Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Send informative email for already confirmed users #4228

Merged
merged 2 commits into from
Apr 20, 2022

Conversation

decabeza
Copy link
Collaborator

@decabeza decabeza commented Oct 30, 2020

Objectives

When a user requests the confirmation email, a message appears indicating that they will receive an email. The same message appears if their account is already confirmed, but CONSUL doesn't send any email.

This PR maintains the behavior to don't resend confirmation instructions email for already confirmed users.
But, we will send an email to the user informing them that their account is now registered.

This way no one can know if someone else's account is confirmed and we don't have to worry about GDPR either.

Notes

One of the problems with adding this text could be that it provides information that the account already exists to a potential "hacker". But the application already gives this information when registering a new user if you enter an existing email "has already been taken".

Perhaps the more correct text would be:
"If your email address exists in our database and you have not received a confirmation email in the past, you will receive an email with instructions for how to confirm your email address in a few minutes." The problem with this text is that it is too long and not concise for a notification.

Conclusion: between the fact that the information disclosed with the proposed PR message ("You have already confirmed your email account.") is already available from the registration page, and that the more correct text in my opinion is too long and not concise, I think we can include this change.

Edit:
As the two previously proposed solutions had some drawbacks, a new commit has been added which directly sends an email to the user informing him that his account is now validated and a link to reset his password. This way we avoid a notice with too much information and unclear or a notice that could somehow breach the GDPR.

@javierm javierm added this to Reviewing in Consul Democracy via automation Oct 30, 2020
@javierm javierm force-pushed the already_confirmed_user_emails branch from 4d3440e to d01b6a3 Compare December 15, 2020 18:34
@javierm
Copy link
Member

javierm commented Dec 15, 2020

This one's tricky 🤔, since with these changes anyone could check whether a certain email is confirmed in the application. We need to check whether we're following data protection guidelines here.

@decabeza decabeza closed this Dec 31, 2021
@decabeza decabeza deleted the already_confirmed_user_emails branch December 31, 2021 18:39
@taitus taitus restored the already_confirmed_user_emails branch March 29, 2022 05:00
@taitus taitus reopened this Mar 29, 2022
Consul Democracy automation moved this from Reviewing to Doing Mar 29, 2022
@taitus taitus self-assigned this Mar 29, 2022
@taitus taitus moved this from Doing to Reviewing in Consul Democracy Mar 29, 2022
@taitus taitus self-requested a review March 29, 2022 08:23
@taitus taitus force-pushed the already_confirmed_user_emails branch from d01b6a3 to d5eb5f7 Compare March 29, 2022 08:38
Consul Democracy automation moved this from Reviewing to Testing Mar 29, 2022
@taitus taitus force-pushed the already_confirmed_user_emails branch from d5eb5f7 to 44680d0 Compare March 29, 2022 17:06
@taitus taitus moved this from Testing to Doing in Consul Democracy Mar 30, 2022
@taitus taitus force-pushed the already_confirmed_user_emails branch from 5e70dca to b089a4f Compare March 30, 2022 07:32
@taitus taitus moved this from Doing to Reviewing in Consul Democracy Mar 30, 2022
@taitus taitus requested a review from Senen March 30, 2022 07:39
@taitus taitus force-pushed the already_confirmed_user_emails branch from b089a4f to 17a978e Compare April 13, 2022 11:23
@taitus taitus changed the title Do not resend confirmation email for already confirmed users Send informative email for already confirmed users Apr 13, 2022
@taitus taitus force-pushed the already_confirmed_user_emails branch from 17a978e to be1316f Compare April 13, 2022 14:39
Consul Democracy automation moved this from Reviewing to Testing Apr 13, 2022
@taitus taitus force-pushed the already_confirmed_user_emails branch from be1316f to f5fb159 Compare April 19, 2022 08:35
taitus and others added 2 commits April 19, 2022 16:53
The texts for the confirmation instructions referred to "reset the password".
We have updated the texts to refer to confirmation instructions.
Currently the application does not send any email to confirm the
account for already confirmed users. But we show a notice message
that may look like you will recive one:

"If your email address exists in our database, you will receive
 an email with instructions for how to confirm your email address
 in a few minutes."

In this commit we keep the original message, but send an email to
the user informing them that their account is now registered.

This way no one can know if someone else's account is confirmed and
we don't have to worry about GDPR either.

Co-Authored-By: taitus <[email protected]>
@taitus taitus force-pushed the already_confirmed_user_emails branch from f5fb159 to ad018c6 Compare April 19, 2022 15:15
@taitus taitus merged commit 7d1c672 into master Apr 20, 2022
@taitus taitus deleted the already_confirmed_user_emails branch April 20, 2022 07:54
Consul Democracy automation moved this from Testing to Release 1.5.0 Apr 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants