[bug]: Potential abuse for when user-signup is disabled but magic-link is enabled,

[Nathan13888]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

Similar to #1792

Invalid users are sent email magic-codes on demand on the login page, despite signups are disabled.

Expected Behaviour: user is warned that signups are disabled, and no email is sent.

Steps to reproduce

• On latest tag (deployed today) to k8s.
• Set the following in Postgres:
  
• Visit login / and enter non-existent email. Magic code is sent to user.

Environment

Production

Browser

Mozilla Firefox

Variant

Self-hosted

Version

v0.21.0

[pablohashescobar]

@Nathan13888, the magic code would be sent but the user won't be able to create account. We will add an additional validation so that even the magic code is not being sent.

[Nathan13888]

Yup, you're correct, that's the behavior I've observed too.

[pushya22]

Hi @Nathan13888 closing the issue since the feature is working as intended. Please re-open in case of any further queries.