Invites that register using a different email address will incorrectly land on invited group/project active page
Summary
A invited user that has not yet registered can incorrectly land on a group/project activity page if they register with a different email address than what they signed up with.
At this point they are not a member of that group or project due to the non-matching email with the invite, but we still try to send them to that group or project's activity page.
At best this isn't correct and they will be on that group/project activity page w/o being a member. At worst the group or project is private
for visibility and they will receive a not found
message/page.
Reproduction steps
- Create a private group.
- Invite a non-registered user via email.
- User clicks invite link in invite email.
- User is redirected to sign up.
- User uses different email to sign up with than what was invited.
- User lands on group's activity page and sees a not found/404 message.
Solution
Stop storing the location for the activity path when clicking the invite from the email.
- Our redirect logic after sign up already handles that. This will allow the
||
statement to be hit here correctly and redirect the user to thedashboard_projects_path
.