Bypassing registration approval using forgot password feature

[pkotnis]

Issue Summary

For Lemmy instances that currently require manual registration approval (such as lemmy.ml), I believe it is possible to bypass the approval using forgot password feature

Steps to Reproduce

1. Create an account on a Lemmy instance that requires registration approval (such as lemmy.ml)
2. Before your account gets approved, go to Lemmy's login page, provide your email/username and click "forgot password"
3. Once you receive the "Password Reset Request" email, click the link inside of it
4. Change your password
5. Voilà, you're now logged in, even tho your account is still pending approval.

[Nutomic]

Right there is a check missing. Thanks for reporting!

[dessalines]

Thanks for this!

Its these types of things that are so hard to think about beforehand.