ENABLE_REGISTRATION default shift in Weblate 4.16 impacts open registration

In Weblate 4.16, the default value for ENABLE_REGISTRATION shifted from True to False. This security hardening breaks automated deployment scripts that rely on public registration to create service accounts. To restore this functionality, you must explicitly override this setting.

Environment Configuration

Setting WEBLATE_ENABLE_REGISTRATION=1 in your container environment is the reliable method to enable registration in Weblate 4.16. Weblate parses this environment variable during the initialization phase; if it is missing or set to 0, the application will block the registration endpoint regardless of other configuration files.

Endpoint Behavior and Status Codes

When the flag is unset or set to False, the behavior of the /accounts/register/ endpoint depends on the environment:

• Production Mode: Typically returns a **403 Forbidden status code. The response body usually contains a JSON error indicating that registration is disabled.
• Debug Mode: May return a **302 Redirect to the login page or a more verbose error message, depending on the specific Django-based middleware stack in use.

Impact Analysis and Side Effects

Toggling ENABLE_REGISTRATION after an upgrade is generally safe for existing environments:

• Existing Users: No impact on existing accounts or authentication sessions.
• Authentication Backends: Existing LDAP, OAuth, or OIDC integrations remain unaffected as this flag only controls the self-registration form.
• Database: No schema changes are triggered.

Resolution Steps

To ensure your automated scripts continue to function, update your deployment manifest (e.g., Docker Compose or Kubernetes YAML) with the following environment variable:

environment:
  - WEBLATE_ENABLE_REGISTRATION=1

To verify the fix, run a simple curl command against your registration endpoint:

curl -X POST http://your-weblate-url/accounts/register/ -d "username=service_account&password=password123"

Note: If you still receive a 403, verify that no reverse proxy or WAF is intercepting the POST request.