From dd5b9c6c46df0ba7504a57a5f252adfe485d4a47 Mon Sep 17 00:00:00 2001
From: timedout <git@nexy7574.co.uk>
Date: Wed, 26 Aug 2026 18:01:24 +0100
Subject: [PATCH] feat: Disable challengeless registration without signing a
 waiver

---
 src/api/client/account/register.rs |  5 +----
 src/core/config/check.rs           |  2 +-
 src/core/config/mod.rs             | 16 ++++++++++++++++
 src/service/firstrun/mod.rs        |  6 +-----
 src/service/uiaa/mod.rs            |  6 +-----
 src/web/pages/account/register.rs  |  4 +---
 6 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/src/api/client/account/register.rs b/src/api/client/account/register.rs
index 6d653fdd8..c9e61a2f5 100644
--- a/src/api/client/account/register.rs
+++ b/src/api/client/account/register.rs
@@ -255,10 +255,7 @@ async fn create_registration_uiaa_session(
 		if flows.is_empty() {
 			// No flows are configured. Bail out by default
 			// unless open registration was explicitly enabled.
-			if !services
-				.config
-				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-			{
+			if !services.config.enable_challengeless_registration() {
 				return Err!(Request(Forbidden(
 					"This server is not accepting registrations at this time."
 				)));
diff --git a/src/core/config/check.rs b/src/core/config/check.rs
index 0ebda4512..21058d6a2 100644
--- a/src/core/config/check.rs
+++ b/src/core/config/check.rs
@@ -180,7 +180,7 @@ pub fn check(config: &Config) -> Result {
 	}
 
 	if config.allow_registration
-		&& config.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+		&& config.enable_challengeless_registration()
 		&& config.registration_token.is_none()
 		&& config.registration_token_file.is_none()
 	{
diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index ab1b6f0e5..09368a758 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -806,6 +806,9 @@ pub struct Config {
 
 	/// Enabling this setting opens registration to anyone without restrictions.
 	/// This makes your server vulnerable to abuse
+	///
+	/// Only works if continuwuity was compiled from source with the
+	/// "openreg" compile-time feature.
 	#[serde(default)]
 	pub yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: bool,
 
@@ -2896,6 +2899,19 @@ impl Config {
 	}
 
 	pub fn check(&self) -> Result<(), Error> { check(self) }
+
+	#[cfg(debug_assertions)]
+	#[inline]
+	#[must_use]
+	pub fn enable_challengeless_registration(&self) -> bool {
+		cfg!(feature = "openreg")
+			&& self.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+	}
+
+	#[cfg(not(debug_assertions))]
+	#[inline(always)]
+	#[must_use]
+	pub fn enable_challengeless_registration(&self) -> bool { false }
 }
 
 fn true_fn() -> bool { true }
diff --git a/src/service/firstrun/mod.rs b/src/service/firstrun/mod.rs
index 85c57d9ce..6a55c72fb 100644
--- a/src/service/firstrun/mod.rs
+++ b/src/service/firstrun/mod.rs
@@ -261,11 +261,7 @@ impl Service {
 			"Find a list of Matrix clients here:".bold()
 		);
 
-		if self
-			.services
-			.config
-			.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-		{
+		if self.services.config.enable_challengeless_registration() {
 			eprintln!();
 			eprintln!(
 				"{}",
diff --git a/src/service/uiaa/mod.rs b/src/service/uiaa/mod.rs
index d9a29472f..5f49b6885 100644
--- a/src/service/uiaa/mod.rs
+++ b/src/service/uiaa/mod.rs
@@ -664,11 +664,7 @@ impl Service {
 				UntrustedFlowStatus::Unavailable
 			} else if self.services.config.recaptcha_private_site_key.is_some() || require_email {
 				UntrustedFlowStatus::Available { require_email }
-			} else if self
-				.services
-				.config
-				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-			{
+			} else if self.services.config.enable_challengeless_registration() {
 				UntrustedFlowStatus::Available { require_email: false }
 			} else {
 				UntrustedFlowStatus::Unavailable
diff --git a/src/web/pages/account/register.rs b/src/web/pages/account/register.rs
index 4f5f4f11a..4ff89e971 100644
--- a/src/web/pages/account/register.rs
+++ b/src/web/pages/account/register.rs
@@ -326,9 +326,7 @@ async fn begin_registration(
 	next: Option<LoginTarget>,
 	client: &IpAddr,
 ) -> Result<Result<Response, ValidationErrors>> {
-	let open_registration = services
-		.config
-		.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse;
+	let open_registration = services.config.enable_challengeless_registration();
 	let mut errors = ValidationErrors::new();
 
 	let user_id = match services