Jakub Zych b179e6b2e5 fix: activate-by-code asks the login gates before it signs in ...

After the mailed code verifies, ActivateByCode consults the login gates
with source password, as Login does. A gate answer (for example a
second-factor challenge) replaces the token response and sets no session
cookie; a gate error answers the opaque 500. The account is activated
either way. Without a gate, or when every gate allows, the answer is
unchanged. With require_activation off an account can enable a second
factor before it activates, so the mailed code no longer stands in for it.

2026-11-05 17:54:21 +01:00

988 B

Raw Blame History

View Raw