UserCreate and AliasCreate used BackToUsersMixin and BackToAliasesMixin,
which access self.user or self.alias for ?return=detail. Neither exists
on the create pages, so the request failed with an AttributeError.
Both views now define their own back link with the target they already
used without the parameter: the user list and the user's detail page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
If the email or domain field was missing or invalid, the error was
flashed, but the address was still built from the unset attributes,
which raised an AttributeError. Only build and validate the address
if both are set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Any user could create aliases like postmaster@, webmaster@ or abuse@ on
their domain. CAs use these addresses to validate domains, so a family
account (or a compromised one) could obtain TLS certificates or catch
abuse and system mails.
- Only admins may create aliases with a reserved local part (admin,
administrator, webmaster, hostmaster, postmaster, abuse, security,
noc, root, mailer-daemon). The acting user counts, so admins can
still assign such aliases to other users.
- Escape the domains in the email regex, so "finn.st" no longer
matches "finnXst".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finnandClaude Opus 5.5