Files
mattermost/server
deb266789b MM-68995: reject deactivated guests on REST magic-link login (#36746) (#36842)
Apply CheckUserAllAuthenticationCriteria after guest magic-link token
authentication in POST /api/v4/users/login, matching the web one-time-link
handler and password login paths.

Add regression test ensuring deactivated guests receive 401 inactive while
active guests can still log in via magic_link_token.



(cherry picked from commit 5c360d8077)

Co-authored-by: Julien Tant <785518+JulienTant@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Julien Tant <JulienTant@users.noreply.github.com>
2026-06-02 07:52:07 +00:00
..
2023-03-22 17:22:27 -04:00
2023-03-22 17:22:27 -04:00
2023-03-22 17:22:27 -04:00
2026-04-21 02:33:20 -07:00
2023-03-22 17:22:27 -04:00
2024-05-15 12:05:13 -03:00