Skip to content

fix(auth): identify invitations by a random token instead of their id (#120053) - #236

Open
kac-axelor wants to merge 2 commits into
axelor:wipfrom
kac-axelor:invite-link-token-RM-120053
Open

kac-axelor wants to merge 2 commits into
axelor:wipfrom
kac-axelor:invite-link-token-RM-120053

Conversation

@kac-axelor

@kac-axelor kac-axelor commented Oct 7, 2026 •

Copy link
Copy Markdown
Collaborator

… (#120053)

- Invitation links carry a random value that cannot be guessed, so pending invitations can no longer be listed by trying links one after another.
- A link that does not match an invitation shows "not found".
- Links in invitations sent before the upgrade no longer work; revoke the pending invitation and send it again.
…120053)

- Registering through an invitation now removes it from the pending invitations, so its link no longer opens a sign-up form.
- If the invitation cannot be removed, the registration fails with an error instead of reporting success.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant