Join GitHub today
People can still use invites after deactivating all #10656
When deactivating all invites as an admin, all invites should become unusable.
When deactivating all invites as an admin, it is still possible top copy the invite link and use it for a new account.
Steps to reproduce the problem
Go to https://server.tld/admin/invites and click the button 'DEACTIVATE ALL' at the bottom of the page. All invites change to expired.
Now copy a random (now expired) invite, open a private browser window and paste & go the link in the address bar. You will see a sign-up form and you can sign-up for a new account.
Update: The deactivated/expired invitation links keep working when registration mode is set to approval required or anyone can sign up.
Only when registration mode is set to nobody can sign-up, the invitation links don't work.
In practice it doesn't matter when those deactivated/expired invitation links still work when everyone can sign-up, but when approval is required it shouldn't bypass approval when deactivated/expired.