XWIKI-17942: Email validation check is not properly reset

  * Ensure to reset the validation email key once validated

Author: surli

xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java

@@ -3857,10 +3857,14 @@ public int validateUser(boolean withConfirmEmail, XWikiContext context) throws X
 
             // Compare the two keys
             if ((!storedKey.equals("") && (storedKey.equals(validationKey)))) {
+                // Ensure to remove the validation key value, so it cannot be used afterwards to enable back
+                // a disabled user.
+                userObject.setStringValue("validkey", "");
+                saveDocument(userDocument, context);
+
                 XWikiUser xWikiUser = new XWikiUser(userDocument.getDocumentReference());
                 xWikiUser.setDisabled(false, context);
                 xWikiUser.setEmailChecked(true, context);
-                saveDocument(userDocument, context);
 
                 if (withConfirmEmail) {
                     String email = userObject.getStringValue("email");

xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java

@@ -580,6 +580,8 @@ public void testValidationKeyStorage() throws Exception
         this.xwiki.saveDocument(testUser, context);
 
         assertEquals(0, this.xwiki.validateUser(false, this.oldcore.getXWikiContext()));
+        XWikiDocument reloadedDocument = this.xwiki.getDocument(testUser, context);
+        assertEquals("", reloadedDocument.getObject("XWiki.XWikiUsers").getStringValue("validkey"));
 
         // Check with an incorrect plaintext key
         validationKey.setValue("wrong key");