From be566f4e0f71a79d25712c3c8b5b00cc24dfa9ba Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 10:27:03 +1000 Subject: [PATCH] [bug] Handle duplicate email addresses for magic links (#12621) (#12622) (cherry picked from commit 77d8470141b2b7b701cd4c021be966f69f510ac8) Co-authored-by: Oliver --- src/backend/InvenTree/InvenTree/magic_login.py | 3 +++ src/backend/InvenTree/InvenTree/tests.py | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/src/backend/InvenTree/InvenTree/magic_login.py b/src/backend/InvenTree/InvenTree/magic_login.py index 7bdd466174..33a965ca4e 100644 --- a/src/backend/InvenTree/InvenTree/magic_login.py +++ b/src/backend/InvenTree/InvenTree/magic_login.py @@ -69,6 +69,9 @@ class GetSimpleLoginView(GenericAPIView): return User.objects.get(email=email) except User.DoesNotExist: return None + except User.MultipleObjectsReturned: + logger.warning('Multiple users found with email: %s', email) + return None def create_link(self, user): """Create a login link for this user.""" diff --git a/src/backend/InvenTree/InvenTree/tests.py b/src/backend/InvenTree/InvenTree/tests.py index bf9bb13790..a0fe391bec 100644 --- a/src/backend/InvenTree/InvenTree/tests.py +++ b/src/backend/InvenTree/InvenTree/tests.py @@ -1708,6 +1708,18 @@ class MagicLoginTest(InvenTreeTestCase): # And we should be logged in again self.assertEqual(resp.wsgi_request.user, self.user) + def test_duplicate_email(self): + """Test that duplicate email addresses do not raise a server error.""" + User = get_user_model() + User.objects.create_user( + username='duplicate', email=self.user.email, password='password' + ) + + resp = self.client.post(reverse('sesame-generate'), {'email': self.user.email}) + self.assertEqual(resp.status_code, 200) + self.assertEqual(resp.data, {'status': 'ok'}) + self.assertEqual(len(mail.outbox), 0) + class MaintenanceModeTest(InvenTreeTestCase): """Unit tests for maintenance mode."""