to decide whether email history should prevent reuse outright, enforce a cooldown, or remain a known trade-off; implementation and a definition of done depend on that decision.
由索引模型根据 Issue 内容生成。
描述
UsersController.createUser checks for duplicate emails against current and soft-deleted users:
count({ where: { email, deleted: true } })triggers "This email belongs to a deleted user, you must restore the user instead of creating a new one"count({ where: { email } })triggers "Email already exists"
There's no history table or history check. If an admin changes User A's email from [email protected] to [email protected] via UsersController.updateUser or ProfilesController.updateProfileById, [email protected] becomes fully free to reassign to a new User B via create-user or invite. Delete already handles this correctly via soft-delete, but change does not — deleted users keep their emailHash reserved, changed users release it.
Consequence: if User A still has access to that mailbox they'll receive emails intended for the new User B (registration link, reset link, notifications). Password-reset links for the old address become invalid, but any pending or previously-received emails are still readable. Social engineering and info-leak vector.
Auth0 and similar providers keep an email-history table specifically to prevent this. Modern guidance is split on whether to block reuse outright or allow it after a cooldown (e.g. 90 days), so filing as a question — worth a team decision on whether we want history enforcement in the health context, or whether accepting the current behaviour as a known trade-off is fine.
Related to #929 which is about notification on email change, and #928 on reset completion.
Related files: UsersController.createUser (lines ~187-197), UsersController.updateUser, ProfilesController.updateProfileById.
- 主要语言
- TypeScript
- 星标
- 4
- 派生
- 0
- 平均合并
- 14 小时 50 分钟
- 30 天内合并 PR
- 5
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
Garvan-Data-Science-Platform/ctrl 的其他 Issue
-
难度 1/5 1-3 小时 新手友好度 82/100
-
admin-client backend bug
难度 2/5 1-3 小时 新手友好度 76/100
-
backend bug
难度 2/5 1-3 小时 新手友好度 68/100
Garvan-Data-Science-Platform/ctrl#970 · 1 条评论 ·
-
backend bug
难度 2/5 1-3 小时 新手友好度 72/100
-
backend bug
难度 2/5 1-3 小时 新手友好度 78/100
查看 Garvan-Data-Science-Platform/ctrl 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 70/100
callstackincubator/simlock#639 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 80/100
aws/agentcore-cli#2606 ·
维护者通常 1 天内回复
-
ai-driven-qa bug Cosmetic
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
ai-driven-qa bug claude Minor
难度 2/5 1-3 小时 新手友好度 64/100
linagora/twake-mail-admin#301 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复