[FIX] Secret Registration not properly validating Invite Token (#17618)

RocketChat · May 14, 2020 · c9e5302 · c9e5302
1 parent 5bbf9c0
commit c9e5302
Showing 1 changed file with 8 additions and 6 deletions.
diff --git a/server/methods/registerUser.js b/server/methods/registerUser.js
@@ -39,12 +39,14 @@ Meteor.methods({
 		}
 
 		if (settings.get('Accounts_RegistrationForm') === 'Secret URL' && (!formData.secretURL || formData.secretURL !== settings.get('Accounts_RegistrationForm_SecretURL'))) {
-			if (formData.secretURL) {
-				try {
-					validateInviteToken(formData.secretURL);
-				} catch (e) {
-					throw new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', { method: 'registerUser' });
-				}
+			if (!formData.secretURL) {
+				throw new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', { method: 'registerUser' });
+			}
+
+			try {
+				validateInviteToken(formData.secretURL);
+			} catch (e) {
+				throw new Meteor.Error('error-user-registration-secret', 'User registration is only allowed via Secret URL', { method: 'registerUser' });
 			}
 		}