🐛 Fix allowing a user to update the email to the same email they already have (#696)

alejsdev · web-flow · commit 03eb49aa4d43 · 2024-03-12T19:24:35.000+01:00
diff --git a/backend/app/api/routes/users.py b/backend/app/api/routes/users.py
@@ -82,7 +82,7 @@ def update_user_me(
 
     if user_in.email:
         existing_user = crud.get_user_by_email(session=session, email=user_in.email)
-        if existing_user:
+        if existing_user and existing_user.id != current_user.id:
             raise HTTPException(
                 status_code=409, detail="User with this email already exists"
             )
@@ -184,7 +184,7 @@ def update_user(
         )
     if user_in.email:
         existing_user = crud.get_user_by_email(session=session, email=user_in.email)
-        if existing_user:
+        if existing_user and existing_user.id != user_id:
             raise HTTPException(
                 status_code=409, detail="User with this email already exists"
             )

Original file line number	Diff line number	Diff line change
`@@ -82,7 +82,7 @@ def update_user_me(`
`82`	`82`
`83`	`83`	`if user_in.email:`
`84`	`84`	`existing_user = crud.get_user_by_email(session=session, email=user_in.email)`
`85`		`- if existing_user:`
	`85`	`+ if existing_user and existing_user.id != current_user.id:`
`86`	`86`	`raise HTTPException(`
`87`	`87`	`status_code=409, detail="User with this email already exists"`
`88`	`88`	`)`
`@@ -184,7 +184,7 @@ def update_user(`
`184`	`184`	`)`
`185`	`185`	`if user_in.email:`
`186`	`186`	`existing_user = crud.get_user_by_email(session=session, email=user_in.email)`
`187`		`- if existing_user:`
	`187`	`+ if existing_user and existing_user.id != user_id:`
`188`	`188`	`raise HTTPException(`
`189`	`189`	`status_code=409, detail="User with this email already exists"`
`190`	`190`	`)`