don't create temporary token when smtp is not enabled

pkg/api/forget_passwords.go

@@ -57,6 +57,10 @@ func (a *ForgetPasswordsApi) UserForgetPasswordRequestHandler(c *core.Context) (
 		return nil, errs.ErrEmailIsNotVerified
 	}
 
+	if !settings.Container.Current.EnableSMTP {
+		return nil, errs.ErrSMTPServerNotEnabled
+	}
+
 	token, _, err := a.tokens.CreatePasswordResetToken(c, user)
 
 	if err != nil {

pkg/api/users.go

@@ -382,6 +382,10 @@ func (a *UsersApi) UserSendVerifyEmailByUnloginUserHandler(c *core.Context) (int
 		return nil, errs.ErrEmailIsVerified
 	}
 
+	if !settings.Container.Current.EnableSMTP {
+		return nil, errs.ErrSMTPServerNotEnabled
+	}
+
 	token, _, err := a.tokens.CreateEmailVerifyToken(c, user)
 
 	if err != nil {
@@ -417,6 +421,10 @@ func (a *UsersApi) UserSendVerifyEmailByLoginedUserHandler(c *core.Context) (int
 		return nil, errs.ErrEmailIsVerified
 	}
 
+	if !settings.Container.Current.EnableSMTP {
+		return nil, errs.ErrSMTPServerNotEnabled
+	}
+
 	token, _, err := a.tokens.CreateEmailVerifyToken(c, user)
 
 	if err != nil {