RocketChat / RocketChat/Rocket.Chat
[BUG] User registration via real-time API happens with invalid custom fields
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Even if the server returns "error-user-registration-custom-field", the user is still registered without the invalid fields.
Server Setup Information:
- Version of Rocket.Chat Server: 0.58.2
- Deployment Method(snap/docker/tar/etc): rocket.chat/hosting
Steps to Reproduce:
- Setup a custom field like
"role":{
"type":"select",
"defaultValue":"student",
"options":[
"teacher",
"student"
],
"required":true,
"modifyRecordField":{
"array":true,
"field":"roles"
}
}
-
Register a user using the Real-Time API with an invalid option, eg. "god" when there's no such option or empty when the field is required.
-
Notice the user has been registered (without the invalid fields)
This is probably not happening on the web version as it's displaying a nice dropdown, but IMO the API should prevent this from happening.
Expected behavior:
The API should return an error and not register the user
Actual behavior:
The API returns an error but still register the user without the invalid fields
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Real-Time API user-registration entry point and reproduce the custom-field cases described: an invalid option and an empty required field. Trace the error path to confirm registration is not committed when validation fails; done means invalid requests return the error without creating a user or silently dropping fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100