Registration Allows Email Manipulation via Query String

[zukidlomo]

The registration page populates the read-only Email field from the default query parameter. Modifying the email value in the URL changes the read-only email displayed on the form.

The backend accepts the modified email during registration instead of validating it against the original invitation or registration context.

This allows a user to alter the email address associated with the registration process by manipulating the URL parameter.

Repro Steps:

1. Navigate to the Login page, linux-functional-adminportal-test.azurewebsites.net/login
2. Click Register.
3. Enter a valid email address and submit.
4. Open the registration link received via email.
5. In the browser address bar, modify the value of the default email parameter in the registration URL to a different email address.
6. Complete all required registration fields.
7. Submit the registration form.

Actual Result:
The registration is completed using the modified email address from the URL parameter.

Expected behaviour:
The email used for registration should be validated server-side against the invitation, token, or registration context and should not be modifiable through URL tampering.

Screenshots: