Check email case insensitive in updateUser (#14950)

matomo-org · Oct 4, 2019 · 9c19370 · 9c19370
1 parent 07e84fd
commit 9c19370
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 3 deletions.
diff --git a/plugins/UsersManager/API.php b/plugins/UsersManager/API.php
@@ -923,7 +923,9 @@ public function updateUser($userLogin, $password = false, $email = false, $alias
             $email = $userInfo['email'];
         }
 
-        if ($email != $userInfo['email']) {
+        $hasEmailChanged = Common::mb_strtolower($email) !== Common::mb_strtolower($userInfo['email']);
+
+        if ($hasEmailChanged) {
             $this->checkEmail($email);
             $changeShouldRequirePasswordConfirmation = true;
         }
@@ -938,7 +940,7 @@ public function updateUser($userLogin, $password = false, $email = false, $alias
 
         Cache::deleteTrackerCache();
 
-        if ($email != $userInfo['email'] && $isEmailNotificationOnInConfig) {
+        if ($hasEmailChanged && $isEmailNotificationOnInConfig) {
             $this->sendEmailChangedEmail($userInfo, $email);
         }
 

diff --git a/plugins/UsersManager/tests/Integration/APITest.php b/plugins/UsersManager/tests/Integration/APITest.php
@@ -143,6 +143,8 @@ class APITest extends IntegrationTestCase
 
     private $password = 'password';
 
+    private $email = 'userlogin@password.de';
+
     public function setUp()
     {
         parent::setUp();
@@ -156,7 +158,7 @@ public function setUp()
         Fixture::createWebsite('2014-01-01 00:00:00');
         Fixture::createWebsite('2014-01-01 00:00:00');
         Fixture::createWebsite('2014-01-01 00:00:00');
-        $this->api->addUser($this->login, $this->password, 'userlogin@password.de');
+        $this->api->addUser($this->login, $this->password, $this->email);
     }
 
     public function tearDown()
@@ -348,6 +350,22 @@ public function test_updateUser_doesNotSendEmailsIfTurnedOffInConfig()
         $this->assertEquals([], $subjects);
     }
 
+
+    public function test_updateUser_doesNotSendEmailIfNoChangeAndDoesNotRequirePassword()
+    {
+        $capturedMails = [];
+        Piwik::addAction('Mail.send', function (Mail $mail) use (&$capturedMails) {
+            $capturedMails[] = $mail;
+        });
+
+        $identity = FakeAccess::$identity;
+        FakeAccess::$identity = $this->login; // en
+        $this->api->updateUser($this->login, false, strtoupper($this->email), 'newAlias');
+        FakeAccess::$identity = $identity;
+
+        $this->assertEquals([], $capturedMails);
+    }
+
     public function test_updateUser_doesNotChangePasswordIfFalsey()
     {
         $model = new Model();