From f109aef701f2fb2222e3cfcf8309ee7aae2f543f Mon Sep 17 00:00:00 2001 From: Claire Date: Thu, 24 Sep 2026 12:28:59 +0000 Subject: [PATCH] Fix `POST /api/v1/accounts` still being accessible when `SSO_ACCOUNT_SIGN_UP` is set (#40681) --- app/controllers/api/v1/accounts_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/api/v1/accounts_controller.rb b/app/controllers/api/v1/accounts_controller.rb index 40e3f248d2c..2fb08fc0b89 100644 --- a/app/controllers/api/v1/accounts_controller.rb +++ b/app/controllers/api/v1/accounts_controller.rb @@ -128,6 +128,6 @@ class Api::V1::AccountsController < Api::BaseController end def check_enabled_registrations - forbidden unless allowed_registration?(request.remote_ip, invite) + forbidden if ENV['SSO_ACCOUNT_SIGN_UP'].present? || !allowed_registration?(request.remote_ip, invite) end end