How to get a confirmed account with an invalid email address

[wetneb]

Not sure that's really an issue, but I've done this accidentally:

• Sign up with a valid address
• Don't click on the confirmation link yet
• After the sign up process you are already logged in: change your email address to a fake one
  (If the address was correct you would get a second email to confirm it)
• Click on the confirmation link of the first email

Your account is confirmed, with a fake email address.

[lnielsen]

Thanks for reporting it. This seems to be an issue with in our lower level library we are using called Flask-Security.

[slint]

Resolved through inveniosoftware/flask-security-fork@eb38e31. Released when #881 is merged.

[slint]

#881 merged and the scenario was tested successfully on production with the desired results (user is prompted to enter his email to resend the confirmation link).