AllBugsFeaturesChangelogSearchNew post
Sign in with Fluxer
Bugs

[Self-Hosted] "New IP Login authorization" softlocks accounts if an instance does not have an email provider set up

(#644) Bug Fixed security self-hosting
by RexSystem edited originally by @snappyapple632 on GitHub

Summary

"New IP Login authorization" and other security features requiring the use of email do not function correctly if an instance does not have an email provider set up. Solution: Forcibly disable all features requiring email service if an email provider is not set up. Related: #638 and PR #1030 .

Steps to reproduce

  1. Create a new instance, but do not set up an email provider.
  2. Create a standard account.
  3. Log out of that account.
  4. Attempt to log in again.
  5. Fluxer will attempt to verify the user via email and will fail, as no email provider is set up.

Environment

Version: Stable Web 2026.616.45607, Linux (x64), Firefox 152.0, Locale en-US OS: CachyOS Linux Browser: Firefox 152.0.1

4 comments

Sign in with Fluxer to comment and vote.
Comment by @HEKnTEKn
RexSystem 1 vote originally by @HEKnTEKn on GitHub
Also seeing this issue on my rig. Would rather not set up an email server if it can be helped but users on the go or switching IPs are unable to access their accounts. On an aside, I'm also worried about the password reset feature, which seems like it wants to do email as well... Any chance for a local or client-side fix?
Permalink
Comment by @Pseudal
RexSystem 1 vote originally by @Pseudal on GitHub
yup, disabling SMTP doesn't disable everything related to it. So it's impossible to register via a invite, impossible to change a password, etc. It would be really nice if there were just an option in the admin panel to hide the “email” field, or if it were simply disabled by default if the instance doesn't have SMTP. The only viable solution to this problem right now is to sign up through the main menu (not via a prompt) and have the user set up two-factor authentication; this bypasses the email verification when the IP address changes. But it probably doesn't work for password recovery.
Permalink
Comment by @thefathacker
RexSystem 1 vote originally by @thefathacker on GitHub
do i guess that this is why "Disable new IP login authorisation" now exists in the admin ui?
Permalink
Comment by Hampus
HampusStaff 1 vote originally by @hampus-fluxer on GitHub
Fixed via #1030 (6fd7c027). Login now authorizes the IP directly when the instance has no working email provider. If you have mail configured but do not want these emails, there is a "Disable new IP login authorization" toggle in /admin.
Permalink