From 0f14d82050a3fbc165ddcab310e710d06d554d84 Mon Sep 17 00:00:00 2001 From: Claire Date: Thu, 24 Sep 2026 12:28:59 +0000 Subject: [PATCH] Fix `POST /api/v1/accounts` still being accessible when `SSO_ACCOUNT_SIGN_UP` is set (#40681) --- app/controllers/api/v1/accounts_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb index 8856b8e0394..bcbd01a6061 100644 --- a/app/controllers/api/v1/accounts_controller.rb +++ b/app/controllers/api/v1/accounts_controller.rb @@ -128,6 +128,6 @@ class Api::V1::AccountsController < Api::BaseController end def check_enabled_registrations - forbidden unless allowed_registration?(request.remote_ip, invite) + forbidden if ENV['SSO_ACCOUNT_SIGN_UP'].present? || !allowed_registration?(request.remote_ip, invite) end end