Bug: Unable to log in when email and password pair overlap

[yuki-takei]

Environment

• [crowi] 1.6.2

How to reproduce? (再現手順)

1. Register user1
   • email: user1@example.com
   • password: password1
2. Register user2
   • email: user2@example.com
   • password: password2
3. Login with user1@example.com (logged in as user1) and modify credentials
   1. Go to /me and change e-mail to user2@example.com
   2. Go to /me/password and change password to password2
4. Logout
5. Login with user2@example.com and password2 pair

What happens? (症状)

• user1 can log in
  • userSchema.statics.findUserByEmailAndPassword picks the old one
• user2 is unable to log in until user1 modify e-mail or password

What is the expected result? (期待される動作)

• user1 cannot modify e-mail to user2@example.com
  • should be checked whether the e-mail is reserved

Note

• Mongoose can attach unique constraint
  • http://mongoosejs.com/docs/2.7.x/docs/indexes.html
• If User.email becomes unique, statusDeleted method will be affected
  

  crowi/lib/models/user.js

  Line 242 in 56e8fe7

  this.email = 'deleted@deleted';