element-hq / element-hq/synapse

Prevent removing all email addresses for a user if an email address is required for regisration

Open
#10,300 0 comments 1 reaction 0 assignees View on GitHub
T-Enhancement
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#10300](https://github.com/matrix-org/synapse/issues/10300).

---

### Description

After registration even if mail validation is required during registration and account validation is enabled you're able to completely remove it without replacing it and having at least one valid e-mail 3PID. This is also a security issue as you could really register an account, log in, remove the 3PID and register another account with the same mail address and a problem in which it can leave accounts in disabled, broken state after they expire and require admin intervention as there's no way for users to receive the renewal tokens.

### Steps to reproduce

- Register an account with mail validation
- Log into the account
- Remove the 3PID from settings > general

Ideally if you have mail validation during registration and account validation enabled there should be at least a mail 3PID associated to the account, and Synapse should prevent mail 3PID associated < 1

### Version information

- **Homeserver**: aria-net.org

If not matrix.org:

- **Version**: 1.37.1

- **Install method**: package manager

- **Platform**: Ubuntu Server 20.04

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the listed registration, login, and email 3PID removal steps on the reported Synapse setup, then trace the account-validation and 3PID removal paths. Done means removal is prevented when email validation and account validation require a valid email 3PID, while replacement with another valid address remains possible.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.