fix: #11554, email requirement bypass by sending in whitespace

NodeBB · May 2, 2023 · 2b8dd3d · 2b8dd3d
1 parent b3787bd
commit 2b8dd3d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/user/interstitials.js b/src/user/interstitials.js
@@ -46,6 +46,10 @@ Interstitials.email = async (data) => {
 			issuePasswordChallenge: !!data.userData.uid && hasPassword,
 		},
 		callback: async (userData, formData) => {
+			if (formData.email) {
+				formData.email = String(formData.email).trim();
+			}
+
 			// Validate and send email confirmation
 			if (userData.uid) {
 				const isSelf = parseInt(userData.uid, 10) === parseInt(data.req.uid, 10);