fix: #11589, regression where a user could not confirm their email if requireEmailAddress was enabled

src/controllers/index.js

@@ -222,6 +222,14 @@ Controllers.registerInterstitial = async function (req, res, next) {
 Controllers.confirmEmail = async (req, res, next) => {
 	try {
 		await user.email.confirmByCode(req.params.code, req.session.id);
+		if (req.session.registration) {
+			// After confirmation, no need to send user back to email change form
+			delete req.session.registration.updateEmail;
+		}
+
+		res.render('confirm', {
+			title: '[[pages:confirm]]',
+		});
 	} catch (e) {
 		if (e.message === '[[error:invalid-data]]') {
 			return next();
@@ -229,10 +237,6 @@ Controllers.confirmEmail = async (req, res, next) => {
 
 		throw e;
 	}
-
-	res.render('confirm', {
-		title: '[[pages:confirm]]',
-	});
 };
 
 Controllers.robots = function (req, res) {

src/middleware/user.js

@@ -239,30 +239,34 @@ module.exports = function (middleware) {
 		 */
 		const path = req.path.startsWith('/api/') ? req.path.replace('/api', '') : req.path;
 
-		if (!req.session.hasOwnProperty('registration')) {
+		if (req.uid && !(path.endsWith('/edit/email') || path.startsWith('/confirm/'))) {
-			if (req.uid && !path.endsWith('/edit/email')) {
+			const [confirmed, isAdmin] = await Promise.all([
-				const [confirmed, isAdmin] = await Promise.all([
+				user.getUserField(req.uid, 'email:confirmed'),
-					user.getUserField(req.uid, 'email:confirmed'),
+				user.isAdministrator(req.uid),
-					user.isAdministrator(req.uid),
+			]);
-				]);
+			if (meta.config.requireEmailAddress && !confirmed && !isAdmin) {
-				if (meta.config.requireEmailAddress && !confirmed && !isAdmin) {
+				req.session.registration = {
-					controllers.helpers.redirect(res, '/me/edit/email');
+					...req.session.registration,
-				}
+					uid: req.uid,
+					updateEmail: true,
+				};
 			}
+		}
 
+		if (!req.session.hasOwnProperty('registration')) {
 			return setImmediate(next);
 		}
 
 		const { allowed } = await plugins.hooks.fire('filter:middleware.registrationComplete', {
-			allowed: ['/register/complete'],
+			allowed: ['/register/complete', '/confirm/'],
 		});
-		if (!allowed.includes(path)) {
+		if (allowed.includes(path) || allowed.some(p => path.startsWith(p))) {
-			// Append user data if present
+			return setImmediate(next);
-			req.session.registration.uid = req.session.registration.uid || req.uid;
-
-			controllers.helpers.redirect(res, '/register/complete');
-		} else {
-			setImmediate(next);
 		}
+
+		// Append user data if present
+		req.session.registration.uid = req.session.registration.uid || req.uid;
+
+		controllers.helpers.redirect(res, '/register/complete');
 	};
 };