diff --git a/src/user/email.js b/src/user/email.js index 85162b8414..d6d2d32b4d 100644 --- a/src/user/email.js +++ b/src/user/email.js @@ -143,6 +143,12 @@ UserEmail.confirmByCode = async function (code, sessionId) { throw new Error('[[error:invalid-data]]'); } + // If another uid has the same email, remove it + const oldUid = await db.sortedSetScore('email:uid', confirmObj.email.toLowerCase()); + if (oldUid) { + await UserEmail.remove(oldUid, sessionId); + } + const oldEmail = await user.getUserField(confirmObj.uid, 'email'); if (oldEmail && confirmObj.email !== oldEmail) { await UserEmail.remove(confirmObj.uid, sessionId); diff --git a/test/user.js b/test/user.js index e74eb8252d..671cc06d20 100644 --- a/test/user.js +++ b/test/user.js @@ -2462,6 +2462,22 @@ describe('User', () => { assert.strictEqual(parseInt(confirmed, 10), 1); assert.strictEqual(isVerified, true); }); + + it('should remove the email from a different account if the email is already in use', async () => { + const email = 'confirm2@me.com'; + const uid = await User.create({ + username: 'confirme3', + }); + + const oldUid = await db.sortedSetScore('email:uid', email); + const code = await User.email.sendValidationEmail(uid, email); + await User.email.confirmByCode(code); + + const oldUserData = await User.getUserData(oldUid); + + assert.strictEqual((await db.sortedSetScore('email:uid', email)), uid); + assert.strictEqual(oldUserData.email, ''); + }); }); describe('user jobs', () => {