user email should not be changed if its unconfirmed
āUnsolvedšŖ²Bugs
the way to change the user email by api v2 is calling patch to a user with new email with returnCode.
So the code is sent to validate email. Its insane that the email of user is updated to the new email with unverified status and the current email verified is lost. The email should only be changed when user confirm the new email with code, not when user request to change email.
If the email is not confirme yet, why to change the email? Should keep the old one that is valid and save new one as pending, when user confirm the email with code, then the email should be changed. Some systems use the email as login method, if user put a wrong email, the actual verified email is lost. Email change must have a request for change with confirmation and only be changed when user confirms the new email with code. Its very amateur to change that way.
So the code is sent to validate email. Its insane that the email of user is updated to the new email with unverified status and the current email verified is lost. The email should only be changed when user confirm the new email with code, not when user request to change email.
If the email is not confirme yet, why to change the email? Should keep the old one that is valid and save new one as pending, when user confirm the email with code, then the email should be changed. Some systems use the email as login method, if user put a wrong email, the actual verified email is lost. Email change must have a request for change with confirmation and only be changed when user confirms the new email with code. Its very amateur to change that way.
