fix: #10805, do not set email field in user hash on user creation

src/controllers/write/users.js

@@ -298,7 +298,7 @@ Users.confirmEmail = async (req, res) => {
 		const code = await db.get(`confirm:byUid:${req.params.uid}`);
 		await user.email.confirmByCode(code, req.session.id);
 		helpers.formatApiResponse(200, res);
-	} else if (current && current === req.params.email) { // email in user hash (i.e. email passed into user.create)
+	} else if (current && current === req.params.email) { // i.e. old account w/ unconf. email in user hash
 		await user.email.confirmByUid(req.params.uid);
 		helpers.formatApiResponse(200, res);
 	} else {

src/user/create.js

@@ -46,7 +46,6 @@ module.exports = function (User) {
 		let userData = {
 			username: data.username,
 			userslug: data.userslug,
-			email: data.email || '',
 			joindate: timestamp,
 			lastonline: timestamp,
 			status: 'online',
@@ -104,13 +103,14 @@ module.exports = function (User) {
 			User.updateDigestSetting(userData.uid, meta.config.dailyDigestFreq),
 		]);
 
-		if (userData.email && isFirstUser) {
+		if (data.email && isFirstUser) {
+			await User.setUserField(uid, 'email', data.email);
 			await User.email.confirmByUid(userData.uid);
 		}
 
-		if (userData.email && userData.uid > 1) {
+		if (data.email && userData.uid > 1) {
 			await User.email.sendValidationEmail(userData.uid, {
-				email: userData.email,
+				email: data.email,
 				template: 'welcome',
 				subject: `[[email:welcome-to, ${meta.config.title || meta.config.browserTitle || 'NodeBB'}]]`,
 			}).catch(err => winston.error(`[user.create] Validation email failed to send\n[emailer.send] ${err.stack}`));

src/user/invite.js

@@ -78,6 +78,7 @@ module.exports = function (User) {
 		const email = await db.getObjectField(`invitation:token:${token}`, 'email');
 		// "Confirm" user's email if registration completed with invited address
 		if (email && email === enteredEmail) {
+			await User.setUserField(uid, 'email', email);
 			await User.email.confirmByUid(uid);
 		}
 	};