undefinded added member to board

[Emile840]

Sometimes, an admin user get notification email says that "undefined" added member "user name" to a private board "board name".
The problem is that no one from that private board's members has invited that user.
the bug was first noticed last September on weekan version 5.29.
Is there anyone who has an idea about this issue ?

[Emile840]

@xet7,
I'm working on this issue, but there is something that I just can't figure out how it works.
Beside the function "inviteUserToBard" in users.js file "https://github.com/wekan/wekan/blob/master/models/users.js", Is there anywhere else that a new user can be invited automatically to participate on the private board which can cause this bug ?

[xet7]

@Emile840

Maybe try to search code:

cd wekan

./find.sh invite

[Emile840]

@xet7
Yeah, i've already done that and on my comprehension, all codes that add a member to a board and that notify with "undefined added a member to a board" message, might come from the "inviteUserToBoard" function which is only called on a user's action.

[Ben0it-T]

@Emile840

Is there anywhere else that a new user can be invited automatically to participate on the private board which can cause this bug ?

A new user can be invited to participate on the private board at Admin Panel.
Doing that way reproduce notification email saying that "undefined added member username to board".

Step to reproduce:

Step 1: At Admin Panel, invite new user and check a board

New user will be notified

Bord activities, at this step

Step 2: New user creates account

Board activities

If boardAdmin is "watching" that board

Hope this can help

[Emile840]

@xet7, @Ben0it-T
Thanks for your comments, it's helped.
I finaly found the issue.

When a new user is invited to participate on a board (as shown above by @Ben0it-T for example)

• An invitation code is created (if not already exists) in database (collection : invitation_codes)
• When the user sign-up with password authentication mode, he'll give an invitation code that he received on his email, the user is saved in database and its corresponding invitation code is deleted from "invitation_codes" collection (in this case, all work well, the user will see all boards that has been invited to.
• But if the user sign-up with OIDC authentication mode, he'll not give an invitation code and at row number 1868 of user.js file (https://github.com/wekan/wekan/blob/master/models/users.js), if there're datas in "invitation_codes" collection, this piece of code will return an invitation object which belong to an other user because findOne with undefined code as value will return an object. So, the user will be created but with boards to which he was not invited to.
• I'm going to make a pull request with this correction : if is OIDC authentication mode then finding an invitation_code object is done by using "email field" instead of "code field"

[xet7]

Fixed at #4245