​Self-hosted: Invite email link can be re-used, potential DoS

[dennorske]

What happened?

When a user is invited to the platform, the user who receives the invite can re-use the invite link multiple times. Every time the user uses that link, a new email is sent out to the person who invited him, to inform that the invite was accepted.

Steps to reproduce

1. Invite a new user
2. New user rapidly spam-clicks the invite link (opens multiple tabs).
3. The equivalent amount of emails are sent to the inviter, to inform the user has accepted the invitation.

See the attached screenshot for a sample:

Distribution version

Linux

What browsers are you seeing the problem on if you're using web version?

No response

Are you self-hosting?

• [X] Yes

Relevant log output

No response

Anything else?

No response

[affine-issue-bot[bot]]

Issue Status: 💡 Open

💡 Open

We want to implement the fix or feature in the near future. We can’t promise it will appear in the next public release, but it’s on our short list.

^{_{This is an automatic reply by the bot.}}