User names uniqueness is no longer accent-sensitive

Created on 19 February 2025, about 1 month ago

h3 id="summary-problem-motivation">Problem/Motivation

The username uniqueness validation in Drupal core has a critical issue with accent-sensitive characters. The implementation of case-insensitive username validation through \Drupal\Core\Validation\Plugin\Validation\Constraint\UniqueFieldValueValidator::caseInsensitiveArrayIntersect() inadvertently affects accent character handling. When creating users with accented variations of existing usernames, the validation passes incorrectly, leading to database integrity constraint violations and White Screen of Death (WSOD).

The problematic logic was introduced in 🐛 Unhandled exception when trying to register a duplicate username with different case Needs review .

Steps to reproduce

  1. Create a user with username "dezso".
  2. Create a user with username "dezső"

Expect behavior, the second user creation fails with a "The username dezső is already taken. " constraint violation error when the db insert would also fail due to the duplicate value.

Actual behavior:
Drupal\Core\Entity\EntityStorageException: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'dezső-en' for key 'user__name': INSERT INTO "users_field_data" ("uid", "langcode", "preferred_langcode", "preferred_admin_langcode", "name", "pass", "mail", "timezone", "status", "created", "changed", "access", "login", "init", "default_langcode") VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3, :db_insert_placeholder_4, :db_insert_placeholder_5, :db_insert_placeholder_6, :db_insert_placeholder_7, :db_insert_placeholder_8, :db_insert_placeholder_9, :db_insert_placeholder_10, :db_insert_placeholder_11, :db_insert_placeholder_12, :db_insert_placeholder_13, :db_insert_placeholder_14); Array ( [:db_insert_placeholder_0] => 11 [:db_insert_placeholder_1] => en [:db_insert_placeholder_2] => en [:db_insert_placeholder_3] => en [:db_insert_placeholder_4] => dezső [:db_insert_placeholder_5] => $2y...... [:db_insert_placeholder_6] => [:db_insert_placeholder_7] => UTC [:db_insert_placeholder_8] => 1 [:db_insert_placeholder_9] => 1739975168 [:db_insert_placeholder_10] => 1739975168 [:db_insert_placeholder_11] => 0 [:db_insert_placeholder_12] => 0 [:db_insert_placeholder_13] => [:db_insert_placeholder_14] => 1 ) in Drupal\Core\Entity\Sql\SqlContentEntityStorage->save() (line 817 of core/lib/Drupal/Core/Entity/Sql/SqlContentEntityStorage.php).

Proposed resolution

The UniqueFieldValueValidator::caseInsensitiveArrayIntersect() method needs to be modified to respect accent-sensitive characters while maintaining case-insensitive validation. The validation should treat accented characters as distinct from their non-accented counterparts.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

user system

Created by

🇭🇺Hungary mxr576 Hungary

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024