User verification works multiple times

[kris7ian]

Shouldn't the link that gets sent to activate an account only work once? Seems especially relevant when having 'REGISTER_VERIFICATION_AUTO_LOGIN': True

[apragacz]

Well, the account activation is idempotent: if the user was already activated, then basically setting the verification field to True again does not change the state.

I guess the problem could arise when you have REGISTER_VERIFICATION_AUTO_LOGIN enabled: someone could use the link to auto-login again, which is probably not what we want.

I will introduce REGISTER_VERIFICATION_ONE_TIME_USE which will work similarly to RESET_PASSWORD_VERIFICATION_ONE_TIME_USE. It will be disabled by default for backward compatibility; probably will be changed in the distant future to True as default with other backward incompatible changes (version 1.0.0 or maybe even 0.5.0?)
For now I will provide a Django system check to see whether REGISTER_VERIFICATION_ONE_TIME_USE is enabled in case REGISTER_VERIFICATION_AUTO_LOGIN is enabled.

[apragacz]

This fix will be released in next version (0.4.4).

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.