HTBox/crisischeckin — pull request #160 by yevgeller (2014-02-24 21:40:24+00:00)
Title: Fixing issues 51 and 60

TL;DR: The problem was that when a new volunteer registered, system first created a new user account, logged him/her in and added him/her to the volunteer role, and then checked if such e-mail had already been registered by someone else. It resulted in registered users who could not volunteer.

First of all -- sorry for working on something that is not in the "jump-in" list.

The problem with mismatch in users during the anti-forgery token check happened because the system would first register user in the membership provider, and then go on to checking for duplicate e-mail. As a result, if the new user uses an e-mail that is already used by someone else, he/she could subsequently log in because he is a member of the web site, but could not volunteer because he/she does not have a record in the dbo.User and dbo.Person tables.

I decided not to implement ajax-styled e-mail verification because that functionality has a potential to be used maliciously to gather user's e-mails. Of course, an attacker could register a gozillion times to pinpoint the e-mails that are already in the system, but then at least there'd be a record for each fakely-registered user. However, adding ajax-styled verification can be easily done if needed.

There may be a slight chance that volunteers share one e-mail address. I am not sure if it is ever a case, but as of now, the system is not ready for such a scenario. If it is, indeed, a possibility, the system can be adjusted to accommodate for that.

I hope that helps.