Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest version of Parse Server.
Issue Description
The Parse Server option emailVerifyTokenReuseIfValid: true
generates a new token on every email verification request. This bug was likely introduced with #8212 where using the masterKey
does not provide read access to fields of internal scope, in this case _email_verify_token
, _email_verify_token_expires_at
.
The bug has not been noticed due to a weak test case which compares the previous to the new token, but does not check whether a token and expiry date is defined at all; since these fields are not returned anymore by the masterKey
, the test is comparing undefined
values and passes, even if these values have changed in the DB.
parse-server/spec/EmailVerificationToken.spec.js
Lines 928 to 933 in 4aba66c
Steps to reproduce
See failing test in #8885.
Actual Outcome
Token and expiry date are modified.
Expected Outcome
Token and expiry date are not modified.
Environment
Server
- Parse Server version:
7.0.0-alpha.5