mirror of
https://github.com/zulip/zulip.git
synced 2025-11-04 14:03:30 +00:00
invite: Fix validation of referred_by field.
Previously, we could 500 if an organization administrator scanned possible PreregistrationUser IDs looking for a valid invitation they can interact with. They couldn't do anything, so no security issue, but this fixes that case to just be a 400 error as it should be.
This commit is contained in:
@@ -4957,6 +4957,10 @@ def do_revoke_multi_use_invite(multiuse_invite: MultiuseInvite) -> None:
|
||||
notify_invites_changed(multiuse_invite.referred_by)
|
||||
|
||||
def do_resend_user_invite_email(prereg_user: PreregistrationUser) -> int:
|
||||
# These are two structurally for the caller's code path.
|
||||
assert prereg_user.referred_by is not None
|
||||
assert prereg_user.realm is not None
|
||||
|
||||
check_invite_limit(prereg_user.referred_by.realm, 1)
|
||||
|
||||
prereg_user.invited_at = timezone_now()
|
||||
|
||||
Reference in New Issue
Block a user