Changing Username On Front End To Another Account Email

Question

We have a front end form for a logged in user to change their Username (email). In our testing, it does not appear to check against and prevent selecting an email address that's already taken (like happens on a login form). However, our Create Account from - which is almost identical - works.

This Form (our create account form) works and catches duplicate emails and returns an error:

<form id="createForm" method="post" accept-charset="UTF-8">

    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="{{ siteUrl }}account/signup-sent">
    <div class="input">
        <label>Email <span>*</span></label>
        <input id="signupEmail" name="email" placeholder="Email" value="" data-parsley-type="email">
    </div>
    <div class="input">
        <label>Confirm Email <span>*</span></label>
        <input id="confirmEmail" placeholder="Confirm Email" value="" data-parsley-type="email">
    </div>
    <div class="input">
        <label>Password <span>*</span></label>
        <input name="password" id="password" type="password" placeholder="Password" value="">
    </div>
    <div class="input">
        <label>Confirm Password <span>*</span></label>
        <input name="confirmPassword" id="confirmPassword" type="password" placeholder="Confirm Password" value="">
    </div>
    <input type="hidden" name="fields[accountReceiveEmails]" value="">
    <div class="checkbox">
        <input type="checkbox" name="fields[accountReceiveEmails][]" value="yes" id="emailOptin">
        <label for="emailOptin"><span class="checkbox"><span></span></span>Yes, I would also like to receive offers, discounts and news for Cadex products by email.</label>
    </div>
    <footer>
        <button>Create Account</button>
    </footer>
</form>

This is our form for users logged into their account. It does not return an error when a user tries changing their email to one that already exists in another account:

<form id="profileCredsForm" method="post" accept-charset="UTF-8">
    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="account/profile/saved">
    <input type="hidden" name="userId" value="{{ currentUser.id }}">
    <div class="input">
        <label>Current Password <span>*</span></label>
        <input id="currentPassword" name="password" placeholder="Current Password" value="" data-parsley-required="true">
    </div>

    <div class="input">
        <label>New Password</label>
        <input name="newPassword" id="newPassword" type="password" placeholder="New Password" value="">
    </div>
    <div class="input">
        <label>Confirm New Password</label>
        <input name="confirmNewPassword" id="confirmNewPassword" type="password" placeholder="Confirm New Password" value="">
    </div>

    <div class="input">
        <label>New Email</label>
        <input id="email" name="email" placeholder="New Email" value="">
    </div>
    <div class="input">
        <label>Confirm New Email</label>
        <input id="confirmNewEmail" placeholder="Confirm New Email" value="">
    </div>

    <button type="submit">Update</button>
</form>

We've tested this repeatedly, changing an email to one for another existing account and no error is returned, the form submits and the email is sent to confirm the new email address.

Also, as an aside, the confirm link in the follow up email seens to ignore the activateAccountSuccessPath set in our config. Is that expected behaviour?

Thanks.

Answer 1

Just answering this for anyone else who sees this. The case above was confirmed by Brad Bell and was fixed in Craft 2.6.2984. So, going forward, the scenario described above should return an error to handle.