🔒 ALLOWED_EMAILS not enforced when signing in with Google, Microsoft or OIDC
Who is affected. Self-hosted instances that set ALLOWED_EMAILS and also offer Google, Microsoft or OIDC login. Instances that only use email login, or that don't set ALLOWED_EMAILS, are not affected.
The bug. ALLOWED_EMAILS was only checked when someone signed in with an email code. Signing in through Google, Microsoft or OIDC skipped the check, so anyone with an account at one of those providers could register and sign in, even if their address didn't match the allowlist. They got their own account and space. They could not access other users' spaces or polls.
The fix. The allowlist is now checked whenever an account is created and whenever a session starts, whatever the sign in method. Someone outside the allowlist is sent back to the login page with "This email address is not allowed". (#3646)
What to do. Upgrade to 4.16.4. Accounts created through this gap before you upgrade are not deleted, but they can no longer sign in. If you rely on ALLOWED_EMAILS, check the users list in the Control Panel for addresses outside your allowlist and remove them.
Thanks to Javier García Herrera for reporting this responsibly.
Full Changelog: v4.16.3...v4.16.4