From 1d9f66f18da251c76b988fd4cccfebe5d2b4005f Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Thu, 24 Sep 2026 17:21:58 +0200
Subject: [PATCH] Prevent confirmation emails from being sent when unconfirmed
 users are disabled

---
 app/models/user.rb | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/app/models/user.rb b/app/models/user.rb
index 14d6db5b309..f6ff154dd67 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -174,8 +174,30 @@ class User < ApplicationRecord
     redis.publish("timeline:system:#{account.id}", { event: :kill }.to_json)
   end
 
+  def mails_disabled?
+    disabled? && confirmed_at.nil? && confirmation_sent_at.nil?
+  end
+
   def enable!
     update!(disabled: false)
+
+    # Users that are disabled at creation-time do not generate a confirmation link,
+    # so generate one on re-enable if that's the case
+    send_confirmation_instructions if confirmation_sent_at.nil? && confirmed_at.nil?
+  end
+
+  # Redefined so users that are created disabled do not cause a confirmation mail to be sent
+  def generate_confirmation_token
+    return if mails_disabled?
+
+    super
+  end
+
+  # Redefined so users that are created disabled do not cause a confirmation mail to be sent
+  def send_confirmation_instructions
+    return if mails_disabled?
+
+    super
   end
 
   def to_log_human_identifier
@@ -258,6 +280,7 @@ class User < ApplicationRecord
   def approve!
     return if approved?
 
+    enable! if disabled?
     update!(approved: true)
 
     # Avoid extremely unlikely race condition when approving and confirming