Existing users can use banned emails

[soloarquitectura]

Affected version

2.2.15

By banning, for example, *@hotmail.* existing users can continue to change their email to a hotmail email address.

 

[Jeremy P]

I can't reproduce this. Note that banned emails are not checked when the change is being performed by an administrator.

 

[soloarquitectura]

It happens to us in the following way:
An administrator puts a user in the status: Email invalid (bounce). The user uses a hotmail email address.
Email is banned ( *@hotmail.*).
The user logs in again and returns to using the same hotmail email address.
In theory, he should not be able to use any hotmail addresses again, as they are banned.

 

[jeb35]

Are you using the wild card in front of the @ sign like this *@hotmail.com Are you using some sort of addon that could be conflicting?

 

[soloarquitectura]

Are you using the wild card in front of the @ sign like this *@hotmail.com

Yes: *@hotmail.*

Are you using some sort of addon that could be conflicting?

We don't use any addon.

 

[soloarquitectura]

I just did a test and this is indeed happening.
If the administrator bans a user's email and then that user is put in Email invalid (bounce) status, the user has the ability to keep their email even though they are banned by simply entering their password.