From 0dcaf80c7f0461c70e4b4a9269f955eff589ad0e Mon Sep 17 00:00:00 2001
From: Aaron Clauson <aaron@sipsorcery.com>
Date: Thu, 20 Dec 2018 20:39:48 +0100
Subject: [PATCH] Changed disable register mechanism to apply policy setting
 after admin user created rather than using DB user count checks.

---
 BTCPayServer/Controllers/AccountController.cs | 8 ++++++--
 BTCPayServer/Services/PoliciesSettings.cs     | 2 +-
 BTCPayServer/Views/Shared/_Layout.cshtml      | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/BTCPayServer/Controllers/AccountController.cs b/BTCPayServer/Controllers/AccountController.cs
index dc2e21a00..738f3b999 100644
--- a/BTCPayServer/Controllers/AccountController.cs
+++ b/BTCPayServer/Controllers/AccountController.cs
@@ -242,7 +242,7 @@ namespace BTCPayServer.Controllers
         public async Task<IActionResult> Register(string returnUrl = null, bool logon = true)
         {
             var policies = await _SettingsRepository.GetSettingAsync<PoliciesSettings>() ?? new PoliciesSettings();
-            if (policies.LockSubscription && _userManager.Users.Count() > 0 && !User.IsInRole(Roles.ServerAdmin))
+            if (policies.LockSubscription && !User.IsInRole(Roles.ServerAdmin))
                 return RedirectToAction(nameof(HomeController.Index), "Home");
             ViewData["ReturnUrl"] = returnUrl;
             ViewData["Logon"] = logon.ToString(CultureInfo.InvariantCulture).ToLowerInvariant();
@@ -257,7 +257,7 @@ namespace BTCPayServer.Controllers
             ViewData["ReturnUrl"] = returnUrl;
             ViewData["Logon"] = logon.ToString(CultureInfo.InvariantCulture).ToLowerInvariant();
             var policies = await _SettingsRepository.GetSettingAsync<PoliciesSettings>() ?? new PoliciesSettings();
-            if (policies.LockSubscription && _userManager.Users.Count() > 0 && !User.IsInRole(Roles.ServerAdmin))
+            if (policies.LockSubscription && !User.IsInRole(Roles.ServerAdmin))
                 return RedirectToAction(nameof(HomeController.Index), "Home");
             if (ModelState.IsValid)
             {
@@ -271,6 +271,10 @@ namespace BTCPayServer.Controllers
                     {
                         await _RoleManager.CreateAsync(new IdentityRole(Roles.ServerAdmin));
                         await _userManager.AddToRoleAsync(user, Roles.ServerAdmin);
+
+                        // Once the admin user has been created lock subsequent user registrations until explicitly enabled.
+                        policies.LockSubscription = true;
+                        await _SettingsRepository.UpdateSetting(policies);
                     }
 
                     var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
diff --git a/BTCPayServer/Services/PoliciesSettings.cs b/BTCPayServer/Services/PoliciesSettings.cs
index c6c533359..b1ef0a423 100644
--- a/BTCPayServer/Services/PoliciesSettings.cs
+++ b/BTCPayServer/Services/PoliciesSettings.cs
@@ -17,6 +17,6 @@ namespace BTCPayServer.Services
 
         [JsonProperty(DefaultValueHandling = DefaultValueHandling.Populate)]
         [Display(Name = "Disable registration")]
-        public bool LockSubscription { get; set; } = true;
+        public bool LockSubscription { get; set; }
     }
 }
diff --git a/BTCPayServer/Views/Shared/_Layout.cshtml b/BTCPayServer/Views/Shared/_Layout.cshtml
index 6751bdf8a..dd9243376 100644
--- a/BTCPayServer/Views/Shared/_Layout.cshtml
+++ b/BTCPayServer/Views/Shared/_Layout.cshtml
@@ -74,7 +74,7 @@
                         </li>}
                     else
                     {
-                        @if (themeManager.ShowRegister || UserManager.Users.Count() == 0)
+                        @if (themeManager.ShowRegister)
                         {
                             <li class="nav-item"><a asp-area="" asp-controller="Account" asp-action="Register" class="nav-link js-scroll-trigger">Register</a></li>
                         }