Skip to content

Conversation

@Musicminion
Copy link
Member

@Musicminion Musicminion commented Jan 31, 2026

Description

Imply public register router. I think we need to add some limit. For instance, we can config a env var, to allow public register or only allow a specific domain ended email to register.

Here are the todos:

  • config env var
  • add documents for overleaf-pro.ayaka.space
  • test with cloud VM

Related issues / Pull Requests

Contributor Agreement

@Musicminion
Copy link
Member Author

@codex Check this PR?

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6582f6dc0b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines 266 to 267
if(!Boolean(process.env.OVERLEAF_ALLOW_PUBLIC_REGISTRATION))
webRouter.get('/register', UserPagesController.registerPage)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Compare OVERLEAF_ALLOW_PUBLIC_REGISTRATION explicitly

The new guard uses Boolean(process.env.OVERLEAF_ALLOW_PUBLIC_REGISTRATION), which treats any non-empty string (e.g., "false", "0") as true. In that scenario the legacy /register route is skipped, while the new registration module is still disabled because it checks process.env.OVERLEAF_ALLOW_PUBLIC_REGISTRATION === 'true' (services/web/modules/registration/index.mjs:4), so /register becomes a 404 and any flows that redirect to registration break. This only happens when the env var is set to a non-empty falsey string, so it’s easy to hit in production configs that use "false"; consider matching the module’s strict string check here too.

Useful? React with 👍 / 👎.

- if OVERLEAF_ALLOW_PUBLIC_REGISTRATION is set to `true`, allow public register
- if set to `@example.com`, we will do email check and validation
@Musicminion
Copy link
Member Author

@codex, what about now

@chatgpt-codex-connector
Copy link

Summary

  • Updated the registration route guard to use a strict, explicit check for OVERLEAF_ALLOW_PUBLIC_REGISTRATION and only enable /register when allowed, matching the registration module’s semantics. services/web/app/src/router.mjsL265-L274

Testing

  • ⚠️ not run (not requested)

View task →

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants