Disallow to set the state to signup from the console

[r3v2d0g]

Hello !

I know that I can disactivate the "signUp" link but the user can still go to the console and type in the console :

AccountsTemplates.setState('signUp');

Is there a way for fix this problem ?

[r3v2d0g]

I finally used :

AccountsTemplates.setState = function() {};

[splendido]

Well, with AccountsTemplates.configure({forbidClientAccountCreation: true}); you should be able to achieve what you're asking for...

But you're right: there's no filter on the setState method checking the forbidClientAccountCreation configuration options.

I'd say the following should work:

AT.prototype.setState = function(state, callback) {
  check(state, String);

  if (!this._isValidState(state) || (AccountsTemplates.options.forbidClientAccountCreation && state === 'signUp')) {
    throw new Meteor.Error(500, "Internal server error", "accounts-templates-core package got an invalid state value!");
  }

  this.state.form.set("state", state);
  if (!this.avoidClearError) {
    this.clearState();
  }
  this.avoidClearError = false;

  if (_.isFunction(callback)) {
    callback();
  }
};