#7761 Disabling a user does not remove/disable his primary email
closed
General
2015-08-20
2014-10-12
No
1) Sign up a user with email abc@abc.com
2) Verify his account/email
3) From user prefs - disable this account
4) Sign up a new user with the same email abc@abc.com
5) Verify his account/email
6) Password recovery won't work for him(And most probably we will run into some other issues)
email_address collection state:
> db.email_address.find({email: 'abc@abc.me'})
{ "_id" : ObjectId("5436e94d01a61326884419c6"), "nonce" : null, "claimed_by_user_id" : ObjectId("5436e94d01a61326884419a0"), "confirmed" : true, "email" : "abc@abc.com" }
{ "_id" : ObjectId("543aaa0601a61361523e52ac"), "nonce" : null, "claimed_by_user_id" : ObjectId("543aaa0601a61361523e5286"), "confirmed" : true, "email" : "abc@abc.com" }
first one is linked to the disabled user, the second one to the current, active user.
If we delete the
email_addressrecords (and I think we should), we'll have to make sure that if/when the user is activated again, theemail_addressrecords are re-created based on theuser.email_addressesfield.Discussed directly with Alex and that option won't work since we won't know if an email address is verified or not any more.
Could keep the email_address records and make sure every place that queries by email address check to see if the user is active.
Closed #690.
ib/7761