diff --git a/app/main/views/register.py b/app/main/views/register.py index 01bc0e5ae..3b0be7961 100644 --- a/app/main/views/register.py +++ b/app/main/views/register.py @@ -160,6 +160,13 @@ def set_up_your_profile(): invited_service = Service.from_id(invite_data["service_id"]) invited_user_id = invite_data["invited_user_id"] invited_user = InvitedUser.by_id(invited_user_id) + + if user_email.lower() != invited_user.email_address.lower(): + flash("You cannot accept an invite for another person.") + session.pop("invited_user_id", None) + abort(403) + else: + invited_user.accept_invite() current_app.logger.debug( hilite( f"INVITED USER {invited_user.email_address} to service {invited_service.name}"