From 77d8470141b2b7b701cd4c021be966f69f510ac8 Mon Sep 17 00:00:00 2001 From: Oliver Date: Tue, 11 Aug 2026 23:49:53 +1000 Subject: [PATCH] [bug] Handle duplicate email addresses for magic links (#12621) --- src/backend/InvenTree/InvenTree/magic_login.py | 3 +++ src/backend/InvenTree/InvenTree/tests.py | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/src/backend/InvenTree/InvenTree/magic_login.py b/src/backend/InvenTree/InvenTree/magic_login.py index 7bdd466174..33a965ca4e 100644 --- a/src/backend/InvenTree/InvenTree/magic_login.py +++ b/src/backend/InvenTree/InvenTree/magic_login.py @@ -69,6 +69,9 @@ class GetSimpleLoginView(GenericAPIView): return User.objects.get(email=email) except User.DoesNotExist: return None + except User.MultipleObjectsReturned: + logger.warning('Multiple users found with email: %s', email) + return None def create_link(self, user): """Create a login link for this user.""" diff --git a/src/backend/InvenTree/InvenTree/tests.py b/src/backend/InvenTree/InvenTree/tests.py index bf9bb13790..a0fe391bec 100644 --- a/src/backend/InvenTree/InvenTree/tests.py +++ b/src/backend/InvenTree/InvenTree/tests.py @@ -1708,6 +1708,18 @@ class MagicLoginTest(InvenTreeTestCase): # And we should be logged in again self.assertEqual(resp.wsgi_request.user, self.user) + def test_duplicate_email(self): + """Test that duplicate email addresses do not raise a server error.""" + User = get_user_model() + User.objects.create_user( + username='duplicate', email=self.user.email, password='password' + ) + + resp = self.client.post(reverse('sesame-generate'), {'email': self.user.email}) + self.assertEqual(resp.status_code, 200) + self.assertEqual(resp.data, {'status': 'ok'}) + self.assertEqual(len(mail.outbox), 0) + class MaintenanceModeTest(InvenTreeTestCase): """Unit tests for maintenance mode."""