getsentry / getsentry/sentry

Team member invitation token hasn't email validator

Open
#30,065 4 comments 0 reactions 1 assignee Assigned to @leedongwei View on GitHub
Bug Product Area: Sign In
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
1d 5h
Merged PRs (30d)
624

Description

### Environment

SaaS (https://sentry.io/)

### Version

_No response_

### Steps to Reproduce

## Back-end side
Probably you have this logic
- Getting the invitation token, with the authorization token
- Authorize user with the authorization token
- validate invitation token (expired or not)
- add the current user to the team (depends on invitation token type)

It needs to add a step to check if the invitation link clicked by the user who can use the invitation token
Add email part to the token

before adding the user to the team, check if the authorized user email is the same email in the invitation token.

### Expected Result

The team member's invitation token hasn't email chunk to identify who is using the token
If the user has an account logged in with email X on some browser and opens the invitation link sent to Y email, it works, and add the user with X email to the team

### Actual Result

It needs to add a Y user to the team, not X.

Need to show exception page, or allow to log in multiple users in the browser, or just log out the current user.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.