Merge pull request #519 from iMMAP/fix/do_not_activate_non_email_veri…

…fied_users user should have verified email to be activated
iMMAP · Dec 24, 2024 · 505f587 · 505f587
2 parents 52e3485 + 1ac3f50
commit 505f587
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/users/views/users.py b/src/users/views/users.py
@@ -96,6 +96,11 @@ def toggle_status(request, user_id):
     if not has_permission(user=request.user, user_obj=user):
         raise PermissionDenied
 
+    if user.profile.email_verified_at is None:
+        raise PermissionDenied(
+            f"{user} has not verified their email. Please ask the user to verifiy their email first."
+        )
+
     if user.is_active:
         user.is_active = False
         user.save()