Automatically logging in after registration, despite no email verification.

Paweł

Is this a security gap or do I not understand the logic behind the registration?

In the permissions options panel, I have local login disabled, for "unverfied-users"
I create a new user, it automatically logs me into the site and I get a verification link.
I can add posts even though I don't have permissions, because it logged me in after registrations.
I log out
Trying to log in again results in "Error verification requierd".

<baris>

@Paweł sounds like a bug, please open an issue on our github.

<baris>

Paweł

Thanks! I hope that for SSO logging the old logic will be preserved.

<baris>

My changes and the local login privilege only applies to regular logins so should be fine.