diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index e33bcb86..5929d498 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -910,10 +910,20 @@ async fn post_email_token(data: Json, headers: Headers, mut conn err!("Invalid password") } - if User::find_by_mail(&data.new_email, &mut conn).await.is_some() { + if let Some(existing_user) = User::find_by_mail(&data.new_email, &mut conn).await { if CONFIG.mail_enabled() { - if let Err(e) = mail::send_change_email_existing(&data.new_email, &user.email).await { - error!("Error sending change-email-existing email: {e:#?}"); + // check if existing_user has already registered + if existing_user.password_hash.is_empty() { + // inform an invited user about how to delete their temporary account if the + // request was done intentionally and they want to update their mail address + if let Err(e) = mail::send_change_email_invited(&data.new_email, &user.email).await { + error!("Error sending change-email-invited email: {e:#?}"); + } + } else { + // inform existing user about the failed attempt to change their mail address + if let Err(e) = mail::send_change_email_existing(&data.new_email, &user.email).await { + error!("Error sending change-email-existing email: {e:#?}"); + } } } err!("Email already in use"); diff --git a/src/config.rs b/src/config.rs index 116c9096..d7f24866 100644 --- a/src/config.rs +++ b/src/config.rs @@ -1643,6 +1643,7 @@ where reg!("email/admin_reset_password", ".html"); reg!("email/change_email_existing", ".html"); + reg!("email/change_email_invited", ".html"); reg!("email/change_email", ".html"); reg!("email/delete_account", ".html"); reg!("email/emergency_access_invite_accepted", ".html"); diff --git a/src/mail.rs b/src/mail.rs index b113cea2..b6b8337c 100644 --- a/src/mail.rs +++ b/src/mail.rs @@ -588,6 +588,20 @@ pub async fn send_change_email_existing(address: &str, acting_address: &str) -> send_email(address, &subject, body_html, body_text).await } +pub async fn send_change_email_invited(address: &str, acting_address: &str) -> EmptyResult { + let (subject, body_html, body_text) = get_text( + "email/change_email_invited", + json!({ + "url": CONFIG.domain(), + "img_src": CONFIG._smtp_img_src(), + "existing_address": address, + "acting_address": acting_address, + }), + )?; + + send_email(address, &subject, body_html, body_text).await +} + pub async fn send_sso_change_email(address: &str) -> EmptyResult { let (subject, body_html, body_text) = get_text( "email/sso_change_email", diff --git a/src/static/templates/email/change_email_invited.hbs b/src/static/templates/email/change_email_invited.hbs new file mode 100644 index 00000000..5b126d18 --- /dev/null +++ b/src/static/templates/email/change_email_invited.hbs @@ -0,0 +1,11 @@ +Your Email Change + +A user ({{ acting_address }}) recently tried to change their account to use this email address ({{ existing_address }}). You already have been invited to join Vaultwarden using this address. + +To change your email address you first would have to delete the account associated with this email address ({{ existing_address }}): +Request account deletion: {{url}}/#/recover-delete + +Once that is done you can change the email address of your existing account to this address. Any invitation would have to be redone. + +If you did not try to change an email address, contact your administrator. +{{> email/email_footer_text }} diff --git a/src/static/templates/email/change_email_invited.html.hbs b/src/static/templates/email/change_email_invited.html.hbs new file mode 100644 index 00000000..28426434 --- /dev/null +++ b/src/static/templates/email/change_email_invited.html.hbs @@ -0,0 +1,30 @@ +Your Email Change + +{{> email/email_header }} + + + + + + + + + + + + + +
+ A user ({{ acting_address }}) recently tried to change their account to use this email address ({{ existing_address }}). You already have been invited to join Vaultwarden using this address. +
+ To change your email address you first would have to delete the account associated with this email address ({{ existing_address }}): + + Request account deletion + +
+ Once that is done you can change the email address of your existing account to this address. Any invitation would have to be redone. +
+ If you did not try to change an email address, contact your administrator. +
+{{> email/email_footer }}