craft()->users->saveUser seems to check email for uniqueness across ALL users, not just verified ones.

It seems like it should only check against verified ones to me.


  • boob@gmail.com registers (only he fat fingered and it was supposed to be bob@gmail.com). Bob never gets his verification email, but that's his fault. Boob gets one, doesn't know what it is and ignores it.
  • Later, the real boob@gmail.com now tries to register, but he can't because boob@gmail.com is sitting there unverified, squatting on that email.

At this point you could have an option to resend the activation code, however once boob@gmail.com get that and verifies it, his account will now be the account that the other guy actually signed up for, so if you're doing stuff with accounts, it might have data associated with it you don't want.

1 Answer 1


I'm not sure that I agree with your analysis. At a minimum maybe it's a feature request with a config setting to change the behavior.

But if you're really concerned about the behavior, you can currently set the purgePendingUsersDuration config setting to something like 24 hours so they don't hang around very long.

  • Yeah, I figured it was kind of specific to my particular need. Didn't know about purgePendingUsersDuration, which will definitely help though. If I need to go further, I'll file a feature request.
    – Tim Kelty
    Jun 29, 2016 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.