3

craft()->users->saveUser seems to check email for uniqueness across ALL users, not just verified ones.

It seems like it should only check against verified ones to me.

Example:

  • [email protected] registers (only he fat fingered and it was supposed to be [email protected]). Bob never gets his verification email, but that's his fault. Boob gets one, doesn't know what it is and ignores it.
  • Later, the real [email protected] now tries to register, but he can't because [email protected] is sitting there unverified, squatting on that email.

At this point you could have an option to resend the activation code, however once [email protected] get that and verifies it, his account will now be the account that the other guy actually signed up for, so if you're doing stuff with accounts, it might have data associated with it you don't want.

1 Answer 1

3

I'm not sure that I agree with your analysis. At a minimum maybe it's a feature request with a config setting to change the behavior.

But if you're really concerned about the behavior, you can currently set the purgePendingUsersDuration config setting to something like 24 hours so they don't hang around very long.

1
  • Yeah, I figured it was kind of specific to my particular need. Didn't know about purgePendingUsersDuration, which will definitely help though. If I need to go further, I'll file a feature request.
    – Tim Kelty
    Jun 29, 2016 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.