Prevent creating new accounts with email registered as secondary

If an email is already added as a secondary address to one account,
don't allow creating a new account using that email, unless it's
removed. Otherwise we end up with the same email address attached to
multiple different accounts, which can cause big problems downstream.

This should never have been allowed of course, but was missed when
support for secondary emails was added.

diff --git a/pgweb/account/forms.py b/pgweb/account/forms.py
index 433216962b5359b4ceb34ac3238e6eb64da41f12..6ab279e401927ab2afc6c76dc951302e8e703feb 100644 (file)
--- a/pgweb/account/forms.py
+++ b/pgweb/account/forms.py
@@ -85,11 +85,13 @@ class SignupForm(forms.Form):
     def clean_email(self):
         email = self.cleaned_data['email'].lower()
 
-        try:
-            User.objects.get(email=email)
-        except User.DoesNotExist:
-            return email
-        raise forms.ValidationError("A user with this email address is already registered")
+        if User.objects.filter(email=email).exists():
+            raise forms.ValidationError("A user with this email address is already registered")
+
+        if SecondaryEmail.objects.filter(email=email).exists():
+            raise forms.ValidationError("This email address is already attached to a different user")
+
+        return email
 
 
 class SignupOauthForm(forms.Form):

diff --git a/pgweb/account/views.py b/pgweb/account/views.py
index ec98d0ec72470243194e5be5bb11a73759f6556f..3717da106cd9b26201a1725abc3f54bea7a3112b 100644 (file)
--- a/pgweb/account/views.py
+++ b/pgweb/account/views.py
@@ -525,6 +525,10 @@ def signup_oauth(request):
        or 'oauth_lastname' not in request.session:
         return HttpSimpleResponse(request, "OAuth error", 'Invalid redirect received')
 
+    # Is this email already on a different account as a secondary one?
+    if SecondaryEmail.objects.filter(email=request.session['oauth_email'].lower()).exists():
+        return HttpSimpleResponse(request, "OAuth error", 'This email address is already attached to a different account')
+
     if request.method == 'POST':
         # Second stage, so create the account. But verify that the
         # nonce matches.