From 91849efde16e795b74085507ca6d43f5de115333 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Wed, 3 Aug 2022 12:33:40 -0400
Subject: [PATCH] fix: #10805, do not set `email` field in user hash on user
 creation

---
 src/controllers/write/users.js | 2 +-
 src/user/create.js             | 8 ++++----
 src/user/invite.js             | 1 +
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/controllers/write/users.js b/src/controllers/write/users.js
index 56d547aaaf..2610de5d1d 100644
--- a/src/controllers/write/users.js
+++ b/src/controllers/write/users.js
@@ -298,7 +298,7 @@ Users.confirmEmail = async (req, res) => {
 		const code = await db.get(`confirm:byUid:${req.params.uid}`);
 		await user.email.confirmByCode(code, req.session.id);
 		helpers.formatApiResponse(200, res);
-	} else if (current && current === req.params.email) { // email in user hash (i.e. email passed into user.create)
+	} else if (current && current === req.params.email) { // i.e. old account w/ unconf. email in user hash
 		await user.email.confirmByUid(req.params.uid);
 		helpers.formatApiResponse(200, res);
 	} else {
diff --git a/src/user/create.js b/src/user/create.js
index f0ef5f37fc..6d598d03ff 100644
--- a/src/user/create.js
+++ b/src/user/create.js
@@ -46,7 +46,6 @@ module.exports = function (User) {
 		let userData = {
 			username: data.username,
 			userslug: data.userslug,
-			email: data.email || '',
 			joindate: timestamp,
 			lastonline: timestamp,
 			status: 'online',
@@ -104,13 +103,14 @@ module.exports = function (User) {
 			User.updateDigestSetting(userData.uid, meta.config.dailyDigestFreq),
 		]);
 
-		if (userData.email && isFirstUser) {
+		if (data.email && isFirstUser) {
+			await User.setUserField(uid, 'email', data.email);
 			await User.email.confirmByUid(userData.uid);
 		}
 
-		if (userData.email && userData.uid > 1) {
+		if (data.email && userData.uid > 1) {
 			await User.email.sendValidationEmail(userData.uid, {
-				email: userData.email,
+				email: data.email,
 				template: 'welcome',
 				subject: `[[email:welcome-to, ${meta.config.title || meta.config.browserTitle || 'NodeBB'}]]`,
 			}).catch(err => winston.error(`[user.create] Validation email failed to send\n[emailer.send] ${err.stack}`));
diff --git a/src/user/invite.js b/src/user/invite.js
index 63658551dc..a4e175b85e 100644
--- a/src/user/invite.js
+++ b/src/user/invite.js
@@ -78,6 +78,7 @@ module.exports = function (User) {
 		const email = await db.getObjectField(`invitation:token:${token}`, 'email');
 		// "Confirm" user's email if registration completed with invited address
 		if (email && email === enteredEmail) {
+			await User.setUserField(uid, 'email', email);
 			await User.email.confirmByUid(uid);
 		}
 	};