Add condition for User moderation and Email confirmation upon registration

[SzymonSel]

No description provided.

[sebastienros]

But why?

Also it seems weird to check an option like _registrationOptions.UsersMustValidateEmail without checking if the email is validated.

[SzymonSel]

This condition is only here to prevent logging users in upon registration. As I understand auto-sign-in should not happen if UsersAreModerated (aka "users must be approved before logging in").

It's the same story for UsersMustValidateEmail

[gvkries]

Actually, I think this patch is not correct. Moderation and email confirmation must be checked, but it's done by the event handlers (RegisteringAsync event). A bug is in the EmailConfirmationRegistrationFormEvents, where CancelSignIn should be set to false.

IMHO it is a different question if this design makes sense at all. This is security critical and by requiring the event handlers to cancel sign-in is is easily to get wrong.

[SzymonSel]

Good point there @gvkries . @Piedone @sebastienros ?

[gvkries]

CancelSignIn should be set to false.

I meant "set to true" 😇

[Piedone]

Yes, can you please fix these @SzymonSel?

[SzymonSel]

Sure