1

We have a front end form for a logged in user to change their Username (email). In our testing, it does not appear to check against and prevent selecting an email address that's already taken (like happens on a login form). However, our Create Account from - which is almost identical - works.

This Form (our create account form) works and catches duplicate emails and returns an error:

<form id="createForm" method="post" accept-charset="UTF-8">

    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="{{ siteUrl }}account/signup-sent">
    <div class="input">
        <label>Email <span>*</span></label>
        <input id="signupEmail" name="email" placeholder="Email" value="" data-parsley-type="email">
    </div>
    <div class="input">
        <label>Confirm Email <span>*</span></label>
        <input id="confirmEmail" placeholder="Confirm Email" value="" data-parsley-type="email">
    </div>
    <div class="input">
        <label>Password <span>*</span></label>
        <input name="password" id="password" type="password" placeholder="Password" value="">
    </div>
    <div class="input">
        <label>Confirm Password <span>*</span></label>
        <input name="confirmPassword" id="confirmPassword" type="password" placeholder="Confirm Password" value="">
    </div>
    <input type="hidden" name="fields[accountReceiveEmails]" value="">
    <div class="checkbox">
        <input type="checkbox" name="fields[accountReceiveEmails][]" value="yes" id="emailOptin">
        <label for="emailOptin"><span class="checkbox"><span></span></span>Yes, I would also like to receive offers, discounts and news for Cadex products by email.</label>
    </div>
    <footer>
        <button>Create Account</button>
    </footer>
</form>

This is our form for users logged into their account. It does not return an error when a user tries changing their email to one that already exists in another account:

<form id="profileCredsForm" method="post" accept-charset="UTF-8">
    {{ getCsrfInput() }}
    <input type="hidden" name="action" value="users/saveUser">
    <input type="hidden" name="redirect" value="account/profile/saved">
    <input type="hidden" name="userId" value="{{ currentUser.id }}">
    <div class="input">
        <label>Current Password <span>*</span></label>
        <input id="currentPassword" name="password" placeholder="Current Password" value="" data-parsley-required="true">
    </div>

    <div class="input">
        <label>New Password</label>
        <input name="newPassword" id="newPassword" type="password" placeholder="New Password" value="">
    </div>
    <div class="input">
        <label>Confirm New Password</label>
        <input name="confirmNewPassword" id="confirmNewPassword" type="password" placeholder="Confirm New Password" value="">
    </div>

    <div class="input">
        <label>New Email</label>
        <input id="email" name="email" placeholder="New Email" value="">
    </div>
    <div class="input">
        <label>Confirm New Email</label>
        <input id="confirmNewEmail" placeholder="Confirm New Email" value="">
    </div>

    <button type="submit">Update</button>
</form>

We've tested this repeatedly, changing an email to one for another existing account and no error is returned, the form submits and the email is sent to confirm the new email address.

Also, as an aside, the confirm link in the follow up email seens to ignore the activateAccountSuccessPath set in our config. Is that expected behaviour?

Thanks.

  • You're saying you've got one form where it works as expected and an identical form where it doesn't? – Brad Bell Jun 15 '17 at 23:02
  • I've expanded the original post with both forms. While not literally identical, I cannot see any functional difference between them that would affect this behaviour (if, indeed, logged in users should be prevented from updating their email (username) to one that already exists). FYI, twig error code and client side validation has been removed for clarity. – Mike Jun 15 '17 at 23:21
  • As far as Craft is concerned, the first is going to register a new user and the latter is going to edit an existing user. But I just did a test case with your 2nd form and changed the email to another existing email address and got the expected "Email "a@b.com" has already been taken." validation error. – Brad Bell Jun 15 '17 at 23:58
  • Wow... ok, thanks Brad. Not certain what is going on then. We have Commerce installed also but I assume that should have no affect, correct? – Mike Jun 16 '17 at 0:02
  • Wouldn't think so... if you've got xdebug.org installed, throw a breakpoint in Craft's craft/app/controllers/UsersController->actionSaveUser() and that might shed some light on what's going on. – Brad Bell Jun 16 '17 at 0:05
1

Just answering this for anyone else who sees this. The case above was confirmed by Brad Bell and was fixed in Craft 2.6.2984. So, going forward, the scenario described above should return an error to handle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.