RocketChat / RocketChat/Rocket.Chat
When creating a new account, an invalid username occupy an email address
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
When creating a new account, if the user types in an invalid username(in my case I have a space in between), the email(which is prompted before username) will be reserved hence it can not be used even after the user modifies the username.
I confirmed this bug by using this unit test in testing mode(follow the steps in https://developer.rocket.chat/contribute-to-rocket.chat/modes-of-contribution/assist-with-testing-rocket.chat)
it('should send email to user (return success), when is a valid email', (done) => {
request
.post(api('users.sendConfirmationEmail'))
.set(credentials)
.send({
email: adminEmail,
})
.expect('Content-Type', 'application/json')
.expect(200)
.expect((res) => {
expect(res.body).to.have.property('success', true);
})
.end(done);
});
I first replaced the adminEmail with an email that is not valid(not existed) and this test failed. Then I tried to create an account using an invalid username(with space in between) with the same email. I clicked the "Join your team" button once and there was no response. I clicked the button once again and it prompted that the email is already existed. I ran the unit test above again and it passed which means the email is written to the database.
In the actual server, the same behavior holds.
Testing Server:
https://github.com/RocketChat/Rocket.Chat/assets/62249815/75b0d5b4-7864-4910-a975-8647dd1f3056
Actual Server:
https://github.com/RocketChat/Rocket.Chat/assets/62249815/90a3cd35-b873-4219-8214-3bc3510054b8
Steps to reproduce:
- Follow my procedures above.
Expected behavior:
Should not reserve the email and prompt the username is invalid.
Actual behavior:
The email is reserved and not telling the username is invalid.
Server Setup Information:
- Version of Rocket.Chat Server: 6.5.0-develop
- Operating System: macOS 13.4.1 (22F82)
- Deployment Method:
- Number of Running Instances: 1
- DB Replicaset Oplog: Enabled
- NodeJS Version: 14.21.4 - x64
- MongoDB Version: 6.0.3
Client Setup Information
- Desktop App or Browser Version:
- Operating System:
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the users.sendConfirmationEmail unit test and the account-creation flow described in the report, then reproduce the invalid-username case in testing mode. Trace when the email is persisted after username validation; done means an invalid username is reported without reserving the email, while the valid-email confirmation test still passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- mongodb, typescript
- Domain
- authentication, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100