RocketChat / RocketChat/Rocket.Chat

[BUG] User registration via real-time API happens with invalid custom fields

Open
#8,475 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area: backend type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Even if the server returns "error-user-registration-custom-field", the user is still registered without the invalid fields.

Server Setup Information:
  • Version of Rocket.Chat Server: 0.58.2
  • Deployment Method(snap/docker/tar/etc): rocket.chat/hosting
Steps to Reproduce:
  1. Setup a custom field like
"role":{  
      "type":"select",
      "defaultValue":"student",
      "options":[  
         "teacher",
         "student"
      ],
      "required":true,
      "modifyRecordField":{  
         "array":true,
         "field":"roles"
      }
   }
  1. Register a user using the Real-Time API with an invalid option, eg. "god" when there's no such option or empty when the field is required.

  2. Notice the user has been registered (without the invalid fields)

This is probably not happening on the web version as it's displaying a nice dropdown, but IMO the API should prevent this from happening.

Expected behavior:

The API should return an error and not register the user

Actual behavior:

The API returns an error but still register the user without the invalid fields

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Real-Time API user-registration entry point and reproduce the custom-field cases described: an invalid option and an empty required field. Trace the error path to confirm registration is not committed when validation fails; done means invalid requests return the error without creating a user or silently dropping fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.