Check email case insensitive in updateUser (#14950)

2 files changed, 23 insertions, 3 deletions

diff --git a/plugins/UsersManager/API.php b/plugins/UsersManager/API.php
index b5a2596d33..d7f6bc33ee 100644
--- a/plugins/UsersManager/API.php
+++ b/plugins/UsersManager/API.php
@@ -923,7 +923,9 @@ class API extends \Piwik\Plugin\API
             $email = $userInfo['email'];
         }
 
-        if ($email != $userInfo['email']) {
+        $hasEmailChanged = Common::mb_strtolower($email) !== Common::mb_strtolower($userInfo['email']);
+
+        if ($hasEmailChanged) {
             $this->checkEmail($email);
             $changeShouldRequirePasswordConfirmation = true;
         }
@@ -938,7 +940,7 @@ class API extends \Piwik\Plugin\API
 
         Cache::deleteTrackerCache();
 
-        if ($email != $userInfo['email'] && $isEmailNotificationOnInConfig) {
+        if ($hasEmailChanged && $isEmailNotificationOnInConfig) {
             $this->sendEmailChangedEmail($userInfo, $email);
         }
 
diff --git a/plugins/UsersManager/tests/Integration/APITest.php b/plugins/UsersManager/tests/Integration/APITest.php
index 6da65dcad4..7605335e88 100644
--- a/plugins/UsersManager/tests/Integration/APITest.php
+++ b/plugins/UsersManager/tests/Integration/APITest.php
@@ -143,6 +143,8 @@ class APITest extends IntegrationTestCase
 
     private $password = 'password';
 
+    private $email = 'userlogin@password.de';
+
     public function setUp()
     {
         parent::setUp();
@@ -156,7 +158,7 @@ class APITest extends IntegrationTestCase
         Fixture::createWebsite('2014-01-01 00:00:00');
         Fixture::createWebsite('2014-01-01 00:00:00');
         Fixture::createWebsite('2014-01-01 00:00:00');
-        $this->api->addUser($this->login, $this->password, 'userlogin@password.de');
+        $this->api->addUser($this->login, $this->password, $this->email);
     }
     
     public function tearDown()
@@ -348,6 +350,22 @@ class APITest extends IntegrationTestCase
         $this->assertEquals([], $subjects);
     }
 
+
+    public function test_updateUser_doesNotSendEmailIfNoChangeAndDoesNotRequirePassword()
+    {
+        $capturedMails = [];
+        Piwik::addAction('Mail.send', function (Mail $mail) use (&$capturedMails) {
+            $capturedMails[] = $mail;
+        });
+
+        $identity = FakeAccess::$identity;
+        FakeAccess::$identity = $this->login; // en
+        $this->api->updateUser($this->login, false, strtoupper($this->email), 'newAlias');
+        FakeAccess::$identity = $identity;
+
+        $this->assertEquals([], $capturedMails);
+    }
+
     public function test_updateUser_doesNotChangePasswordIfFalsey()
     {
         $model = new Model();