Status report confuses null email with duplicate email

I will work on this issue.

@atul_ghate, thanks for working on this issue. I am going to unassign because for Drupal core, it is preferred that contributors add a comment that they are working on an issue instead of assigning it to themselves. See Assigning ownership of a Drupal core issue → .

I've added the tests that the Security Team used when working on SA-CORE-2024-004; we'd typically wait a few weeks before committing tests that accompany a security fix, but there's no need to do so in this case.

We should add to these tests to verify the behaviour of user_requirements() when there are multiple users with a blank email.

We might want to account for the fact that could mean a couple of different things e.g. a truly NULL field in the db, or an empty string.

Plus we need to check that all 3 of core's db drivers behave themselves.

Added a new test that verifies user_requirements() doesn't incorrectly flag a couple of user accounts that both have their mail set to an empty string.

This passes locally for my with mysql.

Tests pass with mysql, sqlite, and postgres (including the new one).

Anyone happy to RTBC this on that basis?

Tested this out, and worked flawlessly. Was confused when running the related SQL it didn't output any results. This patch fixes the false positive.

The diff applies to Drupal 10.3 as well, so just a rebase/cherry-pick should work fine, but here's the same patch if needed.

Tested this on websites reporting the error, but which lacked accounts that differed by upper/lower case characters. Applying the patch resolved the error message on the status page.

My testing was on with mysql databases. Will see if I can setup tests on the others.

larowlan → credited benjifisher → .

larowlan → credited catch → .

larowlan → credited cilefen → .

larowlan → credited damienmckenna → .

larowlan → credited greggles → .

larowlan → credited kristiaanvandeneynde → .

larowlan → credited longwave → .

larowlan → credited poker10 → .

larowlan → credited zengenuity → .

Issue credits from the private issue

Committed to 11.x and backported to 10.4.x, 10.5.x and 11.1.x

10.3.x and 11.0.x are security only.