Fix POST /api/v1/accounts still being accessible when SSO_ACCOUNT_SIGN_UP is set (#40681)

2026-09-27 09:07:47 -05:00 · 2026-09-24 12:28:59 +00:00
parent cd4e10bb1d
commit f109aef701
1 changed files with 1 additions and 1 deletions
--- a/app/controllers/api/v1/accounts_controller.rb
+++ b/app/controllers/api/v1/accounts_controller.rb
@@ -128,6 +128,6 @@ class Api::V1::AccountsController < Api::BaseController
  end

  def check_enabled_registrations
-    forbidden unless allowed_registration?(request.remote_ip, invite)
+    forbidden if ENV['SSO_ACCOUNT_SIGN_UP'].present? || !allowed_registration?(request.remote_ip, invite)
  end
 end