Skip to content

Do not require invited users to confirm their email address

What does this MR do?

  • Allows an invited user to skip the confirmation step on registration for their email if the email used matches the one from the invite that was 'clicked'.

Testing this via GDK(locally)

  1. Ensure ApplicationSetting of send_user_confirmation_email is set to true by starting rails console bundle exec rails c:
    a = ApplicationSetting.first
    a.send_user_confirmation_email = true
    a.save
  2. Visit any project members page and invite a user by email(non-existing user) to that project.
  3. Open Rails letter opener(http://localhost:3000/rails/letter_opener/) to see the invite email(if non is there, check that your background jobs are running with gdk status).
  4. Once you find the email, open the Join now link in an incognito browser window.
  5. Register using email from invite(should be pre-filled).
  6. Confirm you are not asked to confirm email.

Test behaviour for an email that doesn't match

  1. Try the same steps above with a different invite email.
  2. Change the email on the registration form so that it does not match the invite email.
  3. Confirm you are asked to confirm email.

Test behaviour before this change

  1. Try the same steps above against master branch with a different email.
  2. Confirm you see a confirm email step after registering.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #328229

Edited by Dylan Griffith

Merge request reports

Loading