element-hq / element-hq/synapse
Prevent removing all email addresses for a user if an email address is required for regisration
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#10300](https://github.com/matrix-org/synapse/issues/10300).
---
### Description
After registration even if mail validation is required during registration and account validation is enabled you're able to completely remove it without replacing it and having at least one valid e-mail 3PID. This is also a security issue as you could really register an account, log in, remove the 3PID and register another account with the same mail address and a problem in which it can leave accounts in disabled, broken state after they expire and require admin intervention as there's no way for users to receive the renewal tokens.
### Steps to reproduce
- Register an account with mail validation
- Log into the account
- Remove the 3PID from settings > general
Ideally if you have mail validation during registration and account validation enabled there should be at least a mail 3PID associated to the account, and Synapse should prevent mail 3PID associated < 1
### Version information
- **Homeserver**: aria-net.org
If not matrix.org:
- **Version**: 1.37.1
- **Install method**: package manager
- **Platform**: Ubuntu Server 20.04
Contributor guide
Research direction
Start by reproducing the listed registration, login, and email 3PID removal steps on the reported Synapse setup, then trace the account-validation and 3PID removal paths. Done means removal is prevented when email validation and account validation require a valid email 3PID, while replacement with another valid address remains possible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100