Repository: LemmyNet/lemmy (language: rust)

Issue:
[Bug]: User changing their email address sends an errant application notification to admins
### Requirements

- [X] Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support
- [X] Did you check to see if this issue already exists?
- [X] Is this only a single bug? Do not put multiple bugs in one issue.
- [X] Do you agree to follow the rules in our [Code of Conduct](https://join-lemmy.org/docs/code_of_conduct.html)?
- [X] Is this a backend issue? Use the [lemmy-ui](https://github.com/LemmyNet/lemmy-ui) repo for UI / frontend issues.

### Summary

On instances with registration applications enabled, when a user changes their email address, an inappropriate new registration application email is sent to admins after the user has clicked the verification link.


### Steps to Reproduce

Prerequisites:
- Instance must be configured to require an application
- Admin setting "Email admins on receiving new applications" must be enabled
- Setting to require email verification has no effect on the results (which is fine; changing email *should* require the new one to be verified before accepting it)

1.  Have any user update their email address
2.  User will receive a confirmation link to verify the new address
3.  User clicks link and successfully verifies the new email address
4. Admins receive a non-applicable "{user who changed their email} has applied to join {instance}" notification email.


### Technical Details

If that same function is called for both initial registration and email change, I would guess the issue is in [verify_emai.rs](https://github.com/LemmyNet/lemmy/blob/main/crates/api/src/local_user/verify_email.rs#L44) as there doesn't seem to be any check besides whether admins should receive new registration notifications. 



### Version

BE 0.19.3

### Lemmy Instance URL

_No response_


Discussion / hints:

Fix patch:
diff --git a/crates/api/src/local_user/verify_email.rs b/crates/api/src/local_user/verify_email.rs
index 4b6a8c9289..813b683640 100644
--- a/crates/api/src/local_user/verify_email.rs
+++ b/crates/api/src/local_user/verify_email.rs
@@ -19,6 +19,11 @@ pub async fn verify_email(
   let site_view = SiteView::read_local(&mut context.pool()).await?;
   let token = data.token.clone();
   let verification = EmailVerification::read_for_token(&mut context.pool(), &token).await?;
+  let local_user_id = verification.local_user_id;
+  let local_user_view = LocalUserView::read(&mut context.pool(), local_user_id).await?;
+
+  // Check if their email has already been verified once, before this
+  let email_already_verified = local_user_view.local_user.email_verified;
 
   let form = LocalUserUpdateForm {
     // necessary in case this is a new signup
@@ -27,18 +32,16 @@ pub async fn verify_email(
     email: Some(Some(verification.email)),
     ..Default::default()
   };
-  let local_user_id = verification.local_user_id;
 
   LocalUser::update(&mut context.pool(), local_user_id, &form).await?;
 
   EmailVerification::delete_old_tokens_for_local_user(&mut context.pool(), local_user_id).await?;
 
-  // send out notification about registration application to admins if enabled
-  if site_view.local_site.application_email_admins {
-    let local_user = LocalUserView::read(&mut context.pool(), local_user_id).await?;
-
+  // Send out notification about registration application to admins if enabled, and the user hasn't
+  // already been verified.
+  if site_view.local_site.application_email_admins && !email_already_verified {
     send_new_applicant_email_to_admins(
-      &local_user.person.name,
+      &local_user_view.person.name,
       &mut context.pool(),
       context.settings(),
     )


Test patch: