From 1ad52d25906082f7c9ebac7bf3bf471a580bb620 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 5 Dec 2025 08:45:42 -0500 Subject: [PATCH] Only send notification emails to verified users Adds verified? check to bundling_emails? to prevent notification emails from being sent to users who have never authenticated. This closes the spam vector where bad actors could create users for known email addresses and trigger unwanted notifications by mentioning them. Co-Authored-By: Claude --- app/models/user/settings.rb | 2 +- test/models/user/settings_test.rb | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/app/models/user/settings.rb b/app/models/user/settings.rb index 1651e9a64..598ede9c5 100644 --- a/app/models/user/settings.rb +++ b/app/models/user/settings.rb @@ -21,7 +21,7 @@ class User::Settings < ApplicationRecord end def bundling_emails? - !bundle_email_never? && !user.system? && user.active? + !bundle_email_never? && !user.system? && user.active? && user.verified? end def timezone diff --git a/test/models/user/settings_test.rb b/test/models/user/settings_test.rb index b72de92c5..69145c419 100644 --- a/test/models/user/settings_test.rb +++ b/test/models/user/settings_test.rb @@ -49,5 +49,9 @@ class User::SettingsTest < ActiveSupport::TestCase @user.update!(role: :member, active: false) assert_not @user.settings.bundling_emails?, "Inactive users should not receive bundled emails" + + @user.update!(active: true) + @user.update_column(:verified_at, nil) + assert_not @user.settings.bundling_emails?, "Unverified users should not receive bundled emails" end end